Edit tour

Windows Analysis Report
LisectAVT_2403002B_136.dll

Overview

General Information

Sample name:	LisectAVT_2403002B_136.dll
Analysis ID:	1482064
MD5:	6533cbce314b3b88abcb1686b7d26a91
SHA1:	9df9a40839182f8b52ba53d3834f4ab13e7d450b
SHA256:	30a49156bc54f010af18a0ccab0194b79a3d5a5a62c852fa23868250f7043ff8
Tags:	dllEmotetexeHeodo
Infos:

Detection

Emotet

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected Emotet

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Checks if the current process is being debugged

Connects to several IPs in different countries

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains strange resources

Potential key logger detected (key state polling based)

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7972 cmdline: loaddll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8064 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 8088 cmdline: rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

regsvr32.exe (PID: 8172 cmdline: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ppgilxcknb\mvrgiaq.kja" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 8080 cmdline: regsvr32.exe /s C:\Users\user\Desktop\LisectAVT_2403002B_136.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

rundll32.exe (PID: 8096 cmdline: rundll32.exe C:\Users\user\Desktop\LisectAVT_2403002B_136.dll,DllRegisterServer MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7232 cmdline: rundll32.exe C:\Users\user\Desktop\LisectAVT_2403002B_136.dll,DllUnregisterServer MD5: 889B99C52A60DD49227C5E485A016679)

svchost.exe (PID: 8124 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Emotet	While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.	GOLD CABIN MUMMY SPIDER Mealybug	http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ http://ropgadget.com/posts/defensive_pcres.html https://adalogics.com/blog/the-state-of-advanced-code-injections https://asec.ahnlab.com/en/33600/	https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Malware Configuration

Threatname: Emotet

{"C2 list": ["135.148.121.246:8080", "213.190.4.223:7080", "175.107.196.192:80", "46.55.222.11:443", "153.126.203.229:8080", "138.185.72.26:8080", "45.118.135.203:7080", "107.182.225.142:8080", "195.154.133.20:443", "79.172.212.216:8080", "129.232.188.93:443", "50.30.40.196:8080", "131.100.24.231:80", "58.227.42.236:80", "216.158.226.206:443", "45.118.115.99:8080", "51.254.140.238:7080", "173.212.193.249:8080", "110.232.117.186:8080", "81.0.236.90:443", "158.69.222.101:443", "103.75.201.2:443", "185.157.82.211:8080", "176.104.106.96:8080", "82.165.152.127:8080", "156.67.219.84:7080", "212.237.17.99:8080", "178.128.83.165:80", "162.243.175.63:443", "45.142.114.231:8080", "103.134.85.85:80", "178.79.147.66:8080", "31.24.158.56:8080", "103.75.201.4:443", "217.182.143.207:443", "159.8.59.82:8080", "164.68.99.3:8080", "209.126.98.206:8080", "207.38.84.195:8080", "119.235.255.201:8080", "212.24.98.99:8080", "212.237.56.116:7080", "50.116.54.215:443", "45.176.232.124:443", "203.114.109.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xd623:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x121e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xd623:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x121e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xd623:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x121e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xd623:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x121e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.rundll32.exe.4990000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.4990000.0.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xce23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
5.2.rundll32.exe.4990000.0.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x119e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
6.2.rundll32.exe.43f0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.43f0000.0.raw.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
6.2.rundll32.exe.43f0000.0.raw.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
7.2.regsvr32.exe.10000000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.10000000.1.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
7.2.regsvr32.exe.10000000.1.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
7.2.regsvr32.exe.7b0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.7b0000.0.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xce23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
7.2.regsvr32.exe.7b0000.0.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x119e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
4.2.regsvr32.exe.10000000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.10000000.1.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
4.2.regsvr32.exe.10000000.1.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
7.2.regsvr32.exe.7b0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.regsvr32.exe.7b0000.0.raw.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
7.2.regsvr32.exe.7b0000.0.raw.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
4.2.regsvr32.exe.3230000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.3230000.0.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xce23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
4.2.regsvr32.exe.3230000.0.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x119e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
5.2.rundll32.exe.10000000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.10000000.1.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
5.2.rundll32.exe.10000000.1.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
6.2.rundll32.exe.10000000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.10000000.1.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
6.2.rundll32.exe.10000000.1.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
4.2.regsvr32.exe.3230000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.regsvr32.exe.3230000.0.raw.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
4.2.regsvr32.exe.3230000.0.raw.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
6.2.rundll32.exe.43f0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.43f0000.0.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xce23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
6.2.rundll32.exe.43f0000.0.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x119e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
5.2.rundll32.exe.4990000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.4990000.0.raw.unpack	Windows_Trojan_Emotet_18379a8d	unknown	unknown	0xda23:$a: 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88
5.2.rundll32.exe.4990000.0.raw.unpack	Windows_Trojan_Emotet_1943bbf2	unknown	unknown	0x125e6:$a: 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89
Click to see the 31 entries

Sigma Signatures

System Summary

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 135.148.121.246, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\SysWOW64\regsvr32.exe, Initiated: true, ProcessId: 8172, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 135.148.121.246, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\SysWOW64\regsvr32.exe, Initiated: true, ProcessId: 8172, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 8124, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.10

Timestamp:	2024-07-25T17:49:37.808834+0200
SID:	2022930
Source Port:	443
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.10 - Destination IP: 213.190.4.223

Timestamp:	2024-07-25T17:50:37.612947+0200
SID:	2028765
Source Port:	49716
Destination Port:	7080
Protocol:	TCP
Classtype:	Unknown Traffic

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.10 - Destination IP: 135.148.121.246

Timestamp:	2024-07-25T17:49:54.174083+0200
SID:	2028765
Source Port:	49708
Destination Port:	8080
Protocol:	TCP
Classtype:	Unknown Traffic

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 40.68.123.157 - Destination IP: 192.168.2.10

Timestamp:	2024-07-25T17:50:17.475731+0200
SID:	2022930
Source Port:	443
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET JA3 Hash - [Abuse.ch] Possible Dridex - Source IP: 192.168.2.10 - Destination IP: 175.107.196.192

Timestamp:	2024-07-25T17:51:20.487949+0200
SID:	2028765
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: LisectAVT_2403002B_136.dll

Avira: detected

Found malware configuration

Source: 7.2.regsvr32.exe.10000000.1.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["135.148.121.246:8080", "213.190.4.223:7080", "175.107.196.192:80", "46.55.222.11:443", "153.126.203.229:8080", "138.185.72.26:8080", "45.118.135.203:7080", "107.182.225.142:8080", "195.154.133.20:443", "79.172.212.216:8080", "129.232.188.93:443", "50.30.40.196:8080", "131.100.24.231:80", "58.227.42.236:80", "216.158.226.206:443", "45.118.115.99:8080", "51.254.140.238:7080", "173.212.193.249:8080", "110.232.117.186:8080", "81.0.236.90:443", "158.69.222.101:443", "103.75.201.2:443", "185.157.82.211:8080", "176.104.106.96:8080", "82.165.152.127:8080", "156.67.219.84:7080", "212.237.17.99:8080", "178.128.83.165:80", "162.243.175.63:443", "45.142.114.231:8080", "103.134.85.85:80", "178.79.147.66:8080", "31.24.158.56:8080", "103.75.201.4:443", "217.182.143.207:443", "159.8.59.82:8080", "164.68.99.3:8080", "209.126.98.206:8080", "207.38.84.195:8080", "119.235.255.201:8080", "212.24.98.99:8080", "212.237.56.116:7080", "50.116.54.215:443", "45.176.232.124:443", "203.114.109.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Machine Learning detection for sample

Source: LisectAVT_2403002B_136.dll

Joe Sandbox ML: detected

Source: LisectAVT_2403002B_136.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D61172E __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,	4_2_6D61172E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D61D098 LoadIconA,FindFirstFileA,GetLastError,lstrlenA,SetLastError,__fullpath,__splitpath_s,__makepath_s,	4_2_6D61D098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D61172E __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,	5_2_6D61172E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D61D098 LoadIconA,FindFirstFileA,GetLastError,lstrlenA,SetLastError,__fullpath,__splitpath_s,__makepath_s,	5_2_6D61D098
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100227C2 FindFirstFileW,	7_2_100227C2

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D5FFC12 GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,TerminateThread,SendMessageA,ExitWindowsEx,

4_2_6D5FFC12

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 135.148.121.246:8080
Source: Malware configuration extractor	IPs: 213.190.4.223:7080
Source: Malware configuration extractor	IPs: 175.107.196.192:80
Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 153.126.203.229:8080
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 79.172.212.216:8080
Source: Malware configuration extractor	IPs: 129.232.188.93:443
Source: Malware configuration extractor	IPs: 50.30.40.196:8080
Source: Malware configuration extractor	IPs: 131.100.24.231:80
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 51.254.140.238:7080
Source: Malware configuration extractor	IPs: 173.212.193.249:8080
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 185.157.82.211:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 82.165.152.127:8080
Source: Malware configuration extractor	IPs: 156.67.219.84:7080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 178.128.83.165:80
Source: Malware configuration extractor	IPs: 162.243.175.63:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 103.134.85.85:80
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 31.24.158.56:8080
Source: Malware configuration extractor	IPs: 103.75.201.4:443
Source: Malware configuration extractor	IPs: 217.182.143.207:443
Source: Malware configuration extractor	IPs: 159.8.59.82:8080
Source: Malware configuration extractor	IPs: 164.68.99.3:8080
Source: Malware configuration extractor	IPs: 209.126.98.206:8080
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 119.235.255.201:8080
Source: Malware configuration extractor	IPs: 212.24.98.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 45.176.232.124:443
Source: Malware configuration extractor	IPs: 203.114.109.124:443

Source: unknown

Network traffic detected: IP country count 24

Source: global traffic	TCP traffic: 192.168.2.10:49708 -> 135.148.121.246:8080
Source: global traffic	TCP traffic: 192.168.2.10:49716 -> 213.190.4.223:7080

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 185.157.82.211 185.157.82.211
Source: Joe Sandbox View	IP Address: 79.172.212.216 79.172.212.216

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: S-NET-ASPL S-NET-ASPL
Source: Joe Sandbox View	ASN Name: SZERVERPLEXHU SZERVERPLEXHU

Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 135.148.121.246
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 213.190.4.223
Source: unknown	TCP traffic detected without corresponding DNS query: 175.107.196.192
Source: unknown	TCP traffic detected without corresponding DNS query: 175.107.196.192
Source: unknown	TCP traffic detected without corresponding DNS query: 175.107.196.192
Source: unknown	TCP traffic detected without corresponding DNS query: 175.107.196.192
Source: unknown	TCP traffic detected without corresponding DNS query: 175.107.196.192
Source: unknown	TCP traffic detected without corresponding DNS query: 175.107.196.192
Source: unknown	TCP traffic detected without corresponding DNS query: 175.107.196.192
Source: unknown	TCP traffic detected without corresponding DNS query: 175.107.196.192

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D61A53D recv,

4_2_6D61A53D

Source: regsvr32.exe, 00000007.00000002.2567830775.00000000005B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.148.121.246/
Source: regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.148.121.246:8080/
Source: regsvr32.exe, 00000007.00000003.1658723901.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1878908832.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbI
Source: regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbI246122658-3693405117-247675663
Source: regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbIN
Source: regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbIf
Source: regsvr32.exe, 00000007.00000002.2567830775.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://175.107.196.192/
Source: regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://175.107.196.192/ft
Source: regsvr32.exe, 00000007.00000002.2567830775.00000000005EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://175.107.196.192:80/
Source: regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://175.107.196.192:80//
Source: regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://175.107.196.192:80/U
Source: regsvr32.exe, 00000007.00000002.2567830775.0000000000611000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://175.107.196.192:80/Ua
Source: regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://175.107.196.192:80/Uhqos.dll.mui
Source: regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://175.107.196.192:80/Ul
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223/
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc)
Source: regsvr32.exe, 00000007.00000003.2307473067.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc2246122658-3693405117-247675663
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc8
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcN
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcS
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcf
Source: regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcs

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D61DB05 GetPropA,GlobalLock,SendMessageA,SendMessageA,GlobalUnlock,RemovePropA,GlobalFree,GlobalUnlock,GetAsyncKeyState,SendMessageA,

4_2_6D61DB05

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D60A4E0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	4_2_6D60A4E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62BA72 __EH_prolog3,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetParent,SendMessageA,_memset,ScreenToClient,_memset,GetCursorPos,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SetWindowPos,SendMessageA,_memset,SendMessageA,GetParent,	4_2_6D62BA72
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D6297EF ScreenToClient,_memset,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,	4_2_6D6297EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D60A4E0 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	5_2_6D60A4E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62BA72 __EH_prolog3,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetParent,SendMessageA,_memset,ScreenToClient,_memset,GetCursorPos,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SetWindowPos,SendMessageA,_memset,SendMessageA,GetParent,	5_2_6D62BA72
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6297EF ScreenToClient,_memset,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,	5_2_6D6297EF

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 5.2.rundll32.exe.4990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.43f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.3230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.3230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.43f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.rundll32.exe.4990000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 5.2.rundll32.exe.4990000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 6.2.rundll32.exe.43f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 6.2.rundll32.exe.43f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 7.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 7.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 7.2.regsvr32.exe.7b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 7.2.regsvr32.exe.7b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 4.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 4.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 7.2.regsvr32.exe.7b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 7.2.regsvr32.exe.7b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 4.2.regsvr32.exe.3230000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 4.2.regsvr32.exe.3230000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 5.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 5.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 6.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 6.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 4.2.regsvr32.exe.3230000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 4.2.regsvr32.exe.3230000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 6.2.rundll32.exe.43f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 6.2.rundll32.exe.43f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 5.2.rundll32.exe.4990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 5.2.rundll32.exe.4990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown
Source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d Author: unknown
Source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 Author: unknown

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D6001FE SendMessageA,SendMessageA,TerminateThread,SendMessageA,ExitWindowsEx,	4_2_6D6001FE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D5FFC12 GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,TerminateThread,SendMessageA,ExitWindowsEx,	4_2_6D5FFC12
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D5FFB8F GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,TerminateThread,SendMessageA,ExitWindowsEx,	4_2_6D5FFB8F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D5FF510 GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,GetWindowsDirectoryA,GetSystemDirectoryA,_strcspn,TerminateThread,SendMessageA,ExitWindowsEx,	4_2_6D5FF510
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6001FE SendMessageA,SendMessageA,TerminateThread,SendMessageA,ExitWindowsEx,	5_2_6D6001FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D5FFC12 GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,TerminateThread,SendMessageA,ExitWindowsEx,	5_2_6D5FFC12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D5FFB8F GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,TerminateThread,SendMessageA,ExitWindowsEx,	5_2_6D5FFB8F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D5FF510 GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,GetWindowsDirectoryA,GetSystemDirectoryA,_strcspn,TerminateThread,SendMessageA,ExitWindowsEx,	5_2_6D5FF510

Source: C:\Windows\SysWOW64\regsvr32.exe	File created: C:\Windows\SysWOW64\Qeraymrvqkknplm\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\SysWOW64\Ppgilxcknb\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File created: C:\Windows\SysWOW64\Fdsgo\	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Ppgilxcknb\mvrgiaq.kja:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D640DC1	4_2_6D640DC1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62ED99	4_2_6D62ED99
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D63EB49	4_2_6D63EB49
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D6025F0	4_2_6D6025F0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D63FCC9	4_2_6D63FCC9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D60BF21	4_2_6D60BF21
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62FE6E	4_2_6D62FE6E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62FA4E	4_2_6D62FA4E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D63F5D1	4_2_6D63F5D1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62F642	4_2_6D62F642
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D613699	4_2_6D613699
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D635195	4_2_6D635195
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D63F08D	4_2_6D63F08D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62F26E	4_2_6D62F26E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000303A	4_2_1000303A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100050CF	4_2_100050CF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001D15E	4_2_1001D15E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10021E49	4_2_10021E49
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10018131	4_2_10018131
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001416E	4_2_1001416E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100082D2	4_2_100082D2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10008844	4_2_10008844
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000A9CF	4_2_1000A9CF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10004B40	4_2_10004B40
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10020E7A	4_2_10020E7A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10008FE9	4_2_10008FE9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10007013	4_2_10007013
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10019054	4_2_10019054
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10013094	4_2_10013094
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10017098	4_2_10017098
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001519C	4_2_1001519C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100071E3	4_2_100071E3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10013231	4_2_10013231
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10019285	4_2_10019285
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10009343	4_2_10009343
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100213A3	4_2_100213A3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001D4AE	4_2_1001D4AE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000D4BC	4_2_1000D4BC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000958A	4_2_1000958A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100135A3	4_2_100135A3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001F5D9	4_2_1001F5D9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000364E	4_2_1000364E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10017730	4_2_10017730
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10007761	4_2_10007761
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100117D2	4_2_100117D2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001F7F4	4_2_1001F7F4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000186B	4_2_1000186B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000188C	4_2_1000188C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10013983	4_2_10013983
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001F9AF	4_2_1001F9AF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10021A0A	4_2_10021A0A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10019A0C	4_2_10019A0C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10001A5F	4_2_10001A5F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001FAD1	4_2_1001FAD1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000BB14	4_2_1000BB14
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10011B29	4_2_10011B29
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10017B9E	4_2_10017B9E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10009C1B	4_2_10009C1B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001BD63	4_2_1001BD63
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10001DCA	4_2_10001DCA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10017E3D	4_2_10017E3D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10013E89	4_2_10013E89
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001FECB	4_2_1001FECB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001DF2B	4_2_1001DF2B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10003F5A	4_2_10003F5A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10021FC7	4_2_10021FC7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001604B	4_2_1001604B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000806B	4_2_1000806B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000C151	4_2_1000C151
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001E168	4_2_1001E168
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100022F7	4_2_100022F7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10004313	4_2_10004313
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100223B9	4_2_100223B9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000A4DE	4_2_1000A4DE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000C4E5	4_2_1000C4E5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000E4F5	4_2_1000E4F5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10010503	4_2_10010503
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001E5ED	4_2_1001E5ED
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100205F6	4_2_100205F6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000E65A	4_2_1000E65A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001A683	4_2_1001A683
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100166C8	4_2_100166C8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100186EE	4_2_100186EE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10002710	4_2_10002710
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10012783	4_2_10012783
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001490E	4_2_1001490E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001A916	4_2_1001A916
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10018966	4_2_10018966
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10016998	4_2_10016998
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10020A01	4_2_10020A01
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000CA3C	4_2_1000CA3C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10012B1F	4_2_10012B1F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000ED0A	4_2_1000ED0A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000CDE0	4_2_1000CDE0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10014E54	4_2_10014E54
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10016E97	4_2_10016E97
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000AEBB	4_2_1000AEBB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001EEC2	4_2_1001EEC2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10018EF8	4_2_10018EF8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001AF0B	4_2_1001AF0B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10002F36	4_2_10002F36
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001CFA0	4_2_1001CFA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D640DC1	5_2_6D640DC1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62ED99	5_2_6D62ED99
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D63EB49	5_2_6D63EB49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6025F0	5_2_6D6025F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D63FCC9	5_2_6D63FCC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D60BF21	5_2_6D60BF21
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62FE6E	5_2_6D62FE6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62FA4E	5_2_6D62FA4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D63F5D1	5_2_6D63F5D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62F642	5_2_6D62F642
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D613699	5_2_6D613699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D635195	5_2_6D635195
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D63F08D	5_2_6D63F08D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62F26E	5_2_6D62F26E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000303A	5_2_1000303A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100050CF	5_2_100050CF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100213A3	5_2_100213A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000364E	5_2_1000364E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100117D2	5_2_100117D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021E49	5_2_10021E49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001FECB	5_2_1001FECB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10018131	5_2_10018131
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001416E	5_2_1001416E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100082D2	5_2_100082D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10008844	5_2_10008844
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000A9CF	5_2_1000A9CF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10004B40	5_2_10004B40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10014E54	5_2_10014E54
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10020E7A	5_2_10020E7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10008FE9	5_2_10008FE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10007013	5_2_10007013
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10019054	5_2_10019054
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10013094	5_2_10013094
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10017098	5_2_10017098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001D15E	5_2_1001D15E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001519C	5_2_1001519C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100071E3	5_2_100071E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10013231	5_2_10013231
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10019285	5_2_10019285
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10009343	5_2_10009343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001D4AE	5_2_1001D4AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000D4BC	5_2_1000D4BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000958A	5_2_1000958A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100135A3	5_2_100135A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001F5D9	5_2_1001F5D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10017730	5_2_10017730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10007761	5_2_10007761
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001F7F4	5_2_1001F7F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000186B	5_2_1000186B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000188C	5_2_1000188C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10013983	5_2_10013983
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001F9AF	5_2_1001F9AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021A0A	5_2_10021A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10019A0C	5_2_10019A0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001A5F	5_2_10001A5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001FAD1	5_2_1001FAD1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000BB14	5_2_1000BB14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10011B29	5_2_10011B29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10017B9E	5_2_10017B9E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10009C1B	5_2_10009C1B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001BD63	5_2_1001BD63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001DCA	5_2_10001DCA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10017E3D	5_2_10017E3D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10013E89	5_2_10013E89
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001DF2B	5_2_1001DF2B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003F5A	5_2_10003F5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021FC7	5_2_10021FC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001604B	5_2_1001604B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000806B	5_2_1000806B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000C151	5_2_1000C151
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001E168	5_2_1001E168
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100022F7	5_2_100022F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10004313	5_2_10004313
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100223B9	5_2_100223B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000A4DE	5_2_1000A4DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000C4E5	5_2_1000C4E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000E4F5	5_2_1000E4F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10010503	5_2_10010503
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001E5ED	5_2_1001E5ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100205F6	5_2_100205F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000E65A	5_2_1000E65A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001A683	5_2_1001A683
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100166C8	5_2_100166C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100186EE	5_2_100186EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002710	5_2_10002710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10012783	5_2_10012783
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001490E	5_2_1001490E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001A916	5_2_1001A916
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10018966	5_2_10018966
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10016998	5_2_10016998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10020A01	5_2_10020A01
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000CA3C	5_2_1000CA3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10012B1F	5_2_10012B1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000ED0A	5_2_1000ED0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000CDE0	5_2_1000CDE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10016E97	5_2_10016E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000AEBB	5_2_1000AEBB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001EEC2	5_2_1001EEC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10018EF8	5_2_10018EF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001AF0B	5_2_1001AF0B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002F36	5_2_10002F36
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001CFA0	5_2_1001CFA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000303A	6_2_1000303A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10008844	6_2_10008844
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021E49	6_2_10021E49
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020E7A	6_2_10020E7A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100050CF	6_2_100050CF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100082D2	6_2_100082D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10018131	6_2_10018131
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004B40	6_2_10004B40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001D15E	6_2_1001D15E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001416E	6_2_1001416E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000A9CF	6_2_1000A9CF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10008FE9	6_2_10008FE9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020A01	6_2_10020A01
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021A0A	6_2_10021A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10019A0C	6_2_10019A0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10007013	6_2_10007013
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009C1B	6_2_10009C1B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10013231	6_2_10013231
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10017E3D	6_2_10017E3D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000CA3C	6_2_1000CA3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001604B	6_2_1001604B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000364E	6_2_1000364E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10019054	6_2_10019054
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10014E54	6_2_10014E54
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000E65A	6_2_1000E65A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10001A5F	6_2_10001A5F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000806B	6_2_1000806B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000186B	6_2_1000186B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001A683	6_2_1001A683
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10019285	6_2_10019285
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10013E89	6_2_10013E89
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000188C	6_2_1000188C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10013094	6_2_10013094
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10016E97	6_2_10016E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10017098	6_2_10017098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001D4AE	6_2_1001D4AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000AEBB	6_2_1000AEBB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000D4BC	6_2_1000D4BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001EEC2	6_2_1001EEC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100166C8	6_2_100166C8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001FECB	6_2_1001FECB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001FAD1	6_2_1001FAD1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000A4DE	6_2_1000A4DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000C4E5	6_2_1000C4E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100186EE	6_2_100186EE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000E4F5	6_2_1000E4F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100022F7	6_2_100022F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10018EF8	6_2_10018EF8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010503	6_2_10010503
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001AF0B	6_2_1001AF0B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000ED0A	6_2_1000ED0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001490E	6_2_1001490E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002710	6_2_10002710
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004313	6_2_10004313
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000BB14	6_2_1000BB14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001A916	6_2_1001A916
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10012B1F	6_2_10012B1F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10011B29	6_2_10011B29
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001DF2B	6_2_1001DF2B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10017730	6_2_10017730
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002F36	6_2_10002F36
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009343	6_2_10009343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000C151	6_2_1000C151
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003F5A	6_2_10003F5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10007761	6_2_10007761
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001BD63	6_2_1001BD63
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10018966	6_2_10018966
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001E168	6_2_1001E168
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10013983	6_2_10013983
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10012783	6_2_10012783
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000958A	6_2_1000958A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10016998	6_2_10016998
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001519C	6_2_1001519C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10017B9E	6_2_10017B9E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100213A3	6_2_100213A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001CFA0	6_2_1001CFA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100135A3	6_2_100135A3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001F9AF	6_2_1001F9AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100223B9	6_2_100223B9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021FC7	6_2_10021FC7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10001DCA	6_2_10001DCA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100117D2	6_2_100117D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001F5D9	6_2_1001F5D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000CDE0	6_2_1000CDE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100071E3	6_2_100071E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001E5ED	6_2_1001E5ED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100205F6	6_2_100205F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001F7F4	6_2_1001F7F4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000303A	7_2_1000303A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10008844	7_2_10008844
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10021E49	7_2_10021E49
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10020E7A	7_2_10020E7A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10013094	7_2_10013094
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10017098	7_2_10017098
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001EEC2	7_2_1001EEC2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100050CF	7_2_100050CF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001FAD1	7_2_1001FAD1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100186EE	7_2_100186EE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10010503	7_2_10010503
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001AF0B	7_2_1001AF0B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000ED0A	7_2_1000ED0A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10002710	7_2_10002710
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10004313	7_2_10004313
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10003F5A	7_2_10003F5A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001BD63	7_2_1001BD63
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10018966	7_2_10018966
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001E168	7_2_1001E168
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001416E	7_2_1001416E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10016998	7_2_10016998
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10021FC7	7_2_10021FC7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000A9CF	7_2_1000A9CF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100117D2	7_2_100117D2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10020A01	7_2_10020A01
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10021A0A	7_2_10021A0A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10019A0C	7_2_10019A0C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10007013	7_2_10007013
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10009C1B	7_2_10009C1B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10013231	7_2_10013231
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10017E3D	7_2_10017E3D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000CA3C	7_2_1000CA3C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001604B	7_2_1001604B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000364E	7_2_1000364E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10019054	7_2_10019054
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10014E54	7_2_10014E54
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000E65A	7_2_1000E65A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10001A5F	7_2_10001A5F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000806B	7_2_1000806B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000186B	7_2_1000186B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001A683	7_2_1001A683
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10019285	7_2_10019285
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10013E89	7_2_10013E89
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000188C	7_2_1000188C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10016E97	7_2_10016E97
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001D4AE	7_2_1001D4AE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000AEBB	7_2_1000AEBB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000D4BC	7_2_1000D4BC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100166C8	7_2_100166C8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001FECB	7_2_1001FECB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100082D2	7_2_100082D2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000A4DE	7_2_1000A4DE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000C4E5	7_2_1000C4E5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000E4F5	7_2_1000E4F5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100022F7	7_2_100022F7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10018EF8	7_2_10018EF8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001490E	7_2_1001490E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000BB14	7_2_1000BB14
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001A916	7_2_1001A916
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10012B1F	7_2_10012B1F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10011B29	7_2_10011B29
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001DF2B	7_2_1001DF2B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10018131	7_2_10018131
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10017730	7_2_10017730
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10002F36	7_2_10002F36
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10004B40	7_2_10004B40
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10009343	7_2_10009343
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000C151	7_2_1000C151
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001D15E	7_2_1001D15E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10007761	7_2_10007761
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10013983	7_2_10013983
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10012783	7_2_10012783
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000958A	7_2_1000958A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001519C	7_2_1001519C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10017B9E	7_2_10017B9E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100213A3	7_2_100213A3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001CFA0	7_2_1001CFA0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100135A3	7_2_100135A3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001F9AF	7_2_1001F9AF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100223B9	7_2_100223B9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10001DCA	7_2_10001DCA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001F5D9	7_2_1001F5D9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1000CDE0	7_2_1000CDE0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100071E3	7_2_100071E3
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_10008FE9	7_2_10008FE9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001E5ED	7_2_1001E5ED
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100205F6	7_2_100205F6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_1001F7F4	7_2_1001F7F4

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6D62E597 appears 45 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6D62ECE4 appears 74 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6D60735F appears 35 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6D62E564 appears 150 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D62E597 appears 45 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D62ECE4 appears 74 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D60735F appears 35 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D62E564 appears 150 times

Source: LisectAVT_2403002B_136.dll

Static PE information: Resource name: None type: GLS_BINARY_LSB_FIRST

Source: LisectAVT_2403002B_136.dll

Binary or memory string: OriginalFilenameMJAntiVirus.EXEJ vs LisectAVT_2403002B_136.dll

Source: LisectAVT_2403002B_136.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: 5.2.rundll32.exe.4990000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 5.2.rundll32.exe.4990000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 6.2.rundll32.exe.43f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 6.2.rundll32.exe.43f0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 7.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 7.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 7.2.regsvr32.exe.7b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 7.2.regsvr32.exe.7b0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 7.2.regsvr32.exe.7b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 7.2.regsvr32.exe.7b0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.3230000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.3230000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 5.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 5.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 6.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 6.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.3230000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.3230000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 6.2.rundll32.exe.43f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 6.2.rundll32.exe.43f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 5.2.rundll32.exe.4990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 5.2.rundll32.exe.4990000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13
Source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_18379a8d reference_sample = eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827, os = windows, severity = x86, creation_date = 2021-11-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc, id = 18379a8d-f1f2-49cc-8edf-58a3ba77efe7, last_modified = 2022-01-13
Source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Emotet_1943bbf2 reference_sample = 5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38, os = windows, severity = x86, creation_date = 2021-11-18, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Emotet, fingerprint = df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa, id = 1943bbf2-56c0-443e-9208-cd8fc3b02d79, last_modified = 2022-01-13

Source: classification engine

Classification label: mal84.troj.evad.winDLL@15/0@0/45

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D5FD2D0 SendMessageA,SendMessageA,SendMessageA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,SendMessageA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,SHGetFileInfoA,SendMessageA,SHGetFileInfoA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,SendMessageA,LoadCursorA,CopyIcon,LoadCursorFromFileA,ShowCursor,ShowCursor,SetSystemCursor,ShowCursor,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,LoadMenuA,LoadIconA,_strncpy,VariantClear,VariantClear,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,VariantClear,VariantClear,VariantClear,VariantClear,		4_2_6D5FD2D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D5FD2D0 SendMessageA,SendMessageA,SendMessageA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,SendMessageA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,SHGetFileInfoA,SendMessageA,SHGetFileInfoA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,LoadIconA,SendMessageA,LoadCursorA,CopyIcon,LoadCursorFromFileA,ShowCursor,ShowCursor,SetSystemCursor,ShowCursor,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,LoadMenuA,LoadIconA,_strncpy,VariantClear,VariantClear,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,VariantClear,VariantClear,VariantClear,VariantClear,		5_2_6D5FD2D0

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 7_2_1000BE5E CreateToolhelp32Snapshot,

7_2_1000BE5E

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D613417 __EH_prolog3_GS,_memset,GetVersionExA,_malloc,_memset,CoInitializeEx,CoCreateInstance,

4_2_6D613417

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D5F9E50 CreateWindowExW,CreateWindowExW,GetLastError,ShowWindow,ShowWindow,CreateWindowExA,CreateWindowExA,ShowWindow,CreateWindowExW,GetLastError,ShowWindow,CreateWindowExA,ShowWindow,FindResourceW,LoadResource,SizeofResource,VirtualAllocExNuma,VirtualAlloc,memcpy,malloc,??3@YAXPAX@Z,_printf,

4_2_6D5F9E50

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7988:120:WilError_03

Source: LisectAVT_2403002B_136.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\regsvr32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\LisectAVT_2403002B_136.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\LisectAVT_2403002B_136.dll,DllRegisterServer
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ppgilxcknb\mvrgiaq.kja"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\LisectAVT_2403002B_136.dll,DllUnregisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\LisectAVT_2403002B_136.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\LisectAVT_2403002B_136.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\LisectAVT_2403002B_136.dll,DllUnregisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ppgilxcknb\mvrgiaq.kja"	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D5F27F0 LoadLibraryA,GetProcAddress,FreeLibrary,

4_2_6D5F27F0

Source: LisectAVT_2403002B_136.dll

Static PE information: real checksum: 0xb2582 should be: 0xb19b1

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\LisectAVT_2403002B_136.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_011910B0 pushad ; ret	0_2_011910C0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62ED29 push ecx; ret	4_2_6D62ED3C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62E63C push ecx; ret	4_2_6D62E64F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62ED29 push ecx; ret	5_2_6D62ED3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62E63C push ecx; ret	5_2_6D62E64F

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Ppgilxcknb\mvrgiaq.kja

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\regsvr32.exe	File opened: C:\Windows\SysWOW64\Qeraymrvqkknplm\tyxcw.wzk:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Ppgilxcknb\mvrgiaq.kja:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Fdsgo\rulnnl.xks:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D5FB800 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	4_2_6D5FB800
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D6078E8 IsIconic,GetWindowPlacement,GetWindowRect,	4_2_6D6078E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D5FB800 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	5_2_6D5FB800
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6078E8 IsIconic,GetWindowPlacement,GetWindowRect,	5_2_6D6078E8

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_4-43338
Source: C:\Windows\SysWOW64\rundll32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_5-43335

Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 3.0 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 3.3 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D61172E __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,	4_2_6D61172E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D61D098 LoadIconA,FindFirstFileA,GetLastError,lstrlenA,SetLastError,__fullpath,__splitpath_s,__makepath_s,	4_2_6D61D098
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D61172E __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,	5_2_6D61172E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D61D098 LoadIconA,FindFirstFileA,GetLastError,lstrlenA,SetLastError,__fullpath,__splitpath_s,__makepath_s,	5_2_6D61D098
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100227C2 FindFirstFileW,	7_2_100227C2

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D5FFC12 GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetLogicalDriveStringsA,GetDriveTypeA,GetDriveTypeA,TerminateThread,SendMessageA,ExitWindowsEx,

4_2_6D5FFC12

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D62E7DB VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

4_2_6D62E7DB

Source: regsvr32.exe, 00000004.00000002.1348729629.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: rundll32.exe, 00000005.00000002.1349996475.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: regsvr32.exe, 00000004.00000002.1348729629.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: regsvr32.exe, 00000007.00000003.1658723901.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1878908832.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000006.00000003.1348733306.0000000002A21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\u=
Source: regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@l`%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node	graph_4-43509
Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node	graph_4-43544
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_5-43506
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_5-43541

Source: C:\Windows\SysWOW64\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D62CD5C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_6D62CD5C

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D62E7DB VirtualProtect ?,-00000001,00000104,?

4_2_6D62E7DB

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D5F27F0 LoadLibraryA,GetProcAddress,FreeLibrary,

4_2_6D5F27F0

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100032AC mov eax, dword ptr fs:[00000030h]	4_2_100032AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100032AC mov eax, dword ptr fs:[00000030h]	5_2_100032AC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100032AC mov eax, dword ptr fs:[00000030h]	6_2_100032AC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 7_2_100032AC mov eax, dword ptr fs:[00000030h]	7_2_100032AC

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D5F8F00 GetNativeSystemInfo,GetProcessHeap,HeapAlloc,memcpy,

4_2_6D5F8F00

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D62CD5C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6D62CD5C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D63AF75 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6D63AF75
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D6333A4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6D6333A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D62CD5C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6D62CD5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D63AF75 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6D63AF75
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D6333A4 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6D6333A4

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	4_2_6D63E514
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	4_2_6D617787
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	5_2_6D63E514
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	5_2_6D617787

Source: C:\Windows\SysWOW64\regsvr32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D63ACD0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

4_2_6D63ACD0

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D639824 __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

4_2_6D639824

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D613417 __EH_prolog3_GS,_memset,GetVersionExA,_malloc,_memset,CoInitializeEx,CoCreateInstance,

4_2_6D613417

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 5.2.rundll32.exe.4990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.43f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.regsvr32.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.3230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.3230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.43f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4990000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D61A853 bind,	4_2_6D61A853
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D601060 PeekMessageA,SendMessageA,_memset,recv,htons,SendMessageA,inet_ntoa,inet_ntoa,SendMessageA,inet_ntoa,SendMessageA,SendMessageA,htons,htons,SendMessageA,htons,SendMessageA,SendMessageA,SendMessageA,PeekMessageA,closesocket,socket,_memset,gethostbyname,inet_ntoa,inet_addr,setsockopt,htons,bind,WSAIoctl,closesocket,	4_2_6D601060
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D61A853 bind,	5_2_6D61A853
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6D601060 PeekMessageA,SendMessageA,_memset,recv,htons,SendMessageA,inet_ntoa,inet_ntoa,SendMessageA,inet_ntoa,SendMessageA,SendMessageA,htons,htons,SendMessageA,htons,SendMessageA,SendMessageA,SendMessageA,PeekMessageA,closesocket,socket,_memset,gethostbyname,inet_ntoa,inet_addr,setsockopt,htons,bind,WSAIoctl,closesocket,	5_2_6D601060

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	2 Obfuscated Files or Information	Security Account Manager	25 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	31 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	1 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Regsvr32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Rundll32	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LisectAVT_2403002B_136.dll	100%	Avira	HEUR/AGEN.1302651
LisectAVT_2403002B_136.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://135.148.121.246/	0%	Avira URL Cloud	safe
https://213.190.4.223:7080/	0%	Avira URL Cloud	safe
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc8	0%	Avira URL Cloud	safe
https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbI246122658-3693405117-247675663	0%	Avira URL Cloud	safe
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcN	0%	Avira URL Cloud	safe
https://175.107.196.192:80/	0%	Avira URL Cloud	safe
https://175.107.196.192:80/Ua	0%	Avira URL Cloud	safe
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcS	0%	Avira URL Cloud	safe
https://175.107.196.192:80/U	0%	Avira URL Cloud	safe
https://175.107.196.192/	0%	Avira URL Cloud	safe
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc2246122658-3693405117-247675663	0%	Avira URL Cloud	safe
https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbIN	0%	Avira URL Cloud	safe
https://175.107.196.192/ft	0%	Avira URL Cloud	safe
https://213.190.4.223/	0%	Avira URL Cloud	safe
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc)	0%	Avira URL Cloud	safe
https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbI	0%	Avira URL Cloud	safe
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcf	0%	Avira URL Cloud	safe
https://135.148.121.246:8080/	0%	Avira URL Cloud	safe
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc	0%	Avira URL Cloud	safe
https://175.107.196.192:80/Ul	0%	Avira URL Cloud	safe
https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbIf	0%	Avira URL Cloud	safe
https://175.107.196.192:80/Uhqos.dll.mui	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://135.148.121.246/	regsvr32.exe, 00000007.00000002.2567830775.00000000005B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbI246122658-3693405117-247675663	regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc8	regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/	regsvr32.exe, 00000007.00000003.2093235400.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005EE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://175.107.196.192:80/U	regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://175.107.196.192/	regsvr32.exe, 00000007.00000002.2567830775.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcN	regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://175.107.196.192:80/	regsvr32.exe, 00000007.00000002.2567830775.00000000005EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcS	regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcs	regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://175.107.196.192:80/Ua	regsvr32.exe, 00000007.00000002.2567830775.0000000000611000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc)	regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc2246122658-3693405117-247675663	regsvr32.exe, 00000007.00000003.2307473067.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223/	regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWcf	regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbIN	regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://175.107.196.192/ft	regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://135.148.121.246:8080/	regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://175.107.196.192:80//	regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbI	regsvr32.exe, 00000007.00000003.1658723901.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.1878908832.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://213.190.4.223:7080/CSpUukBxAeCqYjCTSIzXqZJwEIKHfZdStBePXGBkWc	regsvr32.exe, 00000007.00000003.2093235400.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2307489165.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000003.2093235400.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://175.107.196.192:80/Ul	regsvr32.exe, 00000007.00000002.2567830775.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://175.107.196.192:80/Uhqos.dll.mui	regsvr32.exe, 00000007.00000002.2567830775.00000000005F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://135.148.121.246:8080/PCkHrOuFxHMtlfYMweFUIzHJqThoUBMBbFPHDiDbIf	regsvr32.exe, 00000007.00000003.1878833258.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
195.154.133.20	unknown	France	12876	OnlineSASFR	true
185.157.82.211	unknown	Poland	42927	S-NET-ASPL	true
79.172.212.216	unknown	Hungary	61998	SZERVERPLEXHU	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
51.254.140.238	unknown	France	16276	OVHFR	true
119.235.255.201	unknown	Indonesia	45146	RAJASA-AS-ID-APPTRajaSepadanAbadiID	true
212.24.98.99	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	true
213.190.4.223	unknown	Germany	47583	AS-HOSTINGERLT	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
153.126.203.229	unknown	Japan	7684	SAKURA-ASAKURAInternetIncJP	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
103.75.201.4	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
209.126.98.206	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
156.67.219.84	unknown	Cyprus	47583	AS-HOSTINGERLT	true
175.107.196.192	unknown	Pakistan	9541	CYBERNET-APCyberInternetServicesPvtLtdPK	true
217.182.143.207	unknown	France	16276	OVHFR	true
82.165.152.127	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
131.100.24.231	unknown	Brazil	61635	GOPLEXTELECOMUNICACOESEINTERNETLTDA-MEBR	true
135.148.121.246	unknown	United States	18676	AVAYAUS	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
173.212.193.249	unknown	Germany	51167	CONTABODE	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
45.176.232.124	unknown	Colombia	267869	CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC	true
162.243.175.63	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
31.24.158.56	unknown	Spain	50926	INFORTELECOM-ASES	true
50.30.40.196	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
164.68.99.3	unknown	Germany	51167	CONTABODE	true
103.134.85.85	unknown	Indonesia	139943	IDNIC-GARUTKAB-AS-IDDinasKomunikasidanInformatikaKabupa	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
129.232.188.93	unknown	South Africa	37153	xneeloZA	true
159.8.59.82	unknown	United States	36351	SOFTLAYERUS	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
178.128.83.165	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482064
Start date and time:	2024-07-25 17:48:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LisectAVT_2403002B_136.dll
Detection:	MAL
Classification:	mal84.troj.evad.winDLL@15/0@0/45
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 300
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target loaddll32.exe, PID 7972 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: LisectAVT_2403002B_136.dll

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
195.154.133.20	6PksShWpxo.dll	Get hash	malicious	Emotet	Browse
	rbh4.dll	Get hash	malicious	Emotet	Browse
	O11Vx8VJED.dll	Get hash	malicious	Emotet	Browse
	XqxpdSzTEl.dll	Get hash	malicious	Emotet	Browse
	file.dll	Get hash	malicious	Emotet	Browse
	NONAME.dll	Get hash	malicious	Emotet	Browse
	9818t9ks1s.dll	Get hash	malicious	Emotet	Browse
	uVPWqAOMKn.dll	Get hash	malicious	Emotet	Browse
	psIFSn7VLi.dll	Get hash	malicious	Emotet	Browse
	hexoutput2.dll	Get hash	malicious	Emotet	Browse
185.157.82.211	O11Vx8VJED.dll	Get hash	malicious	Emotet	Browse
	xyKFtTuCr6.dll	Get hash	malicious	Emotet	Browse
	file.dll	Get hash	malicious	Emotet	Browse
	file.dll	Get hash	malicious	Emotet	Browse
	NONAME.dll	Get hash	malicious	Emotet	Browse
	bscHLGMyjW.dll	Get hash	malicious	Emotet	Browse
	9818t9ks1s.dll	Get hash	malicious	Emotet	Browse
	uVPWqAOMKn.dll	Get hash	malicious	Emotet	Browse
	psIFSn7VLi.dll	Get hash	malicious	Emotet	Browse
	wTcqKKXreW.dll	Get hash	malicious	Emotet	Browse
79.172.212.216	O11Vx8VJED.dll	Get hash	malicious	Emotet	Browse
	file.dll	Get hash	malicious	Emotet	Browse
	NONAME.dll	Get hash	malicious	Emotet	Browse
	bscHLGMyjW.dll	Get hash	malicious	Emotet	Browse
	9818t9ks1s.dll	Get hash	malicious	Emotet	Browse
	uVPWqAOMKn.dll	Get hash	malicious	Emotet	Browse
	psIFSn7VLi.dll	Get hash	malicious	Emotet	Browse
	hexoutput2.dll	Get hash	malicious	Emotet	Browse
	dhtylrVZ5y.dll	Get hash	malicious	Emotet	Browse
	RIBB1B2IrQ.dll	Get hash	malicious	Emotet	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
S-NET-ASPL	A89tA7b84K.elf	Get hash	malicious	Mirai	Browse	80.82.19.176
	GiTCjsd698.elf	Get hash	malicious	Mirai	Browse	80.82.19.195
	Sayaka.x86.elf	Get hash	malicious	Mirai	Browse	80.82.19.176
	ATECHpdf.exe	Get hash	malicious	AsyncRAT, DarkTortilla	Browse	185.157.81.233
	103993900029939939_pdf.exe	Get hash	malicious	Remcos	Browse	185.157.81.233
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	80.82.19.171
	KKveTTgaAAsecNNaaaa.x86.elf	Get hash	malicious	Unknown	Browse	94.124.1.186
	PO21784.vbs	Get hash	malicious	XWorm	Browse	185.157.81.233
	IGpJmlvBoU.elf	Get hash	malicious	Mirai	Browse	80.82.19.196
	LONESTAR.EXE.exe	Get hash	malicious	AveMaria, UACMe	Browse	185.157.81.233
SZERVERPLEXHU	doc023561361500.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	37.17.172.136
	nRUMdtAXUj.img	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	37.17.172.136
	kcQ5SRSkl5.elf	Get hash	malicious	Mirai	Browse	37.17.172.72
	rWLMcEAYog.elf	Get hash	malicious	Mirai	Browse	37.17.172.72
	25u6HSl5Bw.elf	Get hash	malicious	Mirai	Browse	37.17.172.72
	7Ed8mQ5vbd.elf	Get hash	malicious	Mirai	Browse	37.17.172.72
	J7dNulUKFS.elf	Get hash	malicious	Mirai	Browse	37.17.172.72
	IJ7eMs6Nt5.elf	Get hash	malicious	Mirai	Browse	37.17.172.72
	APh2N8Of1i.elf	Get hash	malicious	Mirai	Browse	37.17.172.72
	2ix5VKG6zM.elf	Get hash	malicious	Mirai	Browse	37.17.172.72
OnlineSASFR	Setup 3.0.0.msi	Get hash	malicious	Unknown	Browse	62.210.124.132
	LisectAVT_2403002B_59.dll	Get hash	malicious	Emotet	Browse	195.154.146.35
	LisectAVT_2403002C_62.dll	Get hash	malicious	Emotet	Browse	51.15.7.145
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	163.172.129.251
	25C1.exe	Get hash	malicious	Glupteba, Xmrig	Browse	51.15.58.224
	RPHbzz3JqY.exe	Get hash	malicious	ScreenConnect Tool, PureLog Stealer, RedLine, Xmrig, zgRAT	Browse	212.47.253.124
	https://agana281.xyz/garanti/	Get hash	malicious	Unknown	Browse	51.159.84.191
	yt7dW9nyJK.exe	Get hash	malicious	WhiteSnake Stealer, XWorm	Browse	51.158.147.144
	0SpHek7Jd8.elf	Get hash	malicious	Unknown	Browse	51.159.77.156
	http://frhb68273ds.ikexpress.com	Get hash	malicious	Unknown	Browse	51.159.84.191

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.975036391230239
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	LisectAVT_2403002B_136.dll
File size:	668'160 bytes
MD5:	6533cbce314b3b88abcb1686b7d26a91
SHA1:	9df9a40839182f8b52ba53d3834f4ab13e7d450b
SHA256:	30a49156bc54f010af18a0ccab0194b79a3d5a5a62c852fa23868250f7043ff8
SHA512:	1d821140d4337270eb1769bb3a28bf415f0fe7855f538ea11ccec3ff3b1275804cc15047dceb609ffd2b410dd24f564c641237af1ccfb122de654f9c8a780b8c
SSDEEP:	12288:y6f5tUaLG1iZuyzbVysg1wuKWKDYjX3rUXY:ygHpbVy9750YjX3N
TLSH:	3DE4BE517B81C0B6C25E30B54556E37962EDA9709F3893C3BBC46A3F6E741C1993832B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........./...A...A...A.?.Q...A.......A..O,...A..O:...A...@...A.......A.....,.A.....{.A.......A.......A.......A.Rich..A.........PE..L..

File Icon


Icon Hash:	ce87b1d3e6c6ec58

Static PE Info

General

Entrypoint:	0x1003e527
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x62168D46 [Wed Feb 23 19:38:46 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	cca9170027b8a1c09e4e49e3efdfdd6a

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F978CB75487h
call 00007F978CB81C1Eh
push dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+10h]
mov edx, dword ptr [ebp+0Ch]
call 00007F978CB75371h
pop ecx
pop ebp
retn 000Ch
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov cx, word ptr [eax]
inc eax
inc eax
test cx, cx
jne 00007F978CB75478h
sub eax, dword ptr [ebp+08h]
sar eax, 1
dec eax
pop ebp
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [1006CD1Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [1006CD1Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [1006CD1Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[EXP] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x6aee0	0x72	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x68bfc	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x72000	0x2ad2c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9d000	0x70d0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x56000	0x6cc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x68b74	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5470d	0x54800	77bf2cc8d9f9ac6009e5044c19c44a78	False	0.5482444988905325	data	6.6456067202243565	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x56000	0x14f52	0x15000	57bdb4f933dd3a352b291573c8335489	False	0.3084077380952381	data	5.28195931672097	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6b000	0x6cfc	0x3200	5fbfb40e0b0775ce485cefcc0d258486	False	0.298125	data	4.554850026972256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x72000	0x2ad2c	0x2ae00	383c63981e6b3813f914150c572b16fd	False	0.8915474672011662	data	7.771415105871024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9d000	0xb528	0xb600	20572a755ce521e1d2f1956685425084	False	0.35310782967032966	data	4.916088887795584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
	0x72f28	0x22800	data	Chinese	China	1.0003609035326086
RT_CURSOR	0x95728	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x9585c	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x95910	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x95a44	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x95b78	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x95cac	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x95de0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x95f14	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x96048	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x9617c	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x962b0	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x963e4	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x96518	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x9664c	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x96780	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x968b4	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x969e8	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x96aa0	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x96be4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Chinese	China	0.491804979253112
RT_ICON	0x9918c	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	Chinese	China	0.6907407407407408
RT_ICON	0x99e34	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Chinese	China	0.7313829787234043
RT_MENU	0x9a29c	0x124	data	Chinese	China	0.6061643835616438
RT_DIALOG	0x9a3c0	0x2b2	data	Chinese	China	0.5014492753623189
RT_DIALOG	0x9a674	0x3f2	data	Chinese	China	0.4495049504950495
RT_DIALOG	0x9aa68	0x176	data	Chinese	China	0.5347593582887701
RT_DIALOG	0x9abe0	0x226	data	Chinese	China	0.4581818181818182
RT_DIALOG	0x9ae08	0x12e	data	Chinese	China	0.6291390728476821
RT_DIALOG	0x9af38	0x2e0	data	Chinese	China	0.4361413043478261
RT_DIALOG	0x9b218	0xf8	data	Chinese	China	0.6733870967741935
RT_DIALOG	0x9b310	0xd8	data	Chinese	China	0.6944444444444444
RT_DIALOG	0x9b3e8	0x9e	data	Chinese	China	0.6962025316455697
RT_DIALOG	0x9b488	0x144	data	Chinese	China	0.595679012345679
RT_DIALOG	0x9b5cc	0xfa	data	Chinese	China	0.628
RT_DIALOG	0x9b6c8	0xce	data	Chinese	China	0.6456310679611651
RT_DIALOG	0x9b798	0x2c2	data	Chinese	China	0.556657223796034
RT_DIALOG	0x9ba5c	0xca	data	Chinese	China	0.7326732673267327
RT_DIALOG	0x9bb28	0xf2	data	Chinese	China	0.6942148760330579
RT_DIALOG	0x9bc1c	0x28	data	Chinese	China	0.85
RT_DIALOG	0x9bc44	0xe2	data	Chinese	China	0.6814159292035398
RT_DIALOG	0x9bd28	0x34	data	Chinese	China	0.9038461538461539
RT_STRING	0x9bd5c	0x58	data	Chinese	China	0.7840909090909091
RT_STRING	0x9bdb4	0x4e	data	Chinese	China	0.8461538461538461
RT_STRING	0x9be04	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x9be30	0x82	data	Chinese	China	0.9307692307692308
RT_STRING	0x9beb4	0x1d6	data	Chinese	China	0.8148936170212766
RT_STRING	0x9c08c	0x160	data	Chinese	China	0.4971590909090909
RT_STRING	0x9c1ec	0x12e	data	Chinese	China	0.652317880794702
RT_STRING	0x9c31c	0x50	data	Chinese	China	0.7125
RT_STRING	0x9c36c	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x9c3b0	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x9c418	0x1b8	data	Chinese	China	0.6568181818181819
RT_STRING	0x9c5d0	0x104	data	Chinese	China	0.6038461538461538
RT_STRING	0x9c6d4	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x9c6f8	0x30	data	Chinese	China	0.625
RT_GROUP_CURSOR	0x9c728	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x9c74c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c760	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c774	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c788	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c79c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c7b0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c7c4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c7d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c7ec	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c800	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c814	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c828	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c83c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x9c850	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_ICON	0x9c864	0x30	data	Chinese	China	0.9166666666666666
RT_VERSION	0x9c894	0x320	data	Chinese	China	0.48625
RT_MANIFEST	0x9cbb4	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786
None	0x9cd10	0x1a	GLS_BINARY_LSB_FIRST	Chinese	China	0.9615384615384616

Imports

DLL	Import
KERNEL32.dll	WritePrivateProfileStringA, GetCurrentDirectoryA, FindResourceExA, GetTickCount, RtlUnwind, HeapAlloc, HeapFree, GetSystemTimeAsFileTime, GetCommandLineA, RaiseException, VirtualAlloc, GetSystemInfo, VirtualQuery, HeapReAlloc, SetStdHandle, GetFileType, ExitThread, HeapSize, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, VirtualFree, HeapCreate, HeapDestroy, GetStdHandle, GetFileTime, IsValidCodePage, GetStringTypeA, GetStringTypeW, GetTimeZoneInformation, SetHandleCount, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, InitializeCriticalSectionAndSpinCount, GetConsoleCP, GetConsoleMode, LCMapStringA, LCMapStringW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CompareStringW, SetEnvironmentVariableA, GetFileSizeEx, GetFileAttributesA, GetOEMCP, GetCPInfo, GlobalFlags, TlsFree, DeleteCriticalSection, LocalReAlloc, TlsSetValue, TlsAlloc, InitializeCriticalSection, GlobalHandle, GlobalReAlloc, EnterCriticalSection, TlsGetValue, LeaveCriticalSection, LocalAlloc, GetModuleHandleW, VirtualProtect, FileTimeToLocalFileTime, FindNextFileA, FileTimeToSystemTime, GetCurrentThread, ConvertDefaultLocale, EnumResourceLanguagesA, GetLocaleInfoA, InterlockedExchange, CreateEventA, SetEvent, InterlockedDecrement, GetCurrentProcessId, GetFullPathNameA, FindFirstFileA, FindClose, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, MoveFileA, lstrcmpA, GetThreadLocale, InterlockedIncrement, FreeResource, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, CompareStringA, lstrcmpW, GetVersionExA, GlobalFree, GlobalAlloc, GlobalLock, GlobalUnlock, FormatMessageA, LocalFree, MulDiv, lstrlenA, MultiByteToWideChar, ReadDirectoryChangesW, GetModuleFileNameA, GetVolumeInformationA, CreateThread, SetThreadPriority, GetDriveTypeA, GetWindowsDirectoryA, GetSystemDirectoryA, GetLogicalDriveStringsA, GetCurrentProcess, GetShortPathNameA, OpenProcess, ResumeThread, SuspendThread, GetExitCodeThread, TerminateThread, SetLastError, GetModuleHandleA, Sleep, CreateProcessA, WaitForSingleObject, GetLastError, ExitProcess, FindResourceA, LoadResource, LockResource, SizeofResource, CreateFileA, CloseHandle, DeleteFileA, LoadLibraryA, GetProcAddress, FreeLibrary, GetACP, WideCharToMultiByte
USER32.dll	GetNextDlgGroupItem, MessageBeep, RegisterClipboardFormatA, PostThreadMessageA, GetSysColorBrush, GetAsyncKeyState, SetWindowContextHelpId, MapDialogRect, WaitMessage, SetRectEmpty, PostQuitMessage, EndPaint, BeginPaint, GetWindowDC, ReleaseDC, GetDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, GetMessageA, TranslateMessage, ValidateRect, DestroyMenu, GetWindowThreadProcessId, GetDesktopWindow, GetActiveWindow, CreateDialogIndirectParamA, EndDialog, CharUpperA, CharNextA, IsWindowEnabled, MoveWindow, SetWindowTextA, IsDialogMessageA, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, EnableMenuItem, CheckMenuItem, RegisterWindowMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, SetWindowsHookExA, CallNextHookEx, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, GetFocus, IsWindow, SetFocus, GetWindowTextLengthA, GetWindowTextA, GetForegroundWindow, GetLastActivePopup, SetActiveWindow, DispatchMessageA, GetDlgItem, GetTopWindow, DestroyWindow, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, MapWindowPoints, TrackPopupMenu, GetKeyState, SetMenu, SetForegroundWindow, MessageBoxA, GetClassInfoExA, GetClassInfoA, RegisterClassA, AdjustWindowRectEx, GetParent, EqualRect, EnableWindow, SendMessageA, CopyRect, InflateRect, DeferWindowPos, PtInRect, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, GetMenu, GetWindowLongA, SetWindowLongA, SetWindowPos, OffsetRect, IntersectRect, SystemParametersInfoA, GetWindowPlacement, WindowFromPoint, ReleaseCapture, SetCapture, InvalidateRgn, IsRectEmpty, IsChild, CopyAcceleratorTableA, LoadBitmapA, GetMenuItemCount, GetMenuItemID, GetSubMenu, ModifyMenuA, GetClientRect, UpdateWindow, InvalidateRect, RedrawWindow, SetTimer, KillTimer, SetCursor, GetSysColor, CreateWindowExA, ShowWindow, CreateWindowExW, GetWindowRect, ClipCursor, SetSystemCursor, ShowCursor, DrawIcon, LoadMenuA, IsIconic, ScreenToClient, IsWindowVisible, LoadCursorA, LoadIconA, GetSystemMetrics, FillRect, SetRect, GetCursorPos, LoadCursorFromFileA, CopyIcon, ExitWindowsEx, PeekMessageA, PostMessageA, GetWindow, GetMenuState, GetMenuStringA, GetNextDlgTabItem
GDI32.dll	ExtSelectClipRgn, DeleteDC, CreateRectRgnIndirect, GetMapMode, GetCharWidthA, StretchDIBits, CreateCompatibleBitmap, GetRgnBox, EnumFontFamiliesExA, SetWindowExtEx, ScaleWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, Escape, TextOutA, RectVisible, PtVisible, GetWindowExtEx, GetViewportExtEx, CreateFontA, IntersectClipRect, ExcludeClipRect, SetMapMode, SetBkMode, RestoreDC, SaveDC, ExtTextOutA, GetTextColor, GetBkColor, CreateBitmap, SetBkColor, SetTextColor, GetClipBox, GetDeviceCaps, BitBlt, SelectObject, GetStockObject, CreateFontIndirectA, DeleteObject, CreateSolidBrush, StretchBlt, Rectangle, CreateCompatibleDC, GetObjectA
COMDLG32.dll	GetFileTitleA
WINSPOOL.DRV	DocumentPropertiesA, ClosePrinter, OpenPrinterA
ADVAPI32.dll	RegQueryValueA, RegEnumKeyA, RegDeleteKeyA, RegOpenKeyExA, RegOpenKeyA, RegQueryValueExA, RegCloseKey, RegCreateKeyA, RegSetValueExA, RegDeleteValueA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegCreateKeyExA
SHELL32.dll	SHBrowseForFolderA, ShellExecuteA, Shell_NotifyIconA, SHGetFileInfoA, SHGetPathFromIDListA
SHLWAPI.dll	PathIsUNCA, PathRemoveFileSpecW, PathFindExtensionA, PathStripToRootA, PathFindFileNameA
oledlg.dll
ole32.dll	CoTaskMemFree, CLSIDFromString, OleIsCurrentClipboard, OleFlushClipboard, CoRegisterMessageFilter, CoTaskMemAlloc, CoUninitialize, CoInitializeEx, CoGetClassObject, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, OleUninitialize, CoFreeUnusedLibraries, OleInitialize, CoRevokeClassObject, CoCreateInstance, CLSIDFromProgID
OLEAUT32.dll	VariantChangeType, SysFreeString, SysStringLen, SysAllocString, SysAllocStringByteLen, VariantInit, SysAllocStringLen, OleCreateFontIndirect, VariantCopy, SafeArrayDestroy, VariantTimeToSystemTime, SystemTimeToVariantTime, VariantClear
WS2_32.dll	WSACleanup, accept, select, htonl, WSAGetLastError, WSASetLastError, connect, sendto, recvfrom, WSAAsyncSelect, send, socket, gethostbyname, inet_addr, setsockopt, htons, bind, WSAIoctl, recv, ntohs, inet_ntoa, closesocket, WSAStartup
PSAPI.DLL	EnumProcessModules, EnumProcesses, GetModuleFileNameExA

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x10008c30
DllUnregisterServer	2	0x10008ce0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-25T17:49:37.808834+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49709	40.68.123.157	192.168.2.10
2024-07-25T17:50:37.612947+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49716	7080	192.168.2.10	213.190.4.223
2024-07-25T17:49:54.174083+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49708	8080	192.168.2.10	135.148.121.246
2024-07-25T17:50:17.475731+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49714	40.68.123.157	192.168.2.10
2024-07-25T17:51:20.487949+0200	TCP	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	49719	80	192.168.2.10	175.107.196.192

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 25, 2024 17:49:32.792500019 CEST	49708	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:49:32.799031019 CEST	8080	49708	135.148.121.246	192.168.2.10
Jul 25, 2024 17:49:32.799165964 CEST	49708	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:49:32.810743093 CEST	49708	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:49:32.817770004 CEST	8080	49708	135.148.121.246	192.168.2.10
Jul 25, 2024 17:49:54.173981905 CEST	8080	49708	135.148.121.246	192.168.2.10
Jul 25, 2024 17:49:54.174082994 CEST	49708	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:49:54.174196005 CEST	49708	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:49:54.179059029 CEST	8080	49708	135.148.121.246	192.168.2.10
Jul 25, 2024 17:49:54.180344105 CEST	49713	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:49:54.185247898 CEST	8080	49713	135.148.121.246	192.168.2.10
Jul 25, 2024 17:49:54.185923100 CEST	49713	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:49:54.185923100 CEST	49713	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:49:54.190840006 CEST	8080	49713	135.148.121.246	192.168.2.10
Jul 25, 2024 17:50:16.167201996 CEST	8080	49713	135.148.121.246	192.168.2.10
Jul 25, 2024 17:50:16.167361021 CEST	49713	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:50:16.167462111 CEST	49713	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:50:16.167929888 CEST	8080	49713	135.148.121.246	192.168.2.10
Jul 25, 2024 17:50:16.167980909 CEST	49713	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:50:16.168553114 CEST	8080	49713	135.148.121.246	192.168.2.10
Jul 25, 2024 17:50:16.168602943 CEST	49713	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:50:16.170875072 CEST	49715	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:50:16.172893047 CEST	8080	49713	135.148.121.246	192.168.2.10
Jul 25, 2024 17:50:16.178544998 CEST	8080	49715	135.148.121.246	192.168.2.10
Jul 25, 2024 17:50:16.178668976 CEST	49715	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:50:16.178843975 CEST	49715	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:50:16.186456919 CEST	8080	49715	135.148.121.246	192.168.2.10
Jul 25, 2024 17:50:16.200503111 CEST	49716	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:16.204551935 CEST	8080	49715	135.148.121.246	192.168.2.10
Jul 25, 2024 17:50:16.204638004 CEST	49715	8080	192.168.2.10	135.148.121.246
Jul 25, 2024 17:50:16.206327915 CEST	7080	49716	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:16.206415892 CEST	49716	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:16.206737041 CEST	49716	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:16.212070942 CEST	7080	49716	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:37.612843037 CEST	7080	49716	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:37.612946987 CEST	49716	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:37.624778032 CEST	49716	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:37.629808903 CEST	7080	49716	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:37.636965036 CEST	49717	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:37.648411036 CEST	7080	49717	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:37.648628950 CEST	49717	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:37.649034977 CEST	49717	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:37.653908968 CEST	7080	49717	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:59.041941881 CEST	7080	49717	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:59.042069912 CEST	49717	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:59.042182922 CEST	49717	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:59.042854071 CEST	49718	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:59.048762083 CEST	7080	49717	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:59.048780918 CEST	7080	49718	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:59.048893929 CEST	49718	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:59.049030066 CEST	49718	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:59.058638096 CEST	7080	49718	213.190.4.223	192.168.2.10
Jul 25, 2024 17:50:59.058712959 CEST	49718	7080	192.168.2.10	213.190.4.223
Jul 25, 2024 17:50:59.060978889 CEST	49719	80	192.168.2.10	175.107.196.192
Jul 25, 2024 17:50:59.068340063 CEST	80	49719	175.107.196.192	192.168.2.10
Jul 25, 2024 17:50:59.068526983 CEST	49719	80	192.168.2.10	175.107.196.192
Jul 25, 2024 17:50:59.068876028 CEST	49719	80	192.168.2.10	175.107.196.192
Jul 25, 2024 17:50:59.073782921 CEST	80	49719	175.107.196.192	192.168.2.10
Jul 25, 2024 17:51:20.487788916 CEST	80	49719	175.107.196.192	192.168.2.10
Jul 25, 2024 17:51:20.487948895 CEST	49719	80	192.168.2.10	175.107.196.192
Jul 25, 2024 17:51:20.488374949 CEST	49719	80	192.168.2.10	175.107.196.192
Jul 25, 2024 17:51:20.493213892 CEST	80	49719	175.107.196.192	192.168.2.10
Jul 25, 2024 17:51:20.495786905 CEST	49720	80	192.168.2.10	175.107.196.192
Jul 25, 2024 17:51:20.500818014 CEST	80	49720	175.107.196.192	192.168.2.10
Jul 25, 2024 17:51:20.504098892 CEST	49720	80	192.168.2.10	175.107.196.192
Jul 25, 2024 17:51:20.505332947 CEST	49720	80	192.168.2.10	175.107.196.192
Jul 25, 2024 17:51:20.510222912 CEST	80	49720	175.107.196.192	192.168.2.10

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49719	175.107.196.192	80	8172	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 17:50:59.068876028 CEST	149	OUT	Data Raw: 16 03 03 00 90 01 00 00 8c 03 03 66 a2 74 62 2e 64 07 4e 86 b5 a5 41 0b 15 78 cb 5b d4 c3 73 64 d8 7f 38 d3 25 30 3b 07 60 a5 f8 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: ftb.dNAx[sd8%0;`&,+0/$#('=<5/=#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49720	175.107.196.192	80	8172	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 25, 2024 17:51:20.505332947 CEST	95	OUT	Data Raw: 16 03 01 00 5a 01 00 00 56 03 01 66 a2 74 78 cd 3b 82 3d b6 df c1 c9 32 ca 75 ea de d9 9d fa 67 a7 47 3e 2b bc c6 6d 4a e3 78 d2 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 1f 00 0a 00 08 00 06 00 1d 00 17 00 18 00 0b 00 02 01 00 Data Ascii: ZVftx;=2ugG>+mJx5/#

Target ID:	0
Start time:	11:49:19
Start date:	25/07/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll"
Imagebase:	0x610000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:49:20
Start date:	25/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:49:20
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1
Imagebase:	0xd70000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:49:20
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\LisectAVT_2403002B_136.dll
Imagebase:	0x8c0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_18379a8d, Description: unknown, Source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Emotet_1943bbf2, Description: unknown, Source: 00000004.00000002.1348904110.0000000003230000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_18379a8d, Description: unknown, Source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Emotet_1943bbf2, Description: unknown, Source: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:49:20
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\LisectAVT_2403002B_136.dll",#1
Imagebase:	0x10000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_18379a8d, Description: unknown, Source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Emotet_1943bbf2, Description: unknown, Source: 00000005.00000002.1352450283.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_18379a8d, Description: unknown, Source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Emotet_1943bbf2, Description: unknown, Source: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:49:21
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\LisectAVT_2403002B_136.dll,DllRegisterServer
Imagebase:	0x10000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_18379a8d, Description: unknown, Source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Emotet_1943bbf2, Description: unknown, Source: 00000006.00000002.1350149521.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_18379a8d, Description: unknown, Source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Emotet_1943bbf2, Description: unknown, Source: 00000006.00000002.1349958242.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:49:22
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Ppgilxcknb\mvrgiaq.kja"
Imagebase:	0x8c0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_18379a8d, Description: unknown, Source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Emotet_1943bbf2, Description: unknown, Source: 00000007.00000002.2568053919.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Emotet_18379a8d, Description: unknown, Source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Emotet_1943bbf2, Description: unknown, Source: 00000007.00000002.2568502809.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:49:24
Start date:	25/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\LisectAVT_2403002B_136.dll,DllUnregisterServer
Imagebase:	0x10000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:50:04
Start date:	25/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	32.8%
Signature Coverage:	22.9%
Total number of Nodes:	597
Total number of Limit Nodes:	24

Executed Functions

Function 100050CF Relevance: 41.1, Strings: 32, Instructions: 1098
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[, xrefs: 100060BE
~<N, xrefs: 10005669
\me, xrefs: 10005E5F
tZw, xrefs: 100055E1
X@, xrefs: 10005D03
vx, xrefs: 10006074
xO, xrefs: 10005CB5
6], xrefs: 10006099
&G+, xrefs: 10005C09
Cf, xrefs: 10005711
(n[, xrefs: 10005C5D
~/\, xrefs: 10005FCC
`, xrefs: 10005661
_$, xrefs: 10005B50
l}, xrefs: 100060D1
OTLr, xrefs: 100061AC
E, xrefs: 10005623
Q|?4, xrefs: 1000520F
xNEa, xrefs: 1000527E
Oj, xrefs: 10005F94
"T, xrefs: 10006143
lA, xrefs: 10006303
8#B, xrefs: 100062F0
:_, xrefs: 10005EFE
'\, xrefs: 10005D60
>u, xrefs: 10006232
q~, xrefs: 10005639
:mNi, xrefs: 10005400
sC6, xrefs: 100052F8
iQ\, xrefs: 10005CD6
"', xrefs: 100061F0
k*, xrefs: 1000580D

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Oj$"'$"T$&G+$'\$(n[$6]$8#B$:_$:mNi$>u$Cf$OTLr$Q|?4$X@$\me$_$$`$iQ\$k*$lA$l}$q~$sC6$tZw$vx$xNEa$xO$~<N$~/\$E$[
API String ID: 0-2492860842
Opcode ID: 16efcb974439c1d451e530cacd7df416dc62e14d7d365bcb784cfd0690774994
Instruction ID: 0ca780e8e6c5d3ca7df22d1ee8fce045869506c151b6bbe6d64f3ca6b22b76ed
Opcode Fuzzy Hash: 16efcb974439c1d451e530cacd7df416dc62e14d7d365bcb784cfd0690774994
Instruction Fuzzy Hash: 68D203719083818BD3B4CF25C94ABCFBBE1FB84344F10891DE5D996264DBB19949CF82

Function 6D5F9E50 Relevance: 38.9, APIs: 19, Strings: 3, Instructions: 385
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(000003DB,6D647884,6D64789C,00000038,00000156,000022B7,0000007B,00000379,00000000,00000000,00000000,00000000), ref: 6D5F9EA5
GetLastError.KERNEL32(?,?,?,?), ref: 6D5F9EAB
ShowWindow.USER32(00000000,00000000,?,?,?,?), ref: 6D5F9EB9
CreateWindowExA.USER32(00000298,??????????,????????9,00000060,000001BB,00001A11,00000001,00000379,00000000,00000000,00000000,00000000), ref: 6D5F9EE7
ShowWindow.USER32(00000000,00000000,?,?,?,?), ref: 6D5F9EEF
CreateWindowExW.USER32(000003DB,6D647884,6D64789C,00000038,00000156,000022B7,0000007B,00000379,00000000,00000000,00000000,00000000), ref: 6D5FA083
GetLastError.KERNEL32(?,?,?,?), ref: 6D5FA089
ShowWindow.USER32(00000000,00000000,?,?,?,?), ref: 6D5FA091
CreateWindowExA.USER32(00000298,??????????,????????9,00000060,000001BB,00001A11,00000001,00000379,00000000,00000000,00000000,00000000), ref: 6D5FA0B9
ShowWindow.USER32(00000000,00000000,?,?,?,?), ref: 6D5FA0C1
FindResourceW.KERNEL32(?,00000145,6D647BA8), ref: 6D5FA272
LoadResource.KERNEL32(?,00000000), ref: 6D5FA278
SizeofResource.KERNEL32(?,00000000), ref: 6D5FA284
VirtualAllocExNuma.KERNEL32(000000FF,00000000,00000000,00003000,00000040,00000000), ref: 6D5FA309
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 6D5FA31A
memcpy.MSVCRT ref: 6D5FA329
malloc.MSVCRT ref: 6D5FA334
??3@YAXPAX@Z.MSVCRT ref: 6D5FA352
_printf.LIBCMT ref: 6D5FA394

Strings

????????9, xrefs: 6D5F9ED8, 6D5FA0AA
r_xav$na2L)FOeT1#qD3SWR#DOQBz@h?&+hyJ%CbY*j1z%k(kSwUX$ELDIxwfuhbyDIe, xrefs: 6D5FA33E
??????????, xrefs: 6D5F9EDD, 6D5FA0AF

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$CreateShow$Resource$AllocErrorLastVirtual$??3@FindLoadNumaSizeof_printfmallocmemcpy
String ID: ????????9$??????????$r_xav$na2L)FOeT1#qD3SWR#DOQBz@h?&+hyJ%CbY*j1z%k(kSwUX$ELDIxwfuhbyDIe
API String ID: 174387922-3902351054
Opcode ID: 1bbe36c25a5355dfe9ac0e5744b0b0b2cd56a67a7057fff66db542b6f708e372
Instruction ID: 43223f5e514267f23d21e801e338434acdd2e4152d8a15516941f9d8a5060ad5
Opcode Fuzzy Hash: 1bbe36c25a5355dfe9ac0e5744b0b0b2cd56a67a7057fff66db542b6f708e372
Instruction Fuzzy Hash: 5FD1D6B0508300ABDB14DF76CC44F2BBABDEF99744F40842DF205DB695E7B498418B69

Function 10008844 Relevance: 9.0, Strings: 7, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QK, xrefs: 100088F8
h<, xrefs: 10008AE7
gQ, xrefs: 10008A91
g, xrefs: 10008900
d{?, xrefs: 10008859
?9f, xrefs: 10008925
d{?, xrefs: 10008B58

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: QK$d{?$d{?$gQ$h<$?9f$g
API String ID: 0-2100959024
Opcode ID: afb44c38ff591c7eb86675b97b0fe78ce17a80bd4f236fd940f8323b3a904e18
Instruction ID: 22421128e17db2e479f0332a8848cf53d85b6a0606959b7a6e3c5012cdb7efb2
Opcode Fuzzy Hash: afb44c38ff591c7eb86675b97b0fe78ce17a80bd4f236fd940f8323b3a904e18
Instruction Fuzzy Hash: 2EC132B1108380DFD358CF25D58A81BFBE1FBC4798F204A1DF6969A260D7B59A49CF42

Function 10020E7A Relevance: 9.0, Strings: 7, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$Y, xrefs: 10020FA3
I, xrefs: 100210B5
D@, xrefs: 1002101D
u:, xrefs: 1002105B
Aj_, xrefs: 100212C6
1$, xrefs: 1002118D
>!, xrefs: 100210CD

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $Y$1$$>!$Aj_$I$u:$D@
API String ID: 0-228290010
Opcode ID: 4bac98933db578142025bd5de0b79407f17bba23569f3914af7c11532390db40
Instruction ID: 43eb3b82835ae4936c648a6799011c4b7b2a732330e3ee2ca4c8489c9f810665
Opcode Fuzzy Hash: 4bac98933db578142025bd5de0b79407f17bba23569f3914af7c11532390db40
Instruction Fuzzy Hash: 42B14FB29093409FD368CE61D98944BFBE2FBC4748F508A1DF59996260D3B58909CF43

Function 10018131 Relevance: 7.8, Strings: 6, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E, xrefs: 10018558
<Y!, xrefs: 1001852F
p, xrefs: 100182EE
?Lw, xrefs: 100181AB
Ys, xrefs: 10018405
3, xrefs: 100184B8

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: <Y!$p$3$?Lw$E$Ys
API String ID: 0-486402316
Opcode ID: ff89d9ba8b554419387cafcbdc69e02e6a2ddf58c810c1d78c5e84ac65e0c7d6
Instruction ID: 92d0d05202b49f1ea2f7db499494a9b181594d53508c8ad18110db894d1cafa3
Opcode Fuzzy Hash: ff89d9ba8b554419387cafcbdc69e02e6a2ddf58c810c1d78c5e84ac65e0c7d6
Instruction Fuzzy Hash: 01E10FB14087819FD368CF26C58A54BFBE1FBC4758F108A1DF2E986260D7B58A49CF46

Function 6D5F8F00 Relevance: 7.0, APIs: 4, Instructions: 1014
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,6D5F9E4A), ref: 6D5F9372
GetProcessHeap.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D5F96C3
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D5F96CA
memcpy.MSVCRT ref: 6D5F98FD

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Heap$AllocInfoNativeProcessSystemmemcpy
String ID:
API String ID: 1755227880-0
Opcode ID: ec2c6059ed377d33e8d6246b51807059d0709185b064fd069032004878b02b99
Instruction ID: 12bf44e2ac87075645a2be686fe6bebea7c57dd29ef81d586f769568da5bb17b
Opcode Fuzzy Hash: ec2c6059ed377d33e8d6246b51807059d0709185b064fd069032004878b02b99
Instruction Fuzzy Hash: D29252326042068FCB0CCF2DCA96B69B7F6FBD9304B05862ED455CB669EB34E549CB50

Function 1001416E Relevance: 5.3, Strings: 4, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

E, xrefs: 100142CF
&5x, xrefs: 1001419E
;>, xrefs: 10014285
&,d6, xrefs: 100145EE

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &,d6$&5x$;>$E
API String ID: 0-3806806301
Opcode ID: 7c2134be2eb18cd13f10686fce004f04cdd4fa52c3faffe3a96f0d323648a8e6
Instruction ID: c4249043e1505906f2e8491d7d313bad1be218572f8ee4b4ca1037bc860b6bb4
Opcode Fuzzy Hash: 7c2134be2eb18cd13f10686fce004f04cdd4fa52c3faffe3a96f0d323648a8e6
Instruction Fuzzy Hash: 360211715093808FD3A8CF65C58AA4BFBF1FBC5758F108A1DE1998A260DBB18949CF43

Function 1000A9CF Relevance: 5.2, Strings: 4, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?p, xrefs: 1000AAFA
,", xrefs: 1000AA3F
:, xrefs: 1000AB0F
8&d, xrefs: 1000AB4E

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?p$,"$8&d$:
API String ID: 0-3128282930
Opcode ID: c60055a3fdf1bd35788913f74c333988149bb5ad6d284b2660bc3ac36f085380
Instruction ID: 5a46479afb2b1dd9e968da21cfefa329b56c1398546182726cde7f2f559757ce
Opcode Fuzzy Hash: c60055a3fdf1bd35788913f74c333988149bb5ad6d284b2660bc3ac36f085380
Instruction Fuzzy Hash: 9EA166329083419FD354CF64D58580BFBE1FBC5798F214A2EF99A97260D7B1C9898F82

Function 1001D15E Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1p, xrefs: 1001D1FE
~{, xrefs: 1001D1E6
z, xrefs: 1001D22B

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 1p$~{$z
API String ID: 0-2708623661
Opcode ID: 8766d8a71e2a1298c84489c6c1cceafeb0d3201740f274e4a4e270c79279ce57
Instruction ID: 50e172c0167052c35ac88551bb24e246da60be2ded239d08042f06b44d8181c9
Opcode Fuzzy Hash: 8766d8a71e2a1298c84489c6c1cceafeb0d3201740f274e4a4e270c79279ce57
Instruction Fuzzy Hash: B0819971508341AFC398EF25D48541FBBE1FBC4798F50990EF6965A2A0C3B4C9898F83

Function 100082D2 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

n7k, xrefs: 100084B1
]!, xrefs: 1000853E
)(, xrefs: 10008519

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )($]!$n7k
API String ID: 0-315496457
Opcode ID: b558780e853551f3f9c23f71012fe90e0371ebd48997d0f5c21fe4cc8cd028c2
Instruction ID: 6b4521325a750d3f19cdbe5b0346c522479ea2c922a2c3cfe6037406b2560a2d
Opcode Fuzzy Hash: b558780e853551f3f9c23f71012fe90e0371ebd48997d0f5c21fe4cc8cd028c2
Instruction Fuzzy Hash: 61910EB11093429FC398CF24D98A81FBBE1FBC4798F505A1DF5D696260D7B18A498F83

Function 10008FE9 Relevance: 3.9, Strings: 3, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

VN, xrefs: 10009045
!P8, xrefs: 10009088
hJ(, xrefs: 10009168

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: !P8$VN$hJ(
API String ID: 4033686569-2871701308
Opcode ID: 76e52cf6eb6a1bf6e45a908f08b86a198da54be04cef5d76bbcf8f26464d6352
Instruction ID: 00ae266da5185bfa8b8ee3393b41d8efe762ba7875e14d4be67c4de66fd4d218
Opcode Fuzzy Hash: 76e52cf6eb6a1bf6e45a908f08b86a198da54be04cef5d76bbcf8f26464d6352
Instruction Fuzzy Hash: 68512375D00209EBDF08CFE1D98A9EEFBB2FB44318F208159E415B6260D7B91A45CF94

Function 10004B40 Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

76(N, xrefs: 10004CAB
+=8, xrefs: 10004CCB

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +=8$76(N
API String ID: 0-1438774008
Opcode ID: 1db2f9c43d7fe5329084669e1915b1fd4bcac671b522587addb6cecd1a5ce235
Instruction ID: 196a10c481b5a77a8d7152cfa042693d09a5a61cd9082af3a7f707929fc926f6
Opcode Fuzzy Hash: 1db2f9c43d7fe5329084669e1915b1fd4bcac671b522587addb6cecd1a5ce235
Instruction Fuzzy Hash: E5A10DB5D0131DABDF58CFE0D98A8DEBBB1FB44318F208159E112BA260E7B45A49CF54

Function 1000303A Relevance: 2.5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

Strings

2*<, xrefs: 100030B1
W, xrefs: 10003072

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: 2*<$W
API String ID: 1279760036-2887220841
Opcode ID: ebc570e0260719ffb43f7d75e55fb17aa819b37f5b8bab0ae8db23e12aeef9f6
Instruction ID: c7591d9692ef72757aabe1e75111c8b409abcfe8ac2fa10615e5c07fcf9b388e
Opcode Fuzzy Hash: ebc570e0260719ffb43f7d75e55fb17aa819b37f5b8bab0ae8db23e12aeef9f6
Instruction Fuzzy Hash: 3921DCB2C0131EEBCF45CFE5C98A5EEBBB1BB00319F208188D81576260D3B95B599F81

Function 10021E49 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: db05d33033e35e924a0e4c64544afa6b7f49e34129bff3b41e0ecab6e9a2ba1d
Instruction ID: b5f1d4df7aeb2fdbd5bd533b0ba3fa134ffc9e59177317b4f14a1d0ac660e1ca
Opcode Fuzzy Hash: db05d33033e35e924a0e4c64544afa6b7f49e34129bff3b41e0ecab6e9a2ba1d
Instruction Fuzzy Hash: 2C411DB5D00219EBDF44CFE5C98A5EEBBB1FB48314F208089D912B6260C3B50A46CFA5

Function 6D61FB51 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(6D65FDD4,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FB64
GlobalAlloc.KERNEL32(00000002,00000000,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FBBA
GlobalHandle.KERNEL32(02FE6F78), ref: 6D61FBC3
GlobalUnlock.KERNEL32(00000000,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FBCD
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 6D61FBE6
GlobalHandle.KERNEL32(02FE6F78), ref: 6D61FBF8
GlobalLock.KERNEL32(00000000,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FBFF
LeaveCriticalSection.KERNEL32(?,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FC08
GlobalLock.KERNEL32(00000000,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FC14
_memset.LIBCMT ref: 6D61FC2E
LeaveCriticalSection.KERNEL32(?), ref: 6D61FC5C

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 8682525342c11a247afe3911f6a1778c1f2b84c0db25c711e07f0017621161e6
Instruction ID: d63488a39a3086ec2bd4dbf5c3f6528bd06f4b62652ab8d8e86b5e4026a03420
Opcode Fuzzy Hash: 8682525342c11a247afe3911f6a1778c1f2b84c0db25c711e07f0017621161e6
Instruction Fuzzy Hash: 3C31E3B2608705AFDB20DFA9CC88B5B77F9EF88304B018829EA56C3500DB71F8408B90

Function 6D5F8C30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(000003DB,6D647884,6D64789C,00000038,00000156,000022B7,0000007B,00000379,00000000,00000000,00000000,00000000), ref: 6D5F8C5A
GetLastError.KERNEL32 ref: 6D5F8C64
ShowWindow.USER32(00000000,00000000), ref: 6D5F8C75
CreateWindowExA.USER32(00000298,??????????,????????9,00000060,000001BB,00001A11,00000001,00000379,00000000,00000000,00000000,00000000), ref: 6D5F8CA1
ShowWindow.USER32(00000000,00000000), ref: 6D5F8CAF
ExitProcess.KERNEL32 ref: 6D5F8CBC

Strings

DllRegisterServer, xrefs: 6D5F8CC2
????????9, xrefs: 6D5F8C92
??????????, xrefs: 6D5F8C97

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$CreateShow$ErrorExitLastProcess
String ID: ????????9$??????????$DllRegisterServer
API String ID: 356722023-1345309269
Opcode ID: 934d745af515516939e95c65ff34fe3229594a013830ffd063716609eb7437bf
Instruction ID: 8f6571f801edb580da0d28cfe3887a0fc5bc2758a9756b0119484c00ec35b7a7
Opcode Fuzzy Hash: 934d745af515516939e95c65ff34fe3229594a013830ffd063716609eb7437bf
Instruction Fuzzy Hash: F6013CB1BC5300BBFB6426B24C4BF962A684719F06F10C422F705FE0C1DBD0B04489EA

Function 6D62CED5 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 6D62CEF3

Part of subcall function 6D634C64: __mtinitlocknum.LIBCMT ref: 6D634C7A
Part of subcall function 6D634C64: __amsg_exit.LIBCMT ref: 6D634C86
Part of subcall function 6D634C64: EnterCriticalSection.KERNEL32(00000000,00000000,?,6D63455A,0000000D,6D6587F0,00000008,6D634651,00000000,?,6D62E427,00000000,?,?,?,6D62E48A), ref: 6D634C8E

___sbh_find_block.LIBCMT ref: 6D62CEFE
___sbh_free_block.LIBCMT ref: 6D62CF0D
RtlFreeHeap.NTDLL(00000000,00000000,6D658320,0000000C,6D6344A0,00000000,?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C), ref: 6D62CF3D
GetLastError.KERNEL32(?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C,6D634C7F,00000000,00000000,?,6D63455A,0000000D), ref: 6D62CF4E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 2111cf9e40d04d4b29527aba75d1f041534ca62306af0ea28c5c302044d413e7
Instruction ID: 2c08e76dbb5d77202d496b7172859a26619f56ce6a5f18471633cba59af72b01
Opcode Fuzzy Hash: 2111cf9e40d04d4b29527aba75d1f041534ca62306af0ea28c5c302044d413e7
Instruction Fuzzy Hash: 4D01D631C0E312ABDF105BB59944BAD3FB4AF0D768F138019E619A60C1CB38D580DED9

Function 10006E01 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 10006EAD

Strings

ja, xrefs: 10006E68
K(}, xrefs: 10006E7B
gaF, xrefs: 10006E36

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: K(}$gaF$ja
API String ID: 1889721586-538739611
Opcode ID: 2bfe91f83e54762a76626f5005161e2236a064a7b9ce61c9eebc5f4be2cd1f3e
Instruction ID: ae5e20adda95371a6ffbc60222c05419d1fa10ae125f737c12cd54d8d8f4e7c9
Opcode Fuzzy Hash: 2bfe91f83e54762a76626f5005161e2236a064a7b9ce61c9eebc5f4be2cd1f3e
Instruction Fuzzy Hash: D31155B2D01218BBDB04DFA5C8498DEBFB6EF45314F10C189FA18A7241D7B55B259F90

Function 10007BC6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(1A48E6F8), ref: 10007C74

Strings

Z8, xrefs: 10007C2A

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: Z8
API String ID: 4033686569-4113373922
Opcode ID: 308f64f918a83fe14fd2a0715591c9d5f769be9384a043c1aa0fb948248b5d4f
Instruction ID: bc5ccce564b508e3e5ee151c4ba85837a9aaa66788098328f8ba81862f6ef7fc
Opcode Fuzzy Hash: 308f64f918a83fe14fd2a0715591c9d5f769be9384a043c1aa0fb948248b5d4f
Instruction Fuzzy Hash: B0115BB5D0024CBFDB08CFE5D94AA9EBBB1EB40304F208199E41477290D7B65B548F50

Function 10004A9D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 10004B39

Strings

fW6%, xrefs: 10004AF4

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: fW6%
API String ID: 1029625771-2497841860
Opcode ID: 394d79df2e022e3103ed5dfbf4f970570035fa9306bbb3e241013eecdf3199c8
Instruction ID: 1654fd7a89adbc247ea4b2cc44e2289807b97534170b36b5b589edf922bd2dd5
Opcode Fuzzy Hash: 394d79df2e022e3103ed5dfbf4f970570035fa9306bbb3e241013eecdf3199c8
Instruction Fuzzy Hash: 5E114871C11208FFDB08DFA4DA4A9DEBBB4FB00311F20C189E419B6251D3705B149F90

Function 10017B25 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 10017B98

Strings

p4, xrefs: 10017B34

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: p4
API String ID: 621844428-1539767998
Opcode ID: 94c440c38613cd405a4d170ca76893493cc6bc59e85da6168acdace7e4be3644
Instruction ID: 6f878ff555c26b60996825b1d2b2a2cf69cce43ce534236754b61de2d7acab95
Opcode Fuzzy Hash: 94c440c38613cd405a4d170ca76893493cc6bc59e85da6168acdace7e4be3644
Instruction Fuzzy Hash: 37F08C71E0030CFBDB44CBE5D94AA9EBBF0EB50304F20C098D915A7241D7B56B088F41

Function 6D5F6210 Relevance: 3.3, APIs: 2, Instructions: 259COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 6D5F624B
??3@YAXPAX@Z.MSVCRT ref: 6D5F6572

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ??3@malloc
String ID:
API String ID: 3530088491-0
Opcode ID: 9d3ad2bbf81a1a7d979f94b41ec38ca716ea5a077f5309c1095b91244107991e
Instruction ID: 4f9115585e275d2c8afc9b60d7733503829254ee42cdfa9b12f430f1e6a2c9a4
Opcode Fuzzy Hash: 9d3ad2bbf81a1a7d979f94b41ec38ca716ea5a077f5309c1095b91244107991e
Instruction Fuzzy Hash: DDB1A63260430B8FCB08CF6DCAC2755BBB5FBDA304B05856AD5509B366E770AA49CBD0

Function 6D5F6F80 Relevance: 1.7, APIs: 1, Instructions: 205COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d93115bac5305ab9e97806824b1968b2f6fda0bf62c9c5dde1cfd4c2c67a19
Instruction ID: 61f07d11eff202b9dc0fc69dd0e5048281a047c7d3a05626a5a6bd85c621a553
Opcode Fuzzy Hash: 02d93115bac5305ab9e97806824b1968b2f6fda0bf62c9c5dde1cfd4c2c67a19
Instruction Fuzzy Hash: EF71923264430B8FC708CF6DD9C2B95B7B9FBC9304F04862AD955CF259E770E6498A90

Function 1001A50A Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00000000,D727192A,00D964FD,00000000), ref: 1001A5E4

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 437ca9c9c9e6bbc918406cc15dcd8751e725cea46ce31b3af92ae7b3c8ede5d5
Instruction ID: 412e7376bc276dfc8db94309ca56039382e89c6bc0d174e2226dd53fc2e61811
Opcode Fuzzy Hash: 437ca9c9c9e6bbc918406cc15dcd8751e725cea46ce31b3af92ae7b3c8ede5d5
Instruction Fuzzy Hash: 1A21E576901108FBDF05CFE5C94A8DEBFB6EF48354F108149F91866220D3729A60DF91

Function 100102D8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 10010384

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e059c3c066ff345504bba9c85b1d4992eba54445fe3d98b1d9d536134e0d9d68
Instruction ID: 272cec0317e95e5db047d74803fc0b1aa602f5f7f96704868454fe35651c1806
Opcode Fuzzy Hash: e059c3c066ff345504bba9c85b1d4992eba54445fe3d98b1d9d536134e0d9d68
Instruction Fuzzy Hash: AC114F75E01208FFEB08CFA5D80A9EEBBB5EB85310F50C09AE504A7284E7B16F119F40

Function 10003506 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(9FA0E66D,?,00083F87), ref: 100035AB

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f96f459a1562cf0811398c59acc1a6a1e894971d13c8e85bf07d59f40b728169
Instruction ID: b672eea8bbd5a35847388148feefcd37532f61b34cd955ab03d9af958fa8414f
Opcode Fuzzy Hash: f96f459a1562cf0811398c59acc1a6a1e894971d13c8e85bf07d59f40b728169
Instruction Fuzzy Hash: 2A1125B5D00208BFDF04DFA4D84A89EBFB5EB44740F208098F9146A221D3769B24EF90

Function 6D61FF53 Relevance: 1.5, APIs: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D61FF5A

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 103e4d85f0991829a5be3c889e53d77a263ce8a8b8d30d2c5b4547b125a77538
Instruction ID: 8ca6b8dcd244de4bb9dc726a30481f824984f0f1095633b71f5322539e109b7d
Opcode Fuzzy Hash: 103e4d85f0991829a5be3c889e53d77a263ce8a8b8d30d2c5b4547b125a77538
Instruction Fuzzy Hash: FB017C3660C203CFDB14DF39C8107BE36B2AB8E329B11492CE5998B290DF70C980CB15

Function 6D5F8BE0 Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D5F8BE6

Part of subcall function 6D62CE0B: __FF_MSGBANNER.LIBCMT ref: 6D62CE2E
Part of subcall function 6D62CE0B: __NMSG_WRITE.LIBCMT ref: 6D62CE35
Part of subcall function 6D62CE0B: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C,6D634C7F), ref: 6D62CE82

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 5f1ee0aeb075a1f768145108833e98dae58e51e82a419426d32d25a4a73c97bc
Instruction ID: def6b5fbd842c1cca3ab37a0163055e74e034b7e98e5c06fecb9f38960da5d0e
Opcode Fuzzy Hash: 5f1ee0aeb075a1f768145108833e98dae58e51e82a419426d32d25a4a73c97bc
Instruction Fuzzy Hash: F7E026F661511A0BDF04DAFE8CE0AA337DD6B1A0243460535E482DF502E700E8848EA2

Function 6D63575B Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6D62E311,00000001,?,?,?,6D62E48A,?,?,?,6D6583E0,0000000C,6D62E545), ref: 6D635770

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a1d4ce72eafaa11ceb60ca06ded487be16775dde50173e11a7a911dd8848bf41
Instruction ID: a4cb56999233d7eeb9191f50bf0b36ffa56365de5bbe3df64d1f0b5a0a9063e5
Opcode Fuzzy Hash: a1d4ce72eafaa11ceb60ca06ded487be16775dde50173e11a7a911dd8848bf41
Instruction Fuzzy Hash: BCD05E729543859FDB005EB65849B763BFC9389395F10843AF81CC6240F774D5819A41

Function 6D5F82A0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 6D5F82B4

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1e2c8865c5dd3405fb362278e442da11aea99caaf1eae9dd27b16f9a7f9a461b
Instruction ID: defae9fe6431e499b0d20a52a5266863f353e06682300a2418938c142f823ba4
Opcode Fuzzy Hash: 1e2c8865c5dd3405fb362278e442da11aea99caaf1eae9dd27b16f9a7f9a461b
Instruction Fuzzy Hash: 2AC0EAB9608201AF9A08CB94C889D6BB7A9EBC9240F008908B59983210C630E8418B22

Function 6D5F82C0 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 6D5F82CF

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 61e8130aa66ef2709514687d7dc795322dc21e071dca9f86f3a680e031e07f94
Instruction ID: 4a6e8a738fefb08d0b70b148c9809be90adc7d9ded9092f6b53dfa677e90a366
Opcode Fuzzy Hash: 61e8130aa66ef2709514687d7dc795322dc21e071dca9f86f3a680e031e07f94
Instruction Fuzzy Hash: 8FC048B8608200BF9E08CB60C989C2BB7B9EBC8610F10CD0CB89983200C630EC40DA22

Non-executed Functions

Function 6D5FD2D0 Relevance: 95.7, APIs: 45, Strings: 9, Instructions: 1160windowfileCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000080,00000001,?), ref: 6D5FD322
SendMessageA.USER32(?,00000080,00000000,?), ref: 6D5FD336
LoadIconA.USER32(?,00000088), ref: 6D5FD36E
LoadIconA.USER32(?,00000089), ref: 6D5FD39C
LoadIconA.USER32(?,0000008A), ref: 6D5FD3CA
LoadIconA.USER32(?,0000008B), ref: 6D5FD3F8
LoadIconA.USER32(?,0000008C), ref: 6D5FD426
LoadIconA.USER32(?,0000008D), ref: 6D5FD454
LoadIconA.USER32(?,0000008E), ref: 6D5FD482

Part of subcall function 6D601BE0: SendMessageA.USER32(?,00001003,00000000,?), ref: 6D601BFA

Part of subcall function 6D5F1D80: _memmove_s.LIBCMT ref: 6D5F1DE0

Part of subcall function 6D5F1D80: _memcpy_s.LIBCMT ref: 6D5F1DED

SendMessageA.USER32(?,00001109,00000000,?), ref: 6D5FD72E
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FD777
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FD78F
SHGetFileInfoA.SHELL32(00000000,00000000,?,00000160,00000100), ref: 6D5FD814
SHGetFileInfoA.SHELL32(?,00000000,?,00000160,00000100,?), ref: 6D5FD97F
SendMessageA.USER32(?,00001114,00000000,00000000), ref: 6D5FD86C

Part of subcall function 6D61D246: __EH_prolog3.LIBCMT ref: 6D61D24D

LoadIconA.USER32(?,00000094), ref: 6D5FDC17
LoadIconA.USER32(?,00000091), ref: 6D5FDC45
LoadIconA.USER32(?,00000092), ref: 6D5FDC73
LoadIconA.USER32(?,00000093), ref: 6D5FDCA1
LoadIconA.USER32(?,00000095), ref: 6D5FDCCF
LoadIconA.USER32(?,00000090), ref: 6D5FDCFD
LoadIconA.USER32(?,00000096), ref: 6D5FDD2B
SendMessageA.USER32(?,00001003,00000000,?), ref: 6D5FDD61
LoadCursorA.USER32(00000000,00007F00), ref: 6D5FDE27
CopyIcon.USER32(00000000), ref: 6D5FDE2E
LoadCursorFromFileA.USER32(mouse.ani), ref: 6D5FDE3F
ShowCursor.USER32(00000000), ref: 6D5FDE63
SetSystemCursor.USER32(?,00007F00), ref: 6D5FDE71
ShowCursor.USER32(00000001), ref: 6D5FDE79
GetCurrentProcess.KERNEL32(00000028,6D65E1F4), ref: 6D5FDE82
OpenProcessToken.ADVAPI32(00000000), ref: 6D5FDE89
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,6D65E1EC), ref: 6D5FDE9A
AdjustTokenPrivileges.ADVAPI32(00000000,00000000,6D65E1DC,00000010,00000000,00000000), ref: 6D5FDEDB
LoadMenuA.USER32(?,000000A7), ref: 6D5FDEF5

Part of subcall function 6D5F4890: GetMenuItemCount.USER32(?), ref: 6D5F48A5
Part of subcall function 6D5F4890: GetMenuItemID.USER32(?,00000000), ref: 6D5F48E0
Part of subcall function 6D5F4890: ModifyMenuA.USER32(?,00000000,00000500,?,?), ref: 6D5F493F
Part of subcall function 6D5F4890: GetSubMenu.USER32(?,00000000), ref: 6D5F494C

LoadIconA.USER32(?,00000088), ref: 6D5FDF26
_strncpy.LIBCMT ref: 6D5FDF57
VariantClear.OLEAUT32(?), ref: 6D5FE032
GetSystemMetrics.USER32(00000000), ref: 6D5FE0A2
GetSystemMetrics.USER32(00000001), ref: 6D5FE0B3
GetSystemMetrics.USER32(00000001), ref: 6D5FE0CC
GetSystemMetrics.USER32(00000000), ref: 6D5FE0D5

Part of subcall function 6D61CBC5: __EH_prolog3.LIBCMT ref: 6D61CBCF
Part of subcall function 6D61CBC5: VariantClear.OLEAUT32 ref: 6D61CBD7

Part of subcall function 6D61C792: _memset.LIBCMT ref: 6D61C79E

VariantClear.OLEAUT32(?), ref: 6D5FE1A5
VariantClear.OLEAUT32(?), ref: 6D5FE1AF
VariantClear.OLEAUT32(?), ref: 6D5FE1B9
VariantClear.OLEAUT32(?), ref: 6D5FE1C0

Part of subcall function 6D61D029: __EH_prolog3.LIBCMT ref: 6D61D030

Strings

mouse.ani, xrefs: 6D5FDE34
Wave, xrefs: 6D5FE169
data\*.*, xrefs: 6D5FDB49
SeShutdownPrivilege, xrefs: 6D5FDE94
Ozzar, xrefs: 6D5FDFE1, 6D5FE034
\*.*, xrefs: 6D5FD894
Ozzar.acs, xrefs: 6D5FDFC9
RestPose, xrefs: 6D5FE183
Announce, xrefs: 6D5FE122

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Load$Icon$ClearMessageSendVariant$CursorMenuSystem$Metrics$FileH_prolog3$DriveInfoItemLogicalProcessShowStringsToken$AdjustCopyCountCurrentFromLookupModifyOpenPrivilegePrivilegesValue_memcpy_s_memmove_s_memset_strncpy
String ID: Announce$Ozzar$Ozzar.acs$RestPose$SeShutdownPrivilege$Wave$\*.*$data\*.*$mouse.ani
API String ID: 890176776-3269483239
Opcode ID: c07c59c328c4d4da5f554ba80b4b2eb5b488077306b96bee61ea99384476a415
Instruction ID: f403c3fa1c35242ae146f7e936504fa67aace675f39556fd336187bb5a9db691
Opcode Fuzzy Hash: c07c59c328c4d4da5f554ba80b4b2eb5b488077306b96bee61ea99384476a415
Instruction Fuzzy Hash: 1B926371208340AFD758DB64CC91FBEB3A9AF89318F018A1CF2599B2D1DF74A805CB59

Function 6D601060 Relevance: 54.7, APIs: 29, Strings: 2, Instructions: 488windownetworkCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,?,00000010,00000010,00000000), ref: 6D6010E7
_memset.LIBCMT ref: 6D60110B
recv.WS2_32(?,?,000003E8,00000000), ref: 6D601122
htons.WS2_32(?), ref: 6D601136
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 6D60114A
inet_ntoa.WS2_32(?), ref: 6D601174
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 6D601189
inet_ntoa.WS2_32(?), ref: 6D601199
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 6D6011AE

Strings

Processing2, xrefs: 6D601633
%s, xrefs: 6D601391

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Message$Send$inet_ntoa$Peek_memsethtonsrecv
String ID: %s$Processing2
API String ID: 2681355637-1361235676
Opcode ID: 2c37c8e1fc79ac35b376e83489f92f94b53174d896aab754ea8608ae0e51de05
Instruction ID: 0c17f1c10d6387dc3630b56300929fbf40c79ab5e8eee74f199757794ded9ba4
Opcode Fuzzy Hash: 2c37c8e1fc79ac35b376e83489f92f94b53174d896aab754ea8608ae0e51de05
Instruction Fuzzy Hash: E102B070244700ABE714DB65CC85FABB7A8EF8D714F008A1DF259DB2D0DB74A845CB96

Function 6D62BA72 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 323windowkeyboardCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D62BA79
GetKeyState.USER32(00000001), ref: 6D62BAC0
GetKeyState.USER32(00000002), ref: 6D62BACD
GetKeyState.USER32(00000004), ref: 6D62BADA
GetParent.USER32(?), ref: 6D62BAFF
SendMessageA.USER32(?,00000401,00000000,00000000), ref: 6D62BBAB
_memset.LIBCMT ref: 6D62BBC2
ScreenToClient.USER32(?,?), ref: 6D62BBE0
_memset.LIBCMT ref: 6D62BBEE
GetCursorPos.USER32(?), ref: 6D62BC34
SendMessageA.USER32(?,00000412,00000000,?), ref: 6D62BC52
SendMessageA.USER32(?,00000404,00000000,?), ref: 6D62BCC1
SendMessageA.USER32(?,00000401,00000001,00000000), ref: 6D62BCE7
SendMessageA.USER32(?,00000411,00000001,?), ref: 6D62BD06
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000213), ref: 6D62BD19
SendMessageA.USER32(?,00000405,00000000,?), ref: 6D62BD43
_memset.LIBCMT ref: 6D62BD68
SendMessageA.USER32(?,00000401,00000000,00000000), ref: 6D62BDA9
GetParent.USER32(?), ref: 6D62BDD8

Strings

,, xrefs: 6D62BC04

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$State_memset$Parent$ClientCursorH_prolog3ScreenWindow
String ID: ,
API String ID: 2864161637-3772416878
Opcode ID: 1505f3abf6cae159cf29f742c53efeb84821c55cc0e1fcd12b14cf060cc28475
Instruction ID: dd623f09bdec3786a1376cf6467bd0f2b2c5840d565c15785162cfd87738be8b
Opcode Fuzzy Hash: 1505f3abf6cae159cf29f742c53efeb84821c55cc0e1fcd12b14cf060cc28475
Instruction Fuzzy Hash: BBC1BE71A102169FDF108FA8C884BEE77B5FF0C350F114525EB59AB1A9DBB1A484CF92

Function 10010503 Relevance: 30.8, Strings: 24, Instructions: 779COMMON

Download Yara Rule

Strings

6S', xrefs: 100109F6
X&2, xrefs: 10010911
7ve, xrefs: 100110F2
Z, xrefs: 10010FE2
1{j, xrefs: 10010C83
mQ%k, xrefs: 10010BBB
oe, xrefs: 10010D35
x], xrefs: 10010C96
gG, xrefs: 10010992
+S, xrefs: 10010F31
=f, xrefs: 10010F85
#*, xrefs: 10010B90
Ni, xrefs: 10010D61
q=6, xrefs: 10010C30
i;H, xrefs: 10010850
b3h, xrefs: 10010A03
6 S, xrefs: 10010E49
n, xrefs: 10010A77
\+, xrefs: 10010533
",Dt, xrefs: 1001082B
H, xrefs: 100112A4
yC}, xrefs: 1001095E
3Rj, xrefs: 100111D6
?aR, xrefs: 10010CEE

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: oe$",Dt$#*$+S$1{j$6 S$6S'$7ve$=f$?aR$H$Ni$X&2$Z$\+$b3h$gG$i;H$mQ%k$n$q=6$x]$yC}$3Rj
API String ID: 0-3556981824
Opcode ID: 6a19bbd3df0733e7eae29c9100c83af6e5e6ba54dafeb33c3bf276082d8d96d2
Instruction ID: 5d62518833e5c746b13573bb0b5580e4c959395a5400311213104730dffa91a4
Opcode Fuzzy Hash: 6a19bbd3df0733e7eae29c9100c83af6e5e6ba54dafeb33c3bf276082d8d96d2
Instruction Fuzzy Hash: F092E371508380DBD379CF61C98AB8FBBE2FBC5344F10891DE68996260DBB19959CF42

Function 6D5FF510 Relevance: 25.2, APIs: 11, Strings: 3, Instructions: 683threadwindowshutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 6D5FCEF0: _memset.LIBCMT ref: 6D5FCF78
Part of subcall function 6D5FCEF0: EnumProcesses.PSAPI(?,00001000,?,?,00000000,00000103), ref: 6D5FCF8F
Part of subcall function 6D5FCEF0: OpenProcess.KERNEL32(00000410,00000000,?,?,00001000,?,?,00000000,00000103), ref: 6D5FCFB9
Part of subcall function 6D5FCEF0: EnumProcessModules.PSAPI(00000000,?,00000004,?), ref: 6D5FCFD6
Part of subcall function 6D5FCEF0: GetModuleFileNameExA.PSAPI(00000000,?,?,00000104,00000000,?,00000004,?), ref: 6D5FCFEE
Part of subcall function 6D5FCEF0: GetShortPathNameA.KERNEL32(?,?,00000100), ref: 6D5FD003
Part of subcall function 6D5FCEF0: __itow.LIBCMT ref: 6D5FD014

GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FF7BD
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FF7D1
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FF85F
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FF873
GetDriveTypeA.KERNEL32(00000000), ref: 6D5FF8A1
GetWindowsDirectoryA.KERNEL32(?,00000032), ref: 6D5FFB26
GetSystemDirectoryA.KERNEL32(?,00000032), ref: 6D5FFB36
_strcspn.LIBCMT ref: 6D5FFB6B
TerminateThread.KERNEL32(?,00000000,Error in Fun_mycomputer,00000000,00000000), ref: 6D5FFCAD
SendMessageA.USER32(?,00000111,FFF555EE,F55555EE), ref: 6D5FFCCC
ExitWindowsEx.USER32(00000008,00000000), ref: 6D5FFF0C

Part of subcall function 6D60D9DE: IsWindow.USER32(?), ref: 6D60D9F2

Part of subcall function 6D62D661: __mbscmp_l.LIBCMT ref: 6D62D66E

Part of subcall function 6D6184CF: SendMessageA.USER32(?,0000102E,?,?), ref: 6D6184F2

Part of subcall function 6D60D9DE: SetWindowTextA.USER32(?,6D646930), ref: 6D60DA1A

Part of subcall function 6D5F10A0: _memcpy_s.LIBCMT ref: 6D5F10F9

Strings

C:\Documents and Settings, xrefs: 6D5FF83B
Setting\ScanSet.dat, xrefs: 6D5FFD86
Error in Fun_mycomputer, xrefs: 6D5FFC93

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Drive$LogicalStrings$DirectoryEnumMessageNameProcessSendWindowWindows$ExitFileModuleModulesOpenPathProcessesShortSystemTerminateTextThreadType__itow__mbscmp_l_memcpy_s_memset_strcspn
String ID: C:\Documents and Settings$Error in Fun_mycomputer$Setting\ScanSet.dat
API String ID: 2528079533-416981898
Opcode ID: b107fc313c0429a8831f71013992faccfcf3e7168ca9dafe26f7103e08255aee
Instruction ID: 21649b9330c816a6d277a4cafa0ad94cdacbd17a322e0d4507b9367d027887d8
Opcode Fuzzy Hash: b107fc313c0429a8831f71013992faccfcf3e7168ca9dafe26f7103e08255aee
Instruction Fuzzy Hash: 9742D4712082429FD718CF64C890FABB7F5BFC9304F158A2CE6898B691DB70E945CB91

Function 1000ED0A Relevance: 23.3, Strings: 18, Instructions: 791COMMON

Download Yara Rule

Strings

}$J, xrefs: 1000F3E1
}Q, xrefs: 1000F196
vOj, xrefs: 1000FC3F
$:, xrefs: 1000F97A
]|, xrefs: 1000ED7D
n6, xrefs: 1000EDD8
}, xrefs: 1000F0AF
)0, xrefs: 1000F271
<s, xrefs: 1000F6E0
&F, xrefs: 1000F903
1L, xrefs: 1000FA54
8Z}, xrefs: 1000F468
., xrefs: 1000FA96
FJ, xrefs: 1000F70C
AE, xrefs: 1000EF0B
J, xrefs: 1000F95C
;Da, xrefs: 1000EEC1
d., xrefs: 1000F6EB

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }$$:$&F$)0$.$1L$8Z}$;Da$AE$FJ$]|$d.$n6$vOj$}$J$<s$J$}Q
API String ID: 0-2034874769
Opcode ID: b0e9a17f2acce03e7086befe4c507c52328108504173ca1fd4510968b9ed539f
Instruction ID: 8c56035fb700b9a7871df915df22f3676d0564e00da836232f03f85a1d9ccf85
Opcode Fuzzy Hash: b0e9a17f2acce03e7086befe4c507c52328108504173ca1fd4510968b9ed539f
Instruction Fuzzy Hash: 8BA2ED715093819FD3B9CF65C58ABDBBBE1BBC4304F10891DE5DA8A260DBB18949CF42

Function 1001BD63 Relevance: 22.0, Strings: 17, Instructions: 709COMMON

Download Yara Rule

Strings

eWF, xrefs: 1001CCAD
%"p, xrefs: 1001C492
G1, xrefs: 1001C852
eWF, xrefs: 1001CC0F
eWF, xrefs: 1001CAEE
D, xrefs: 1001BEEC
OT, xrefs: 1001C5DD
5#, xrefs: 1001C2BA
],0, xrefs: 1001C3A6
hV, xrefs: 1001C887
F|`, xrefs: 1001BE0E
f{N, xrefs: 1001BEC6
Ec, xrefs: 1001BF65
7c, xrefs: 1001C7D2
TeC, xrefs: 1001C06C
9yL, xrefs: 1001C0EE
J, xrefs: 1001BF33

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %"p$5#$7c$9yL$Ec$F|`$G1$OT$TeC$],0$eWF$eWF$eWF$f{N$hV$D$J
API String ID: 0-4285528825
Opcode ID: c27129fdffa640f9c976f94e6cee6578926f5db1a3a88e050b365f8b188eb50b
Instruction ID: ee6588e770e328bdcb98d03fa00280db3e39129df95c59cb3ba532bead8410e1
Opcode Fuzzy Hash: c27129fdffa640f9c976f94e6cee6578926f5db1a3a88e050b365f8b188eb50b
Instruction Fuzzy Hash: 789200B15093818FD3B8CF65C54AA8FBBE1BBD4708F10891DE5DA96260D7B48949CF43

Function 6D613699 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 443libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D6136A0
_strlen.LIBCMT ref: 6D613759
_strlen.LIBCMT ref: 6D613763
_strlen.LIBCMT ref: 6D6137C5
_memcpy_s.LIBCMT ref: 6D613809

Part of subcall function 6D606A83: __EH_prolog3.LIBCMT ref: 6D606A8A

_strlen.LIBCMT ref: 6D613818
_memcpy_s.LIBCMT ref: 6D613861

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

PathRemoveFileSpecW.SHLWAPI(00000000,00000000), ref: 6D61395C
GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 6D613A36

Strings

Shell32.dll, xrefs: 6D6139F3
SHCreateItemFromParsingName, xrefs: 6D613A30

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: _strlen$H_prolog3$_memcpy_s$AddressException@8FilePathProcRemoveSpecThrow
String ID: SHCreateItemFromParsingName$Shell32.dll
API String ID: 515475663-214508289
Opcode ID: 171ac7ed068d7ac88cf8588bf16bef5fc1ae96932c6bf3fd1b5c72859944117e
Instruction ID: 3da04d3484adee59f92baa929744fa1c4acf06243c3f5830b1370d825b1a93a8
Opcode Fuzzy Hash: 171ac7ed068d7ac88cf8588bf16bef5fc1ae96932c6bf3fd1b5c72859944117e
Instruction Fuzzy Hash: E502A1709082179FDB09CFA8CD95ABEB7B4FF08315F11426DE526AB2A1DB309905CB90

Function 1000D4BC Relevance: 15.6, Strings: 12, Instructions: 647COMMON

Download Yara Rule

Strings

m6j, xrefs: 1000D900
A.#,, xrefs: 1000DB83
[, xrefs: 1000D83A
x-, xrefs: 1000D61E
{`4, xrefs: 1000DC08
^-}, xrefs: 1000E059
\{t, xrefs: 1000DB96
$I_, xrefs: 1000DE60
{P, xrefs: 1000DEFB
,u , xrefs: 1000DC3E
3, xrefs: 1000DB52
qkA, xrefs: 1000DDB8

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: $I_$,u $3$A.#,$\{t$^-}$m6j$x-${P$[$qkA${`4
API String ID: 2591292051-272997853
Opcode ID: 2f63dd69095d9b515c4bed1411e5a0457518713d033c1e045df0a75471be8419
Instruction ID: c830beccb9242ba3ba803b20a7fa76404823b019f1b77bf206095d199b5024dc
Opcode Fuzzy Hash: 2f63dd69095d9b515c4bed1411e5a0457518713d033c1e045df0a75471be8419
Instruction Fuzzy Hash: EC82EC715093809FD3B9CF21D58AB8BBBE1BBC4748F10891DE6DA96260D7B09949CF43

Function 1001519C Relevance: 14.4, Strings: 11, Instructions: 619COMMON

Download Yara Rule

Strings

w:j, xrefs: 100155C5
$rb, xrefs: 10015BFB
Cjw, xrefs: 10015EC4
e_, xrefs: 10015A85
rGD, xrefs: 10015B53
c, xrefs: 10015353
a?/, xrefs: 1001539A
[#, xrefs: 1001584B
$rb, xrefs: 10015FAC
Cjw, xrefs: 10015C07
R-, xrefs: 1001586B

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $rb$$rb$Cjw$Cjw$[#$a?/$e_$rGD$w:j$R-$c
API String ID: 0-3456748807
Opcode ID: a0ff22bc531dddd2443fd78e15540818585cf624a7d26cb4e48b0b0de6ce6dc2
Instruction ID: 090c3b0655b69cae11192f4fcf5620542e3867e2ee28f79cc81d2a87bb1169a1
Opcode Fuzzy Hash: a0ff22bc531dddd2443fd78e15540818585cf624a7d26cb4e48b0b0de6ce6dc2
Instruction Fuzzy Hash: C67202715083809FD3B4CF65C58AB8BBBE1FBC4754F10891DE5DA8A260DBB19989CF42

Function 6D6297EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 6D629879
_memset.LIBCMT ref: 6D629887
IsWindow.USER32(?), ref: 6D6299D3

Strings

0, xrefs: 6D62989D

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClientScreenWindow_memset
String ID: 0
API String ID: 1268500159-4108050209
Opcode ID: deabfb58ac26d6652c623dabd913d024932e03d05fda15f7f33ad6a1c0b28112
Instruction ID: f282e409303308619c361ec9db974c0657a337a429216396aec9ead4ad32a5ee
Opcode Fuzzy Hash: deabfb58ac26d6652c623dabd913d024932e03d05fda15f7f33ad6a1c0b28112
Instruction Fuzzy Hash: 4851C230E84206DFDF009FA4C448BEDBBB5BF8C368F14445AEA55A7290DB759981CF91

Function 10009C1B Relevance: 14.1, Strings: 11, Instructions: 399COMMON

Download Yara Rule

Strings

{C, xrefs: 10009C4F
RDv, xrefs: 10009D18
%, xrefs: 10009F7C
@, xrefs: 10009DBC
$<, xrefs: 10009F6C
3}), xrefs: 1000A0E1
`/D, xrefs: 1000A178
/v, xrefs: 10009FEF
pa, xrefs: 1000A156
(, xrefs: 1000A015
D.|, xrefs: 10009D93

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: pa$$<$%$/v$3})$D.|$RDv$`/D${C$($@
API String ID: 0-3390780285
Opcode ID: b4221a7ec40f77d3d66757f50ad33db8a595ab99c182fb2d0fbd8c5fb8cd4eab
Instruction ID: 97f880a5db22ffdc89eccd01eec75a76eeee2769d7118af9296c62c06ff0bbaf
Opcode Fuzzy Hash: b4221a7ec40f77d3d66757f50ad33db8a595ab99c182fb2d0fbd8c5fb8cd4eab
Instruction Fuzzy Hash: A52226715083809FE364CF65C94AA9FFBE1FBC5754F108A1DE29A86260C7B19949CF43

Function 6D61D098 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 106filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(6D646930,?,?,?,?,00000001), ref: 6D61D0E7
GetLastError.KERNEL32(?,?,?,00000001), ref: 6D61D0F5
lstrlenA.KERNEL32(6D646930,?,?,00000001), ref: 6D61D108
SetLastError.KERNEL32(0000007B,00000000,?,?,00000104,?,?,?,00000001), ref: 6D61D117

Part of subcall function 6D606101: _malloc.LIBCMT ref: 6D60611F

Part of subcall function 6D61115E: _strcpy_s.LIBCMT ref: 6D61116C

__fullpath.LIBCMT ref: 6D61D13C
__splitpath_s.LIBCMT ref: 6D61D180
__makepath_s.LIBCMT ref: 6D61D1A2

Strings

*.*, xrefs: 6D61D0C3, 6D61D0D2, 6D61D0E6

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ErrorLast$FileFindFirst__fullpath__makepath_s__splitpath_s_malloc_strcpy_slstrlen
String ID: *.*
API String ID: 23357613-438819550
Opcode ID: 98527f3b76f63a5980cf2b2318285f0152452abc8e13bd85de3b39738bb41358
Instruction ID: d5f31ce8bad0537e140936c542e3aa4f96330a62202d6b1053fda2e0ebaaf7d3
Opcode Fuzzy Hash: 98527f3b76f63a5980cf2b2318285f0152452abc8e13bd85de3b39738bb41358
Instruction Fuzzy Hash: F731C671908214BBCB10ABBA8C85EDFBB7CEF9E354F014965F619D2180DB749D80CEA4

Function 1001490E Relevance: 14.0, Strings: 11, Instructions: 268COMMON

Download Yara Rule

Strings

r6, xrefs: 10014C9A
P:, xrefs: 10014C82
Ky., xrefs: 10014B96
U`?, xrefs: 10014D70
kO0, xrefs: 10014A44
U`?, xrefs: 10014D09
qL<, xrefs: 10014C12
"CS, xrefs: 10014AD2
8R, xrefs: 1001498A
9rV, xrefs: 100149D4
AJ-, xrefs: 10014C8A

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: P:$"CS$8R$9rV$AJ-$Ky.$U`?$U`?$qL<$r6$kO0
API String ID: 0-914005703
Opcode ID: 737b086a3945c0bee45425df07fade377b0128617b10cdcf14ed608bf27ab5d7
Instruction ID: 27373a81f89185aa70ce46632035155be15de031511a6564bed99d20cc865751
Opcode Fuzzy Hash: 737b086a3945c0bee45425df07fade377b0128617b10cdcf14ed608bf27ab5d7
Instruction Fuzzy Hash: 3FD1FE724093819FD358CF65C98A90BFBE1FBC4758F50891DF6A68A260D7B6C948CF42

Function 6D61DB05 Relevance: 13.6, APIs: 9, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetPropA.USER32(?), ref: 6D61DB2C
GlobalLock.KERNEL32(00000000), ref: 6D61DB35
SendMessageA.USER32(?,00000476,00000000,00000000), ref: 6D61DB56
GlobalUnlock.KERNEL32(00000000), ref: 6D61DB5D
RemovePropA.USER32(?), ref: 6D61DB6C
GlobalFree.KERNEL32(00000000), ref: 6D61DB77

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Global$Prop$FreeLockMessageRemoveSendUnlock
String ID:
API String ID: 2391254433-0
Opcode ID: ff672f8128bd8a97c5d2b3fbdf388591229cd37aee770e4b1547756c98665fff
Instruction ID: 2c9a8287c9eb09922f2d16df1faa388268df0725ae37bf1b9ea02497a5fa8e6a
Opcode Fuzzy Hash: ff672f8128bd8a97c5d2b3fbdf388591229cd37aee770e4b1547756c98665fff
Instruction Fuzzy Hash: F2215EB5248206BFDF216B6A8C84F6A3B79FB8E7A5F008424F54795150D761D880DEA4

Function 1001D4AE Relevance: 13.0, Strings: 10, Instructions: 457COMMON

Download Yara Rule

Strings

$as, xrefs: 1001DBCA
(], xrefs: 1001DAB0
Ek\, xrefs: 1001D5F8
}| , xrefs: 1001D72D
aD, xrefs: 1001DB68
V>!, xrefs: 1001D7F7
p6, xrefs: 1001D6A0
z X, xrefs: 1001DEFC
jB, xrefs: 1001D7FF
#^, xrefs: 1001D65B

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $as$(]$Ek\$V>!$aD$jB$z X$}| $#^$p6
API String ID: 0-2883086406
Opcode ID: 0f47c550307f8e21733316f5963f41ed35531f5e28a27c8939618ae3a7fa6877
Instruction ID: ca385adafd6dd087f5e5b480d2795cc97ab61bf8fcec4dda013580720c227125
Opcode Fuzzy Hash: 0f47c550307f8e21733316f5963f41ed35531f5e28a27c8939618ae3a7fa6877
Instruction Fuzzy Hash: AA3202B15083819FE3B8CF61C94AB8BBBE1FBC0354F10891DE59996260D7B58949CF43

Function 10019A0C Relevance: 12.9, Strings: 10, Instructions: 416COMMON

Download Yara Rule

Strings

7l, xrefs: 10019D93
W, xrefs: 10019D58
{ag, xrefs: 1001A118
\f1i, xrefs: 10019ADC
-PA, xrefs: 10019F32
4z{, xrefs: 10019EF0
"Y, xrefs: 10019A57
M|nT, xrefs: 1001A29B
], xrefs: 10019AEC
W, xrefs: 10019CE2

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "Y$-PA$4z{$7l$M|nT$W$\f1i${ag$W$]
API String ID: 0-1096841937
Opcode ID: bad48bbd17eff76a0a8e88d6d712c3c1fca59daa15053f1c75d238e4eaa69377
Instruction ID: 34cf0cf16b7883140b5f28e29c55e0f95892f70fd99c4871f35f408494a67b83
Opcode Fuzzy Hash: bad48bbd17eff76a0a8e88d6d712c3c1fca59daa15053f1c75d238e4eaa69377
Instruction Fuzzy Hash: 1722E171508380DFE3A9CF61C54AA9BFBE2FBC4708F108A1DE1D996260D7B59949CF42

Function 10002710 Relevance: 12.8, Strings: 10, Instructions: 327COMMON

Download Yara Rule

Strings

;c, xrefs: 10002960
M%$, xrefs: 10002B48
k, xrefs: 10002BE9
}i, xrefs: 10002C70
yV, xrefs: 1000284C
/o, xrefs: 1000299B
j, xrefs: 100029EF
{T>, xrefs: 100029FF
yg, xrefs: 1000292D
{^, xrefs: 10002990

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /o$;c$M%$$j$k$yV$yg${T>${^$}i
API String ID: 0-1421433962
Opcode ID: 1f2b7754708c37d922367034690ea1bb1e2a638b28b3b7c50cd367ce09a5d6a2
Instruction ID: 05b1c6af8125033bb1f702f8d7d61b76824b5cd1bf9d774e36785a3f2458a017
Opcode Fuzzy Hash: 1f2b7754708c37d922367034690ea1bb1e2a638b28b3b7c50cd367ce09a5d6a2
Instruction Fuzzy Hash: 5912EC715093809FD3A8CF61C58AA4BBBF1FBD5758F208A0DE5DA86260D7B58949CF03

Function 6D6001FE Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 376windowthreadshutdownCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000001,?), ref: 6D600443
TerminateThread.KERNEL32(?,00000000,73341224,00000000,?,?,00000000), ref: 6D60045C
SendMessageA.USER32(?,00000111,FFF555EE,F55555EE), ref: 6D60047B
ExitWindowsEx.USER32(00000008,00000000), ref: 6D6006B8

Part of subcall function 6D60D9DE: IsWindow.USER32(?), ref: 6D60D9F2

Part of subcall function 6D62D661: __mbscmp_l.LIBCMT ref: 6D62D66E

Part of subcall function 6D6184CF: SendMessageA.USER32(?,0000102E,?,?), ref: 6D6184F2

Strings

Setting\ScanSet.dat, xrefs: 6D600536
0idm, xrefs: 6D6001DA
0idm, xrefs: 6D6002F1, 6D600300

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$ExitTerminateThreadWindowWindows__mbscmp_l
String ID: 0idm$0idm$Setting\ScanSet.dat
API String ID: 3643140477-2608025216
Opcode ID: 7718d419f1cc44e557dcf43606eba1fcf703aeba46545000542ca85b6bf3a7ab
Instruction ID: c69fad3c4ba7535cf5e1a4c96b8703bf417b00734f1fa7273621c4ebd1fff7ca
Opcode Fuzzy Hash: 7718d419f1cc44e557dcf43606eba1fcf703aeba46545000542ca85b6bf3a7ab
Instruction Fuzzy Hash: 6CE190712083419FDB18CF69C990FAA77E5FF8D318F05892CE6898B292DB70A845CB55

Function 6D5FFC12 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 246threadwindowCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FFC1C
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FFC30
GetDriveTypeA.KERNEL32(00000000), ref: 6D5FFC54
TerminateThread.KERNEL32(?,00000000,Error in Fun_mycomputer,00000000,00000000), ref: 6D5FFCAD
SendMessageA.USER32(?,00000111,FFF555EE,F55555EE), ref: 6D5FFCCC

Strings

Setting\ScanSet.dat, xrefs: 6D5FFD86

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Drive$LogicalStrings$MessageSendTerminateThreadType
String ID: Setting\ScanSet.dat
API String ID: 3133380392-908802073
Opcode ID: f5d4c63a17365be79d03a0f461684d8ad1eb1fee11e01f4dce71282d0dfca833
Instruction ID: 52f304ba4a7b3b9db74de6a14af7ba50a9f0b78f26e332c23c620fcfd43558c0
Opcode Fuzzy Hash: f5d4c63a17365be79d03a0f461684d8ad1eb1fee11e01f4dce71282d0dfca833
Instruction Fuzzy Hash: 3191E17120C2419BD718CB65CD50FABB7F5ABCD308F04891CF6898B681DBB0E809CB56

Function 6D5FFB8F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 246threadwindowCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FFB99
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 6D5FFBAD
GetDriveTypeA.KERNEL32(00000000), ref: 6D5FFBD8
TerminateThread.KERNEL32(?,00000000,Error in Fun_mycomputer,00000000,00000000), ref: 6D5FFCAD
SendMessageA.USER32(?,00000111,FFF555EE,F55555EE), ref: 6D5FFCCC

Strings

Setting\ScanSet.dat, xrefs: 6D5FFD86

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Drive$LogicalStrings$MessageSendTerminateThreadType
String ID: Setting\ScanSet.dat
API String ID: 3133380392-908802073
Opcode ID: cc13fd71c0ac6663a9e69b3665b160907214b3728bf292e6f72b8faa20b4df68
Instruction ID: f813ca309ad4b59d10c0dcdb15fa8934fc89be3130cdacef6b57cc4760df6e4d
Opcode Fuzzy Hash: cc13fd71c0ac6663a9e69b3665b160907214b3728bf292e6f72b8faa20b4df68
Instruction Fuzzy Hash: 8A91E03120C2419BD718CB65CD50FABB7F5ABDD308F14891CF6898B681DBB0E809CB56

Function 6D61172E Relevance: 12.1, APIs: 8, Instructions: 125filestringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D611738
GetFullPathNameA.KERNEL32(00000000,00000104,?,-000001B0,00000158,6D6119D7,-0000015C,?,?,?,00000104,00000000,00000000,?,00000000), ref: 6D611776

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

PathIsUNCA.SHLWAPI(?,?,-000001A8,?,00000000), ref: 6D6117E6
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,-000001B8,-000001B4,00000000,00000000,?,00000000), ref: 6D61180D
CharUpperA.USER32(?), ref: 6D611840
FindFirstFileA.KERNEL32(?,-000001A4), ref: 6D61185C
FindClose.KERNEL32(00000000), ref: 6D611868
lstrlenA.KERNEL32(-00000178), ref: 6D611886

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3H_prolog3_InformationNameThrowUpperVolumelstrlen
String ID:
API String ID: 624941980-0
Opcode ID: c7d11566f466d1e748f09310f9c7a32800c3c80df43bb8394c697d2014dc1d7f
Instruction ID: 12b1ef13c2add065117bff211ba8c70c34277aa0c2c1921748f8f5e5ab647e25
Opcode Fuzzy Hash: c7d11566f466d1e748f09310f9c7a32800c3c80df43bb8394c697d2014dc1d7f
Instruction Fuzzy Hash: 10410671908619DBDF159FA8CC58BFE7778EF69319F008598E919A9280DB388EC4CF50

Function 1001AF0B Relevance: 11.8, Strings: 9, Instructions: 577COMMON

Download Yara Rule

Strings

i?r, xrefs: 1001B891
y[A, xrefs: 1001B25B
)U|, xrefs: 1001B723
Q;, xrefs: 1001B0FC
?, xrefs: 1001B4C5
4Mk, xrefs: 1001B499
&, xrefs: 1001B703
+u, xrefs: 1001B020
4Ur, xrefs: 1001B515

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$)U|$+u$4Mk$4Ur$?$Q;$i?r$y[A
API String ID: 0-3461261877
Opcode ID: a423b7f85e3015c599de528c76bb7cd432928e335d285efd6bab96a4ad68daee
Instruction ID: 97fe2f4a40665754ed736929d2ab25790788795c63e3cd2d8683b2c8f85d3ffd
Opcode Fuzzy Hash: a423b7f85e3015c599de528c76bb7cd432928e335d285efd6bab96a4ad68daee
Instruction Fuzzy Hash: BD62F0715093819BD378CF65C98AB8BBBE1FBC4348F10891DE6D99A260D7B18949CF43

Function 10011B29 Relevance: 11.7, Strings: 9, Instructions: 415COMMON

Download Yara Rule

Strings

RHf, xrefs: 100122BE
BO, xrefs: 10011FBE
DZs/, xrefs: 10011D03
`, xrefs: 10011D83
T(, xrefs: 10011F4B
, xrefs: 10012179
IeO, xrefs: 10011B7E
v, xrefs: 10011F1D
qNv, xrefs: 10011B71

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $BO$DZs/$IeO$RHf$T($`$qNv$v
API String ID: 0-3631915167
Opcode ID: 92e239ade607393e425f5dba0ea291aa626a443c41db43d432ee5a7c7039a24a
Instruction ID: fe9295bb72565695c52a01ddd140b90e49bdf4bbcc242f83c82ab9963943a2f8
Opcode Fuzzy Hash: 92e239ade607393e425f5dba0ea291aa626a443c41db43d432ee5a7c7039a24a
Instruction Fuzzy Hash: FA2222B15083809FD368CF25C48AA5BFBE1FBC5344F108A1DE6D98A261D7B19999CF43

Function 1000364E Relevance: 11.6, Strings: 9, Instructions: 371COMMON

Download Yara Rule

Strings

V(, xrefs: 100037E2
,ko^, xrefs: 10003950
7n3, xrefs: 100036FE
c\x, xrefs: 100038B1
7n3, xrefs: 100036ED
Ji, xrefs: 10003A5F
]By, xrefs: 1000386F
{w, xrefs: 100037EA
), xrefs: 10003AB3

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )$,ko^$7n3$7n3$Ji$V($]By$c\x${w
API String ID: 0-1107212377
Opcode ID: a61eebb33cae8a31ed0134f3632021ab37b38a94c89ba0c1f66bb82ceefaa357
Instruction ID: d7b9fc553c473a6438126c181d70b930d2ccd9e77f15db2f6fb4ea389db22de4
Opcode Fuzzy Hash: a61eebb33cae8a31ed0134f3632021ab37b38a94c89ba0c1f66bb82ceefaa357
Instruction Fuzzy Hash: 430222719083809FD364CF25C486A4BBBE5FBC4348F108A2DF6D99A261D7B59949CF43

Function 10004313 Relevance: 11.6, Strings: 9, Instructions: 365COMMON

Download Yara Rule

Strings

a , xrefs: 10004819
f, xrefs: 100045AC
o(Y, xrefs: 10004646
v`, xrefs: 100046C8
pf7, xrefs: 1000489F
rvB0, xrefs: 100045D4
4Nn, xrefs: 10004685
in, xrefs: 1000440E
U), xrefs: 1000479A

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: 4Nn$U)$a $in$o(Y$pf7$rvB0$f$v`
API String ID: 2591292051-3925418858
Opcode ID: f10ad1a2fa77f65596de889e1205d28d95c48d8c1fc89c565a90ff4c5fd4b7a2
Instruction ID: 611a29810b3a1199c508f54dae9467adcc071ddebd5c577b92409b24f34fc6c9
Opcode Fuzzy Hash: f10ad1a2fa77f65596de889e1205d28d95c48d8c1fc89c565a90ff4c5fd4b7a2
Instruction Fuzzy Hash: 380232B15083809FD364CF65C589A4FBBE1FBC5798F10891DF6AA86260DBB08949CF47

Function 6D613417 Relevance: 10.7, APIs: 7, Instructions: 173comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D613421
_memset.LIBCMT ref: 6D613482
GetVersionExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6D641F10,000000FF), ref: 6D613497
_malloc.LIBCMT ref: 6D6134B8
_memset.LIBCMT ref: 6D6134CF
CoInitializeEx.OLE32(00000000,00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,6D641F10), ref: 6D6135D5
CoCreateInstance.OLE32(6D65C080,00000000,00000001,6D64B834,?), ref: 6D61361C

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: _memset$CreateException@8H_prolog3H_prolog3_InitializeInstanceThrowVersion_malloc
String ID:
API String ID: 4031887728-0
Opcode ID: 8a9d63c266bc9a5a037bf05caa09680f43338b0e7d9fd895a0d8722fbe573482
Instruction ID: c9ad21e6ca7d27a1f8ebe8b43124236c54dd0bd430c730a48c5e324a98648b8c
Opcode Fuzzy Hash: 8a9d63c266bc9a5a037bf05caa09680f43338b0e7d9fd895a0d8722fbe573482
Instruction Fuzzy Hash: 5A7169B0A44745DFDB21CF28C880B9ABBF4BF49718F01899DEA9A9B351D730A944CF51

Function 1000AEBB Relevance: 10.5, Strings: 8, Instructions: 477COMMON

Download Yara Rule

Strings

i7P&, xrefs: 1000AF91
h~;, xrefs: 1000B20F
Q$, xrefs: 1000B129
@7, xrefs: 1000B022
5d+, xrefs: 1000B081
|rXh, xrefs: 1000B31A
i<5, xrefs: 1000B4A5
X], xrefs: 1000B296

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: 5d+$@7$Q$$X]$h~;$i7P&$i<5$|rXh
API String ID: 2591292051-4098937169
Opcode ID: d88b6f50f0a77ac5313b2d9e0d76fbec62d6c4cf73a6480e19557808079301b6
Instruction ID: 377814d76b2d86c1884858ca70d1c34303f2a3e94fa5212087b2306c3cb4838c
Opcode Fuzzy Hash: d88b6f50f0a77ac5313b2d9e0d76fbec62d6c4cf73a6480e19557808079301b6
Instruction Fuzzy Hash: EB42F0715083818FE3B9CF61C54AB8BBBE1FB80748F50891DE5DA96260DBB19948CF43

Function 100213A3 Relevance: 10.3, Strings: 8, Instructions: 287COMMON

Download Yara Rule

Strings

6CR, xrefs: 1002145F
XvN, xrefs: 1002159D
;i, xrefs: 10021771
vQ, xrefs: 1002168E
c, xrefs: 1002172F
?Cd, xrefs: 1002171F
Xh/, xrefs: 100213CE
k/, xrefs: 1002151B

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: 6CR$?Cd$Xh/$XvN$c$k/$vQ$;i
API String ID: 2591292051-1642066035
Opcode ID: 87b446e106eb0e70fbbd57f7259118e10fd5eb6385c451a3294044f87defdc67
Instruction ID: 4bb14dad2b5b3e397de98479dffff4b7f243b58cb2227aeabafde8891f2e44a5
Opcode Fuzzy Hash: 87b446e106eb0e70fbbd57f7259118e10fd5eb6385c451a3294044f87defdc67
Instruction Fuzzy Hash: FDE12F724083809FD3A4CF65C549A8BBBE1FBC4758F508A1DF5DA86260DBB18949CF43

Function 6D5FB800 Relevance: 9.1, APIs: 6, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 6D5FB815

Part of subcall function 6D616A46: __EH_prolog3.LIBCMT ref: 6D616A4D
Part of subcall function 6D616A46: BeginPaint.USER32(?,?,00000004,6D611C62,?,00000058,6D5FB8B9), ref: 6D616A79

SendMessageA.USER32(?,00000027,?,00000000), ref: 6D5FB83C
GetSystemMetrics.USER32(0000000B), ref: 6D5FB84A
GetSystemMetrics.USER32(0000000C), ref: 6D5FB850
GetClientRect.USER32(?,?), ref: 6D5FB85D
DrawIcon.USER32(?,?,?,?), ref: 6D5FB891

Part of subcall function 6D616A9A: __EH_prolog3.LIBCMT ref: 6D616AA1
Part of subcall function 6D616A9A: EndPaint.USER32(?,?,00000004,6D616CE7), ref: 6D616ABC

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3MetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
String ID:
API String ID: 2914073315-0
Opcode ID: 1b00a92ed957d0492732482d82cae658efcea90b7ca05b5c9a3b0887e81ffda1
Instruction ID: 68e4a0980f6beb310720c04d820ea3f73e63ad103d6c33732e66fca9ac0741ca
Opcode Fuzzy Hash: 1b00a92ed957d0492732482d82cae658efcea90b7ca05b5c9a3b0887e81ffda1
Instruction Fuzzy Hash: 312135712083019FD714EF79CC89AAB77F9BBC8604F458A1DF58AC3284DB34E809CA91

Function 100071E3 Relevance: 9.0, Strings: 7, Instructions: 261COMMON

Download Yara Rule

Strings

9, xrefs: 10007408
UDb, xrefs: 100073C8
BrR, xrefs: 1000742A
o@, xrefs: 1000736D
D, xrefs: 1000766E
IXNr, xrefs: 10007566
]l, xrefs: 10007266

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: BrR$D$IXNr$UDb$]l$o@$9
API String ID: 0-356127896
Opcode ID: 54b3e545d742b6863b1a10c9572c4ed0dd34503cbfbbd4c3f3fd8b8cda84459e
Instruction ID: 15cd2c9871fd29e7aafecdb23e1e48238bfb61d3bfb291d42abc18d823ce19b0
Opcode Fuzzy Hash: 54b3e545d742b6863b1a10c9572c4ed0dd34503cbfbbd4c3f3fd8b8cda84459e
Instruction Fuzzy Hash: BDD110724097809FE3A4CF61C889A5FFBE1FB84794F10891CF69A96260C7B58959CF43

Function 1001E168 Relevance: 9.0, Strings: 7, Instructions: 235COMMON

Download Yara Rule

Strings

M", xrefs: 1001E31B
(6, xrefs: 1001E44C
om, xrefs: 1001E26E
CH, xrefs: 1001E323
zk, xrefs: 1001E401
NS, xrefs: 1001E1D2
:V_+, xrefs: 1001E3AC

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: (6$:V_+$CH$om$zk$M"$NS
API String ID: 0-135718759
Opcode ID: b3b9f21eee639c156cfb713098550538031bb551cb1b5e3b7b77e5d6f8b8faec
Instruction ID: 97d79512dc5b36b65bc10859c5369329ddc7a0322f0ba50a036a83c07fb33224
Opcode Fuzzy Hash: b3b9f21eee639c156cfb713098550538031bb551cb1b5e3b7b77e5d6f8b8faec
Instruction Fuzzy Hash: 53B111725083809BD354CF61C48950FFBE1FBC4398F508A1DF9A69A260D7B5D989CF86

Function 1000C151 Relevance: 8.9, Strings: 7, Instructions: 195COMMON

Download Yara Rule

Strings

ZC1, xrefs: 1000C30B
o-y, xrefs: 1000C1B1
AO, xrefs: 1000C249
5-_, xrefs: 1000C37A
SGr, xrefs: 1000C16C
sb, xrefs: 1000C259
~J=, xrefs: 1000C36A

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5-_$SGr$o-y$sb$~J=$AO$ZC1
API String ID: 0-1344538677
Opcode ID: 36380f1e31838bd30e05655b13c212d1936664283888027826a599e8106fff42
Instruction ID: 27b6bd58b6e7c773fcd18acbdcd19a56b440c78a9c87ad2e7b449dd65c26a258
Opcode Fuzzy Hash: 36380f1e31838bd30e05655b13c212d1936664283888027826a599e8106fff42
Instruction Fuzzy Hash: DA9111729093419FD348CF21D58A81BFBE1FB88748F408A1DF5A9A6260D7B5DA09CF47

Function 6D5F27F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dll//AntiVirusDLL2.dll), ref: 6D5F27FE
GetProcAddress.KERNEL32(00000000,GetComputerInfo), ref: 6D5F2821

Strings

GetComputerInfo, xrefs: 6D5F281B
dll//AntiVirusDLL2.dll, xrefs: 6D5F27F9

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetComputerInfo$dll//AntiVirusDLL2.dll
API String ID: 2574300362-350967257
Opcode ID: a881d426e3cd4cd5ea581db6ace9f464590c9a4333d5bea82033b7fb09002e34
Instruction ID: 53bac7ad023e4815ecfc4235e35fc464821637bb41b719b54c640098600cac4f
Opcode Fuzzy Hash: a881d426e3cd4cd5ea581db6ace9f464590c9a4333d5bea82033b7fb09002e34
Instruction Fuzzy Hash: E821B6A17442006BDB2867F45994A3E62AADFCD1047054E29F78ADFA80CF749C460B19

Function 6D617787 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 6D6177B9

Part of subcall function 6D62E99E: __getptd_noexit.LIBCMT ref: 6D62E99E

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 6D6177D1
__snwprintf_s.LIBCMT ref: 6D617806
LoadLibraryA.KERNEL32(?), ref: 6D617841

Strings

LOC, xrefs: 6D6177B1

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: InfoLibraryLoadLocale__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1155623865-519433814
Opcode ID: a157c0cb21249eccb25d5866955ead1a6db05211a8034f0e980e673fd9602b3d
Instruction ID: 2268e7f41a3214a5d271fed4764cfc52fc91ba9e8e98e1f74f09e0f7ddfd2378
Opcode Fuzzy Hash: a157c0cb21249eccb25d5866955ead1a6db05211a8034f0e980e673fd9602b3d
Instruction Fuzzy Hash: 5C21B771D08208EFDB65AB78CC45BEA3BBC9F4E355F0184B1E309D7091DB708945CAA5

Function 1001FECB Relevance: 7.8, Strings: 6, Instructions: 306COMMON

Download Yara Rule

Strings

F, xrefs: 10020145
!{3, xrefs: 10020198
`}6, xrefs: 10020333
A, xrefs: 10020299
/5:, xrefs: 100203D8
nm, xrefs: 100201B5

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !{3$/5:$A$`}6$F$nm
API String ID: 0-387362328
Opcode ID: 6868480723ad66684504a35ffcfeb399fd836ccd63184e16b76c34f9ae57f27d
Instruction ID: 943de48d43427e6e8f0f89a24d8e12b9dc6aad93be47aad7ae39555b364a0f8c
Opcode Fuzzy Hash: 6868480723ad66684504a35ffcfeb399fd836ccd63184e16b76c34f9ae57f27d
Instruction Fuzzy Hash: 44F122B11093809FD368CF25C94AA9FBBE1FBC4758F50891DF29A96261C7B18949CF43

Function 10020A01 Relevance: 7.7, Strings: 6, Instructions: 218COMMON

Download Yara Rule

Strings

mmc, xrefs: 10020D0E
\2, xrefs: 10020A81
mmc, xrefs: 10020D34
]Q+, xrefs: 10020AAB
pOx, xrefs: 10020A68
[Vr, xrefs: 10020BA0

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [Vr$\2$]Q+$mmc$mmc$pOx
API String ID: 0-1739744460
Opcode ID: 05d0f395df65e8b2fcfdb3693fd1f01176fdcae2f62e518792c8bbe3bfd93cfc
Instruction ID: 31abc73a436538be81c86d5a4763a08602da7293d2e27bcff90563269a7e344e
Opcode Fuzzy Hash: 05d0f395df65e8b2fcfdb3693fd1f01176fdcae2f62e518792c8bbe3bfd93cfc
Instruction Fuzzy Hash: 57919AB45093418FD7A8CF21D59182FBBE2EBC4348FA04A1EF98656662C770DA49CF43

Function 10003F5A Relevance: 7.7, Strings: 6, Instructions: 171COMMON

Download Yara Rule

Strings

MX, xrefs: 10003F90
:B, xrefs: 10003FC3
AtG, xrefs: 10003FBB
tn&, xrefs: 10004032
\^, xrefs: 10004115
3., xrefs: 10004058

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 3.$:B$MX$\^$tn&$AtG
API String ID: 0-4051168333
Opcode ID: 3cfc06097e5ee3810f5b3947b4c4f974f736126e78bb91cb219ebdbd5552dcd1
Instruction ID: da8fc26e9f47bfe780f7498fceb4276e58c3eace1c9e8399970d28023daedbfb
Opcode Fuzzy Hash: 3cfc06097e5ee3810f5b3947b4c4f974f736126e78bb91cb219ebdbd5552dcd1
Instruction Fuzzy Hash: DF8164B14093819FD394CF25C54951FBBE0FBC5788F805A1DF59596224C7B18A0A8F87

Function 6D62CD5C Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6D634997
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D6349AC
UnhandledExceptionFilter.KERNEL32(6D64E6B4), ref: 6D6349B7
GetCurrentProcess.KERNEL32(C0000409), ref: 6D6349D3
TerminateProcess.KERNEL32(00000000), ref: 6D6349DA

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c3b5bca125879fb242c10ce2405aa785ada2991ed7d7b55791116bb53dbb5a4e
Instruction ID: 450315f63b425deb9a07a826f15c635a915ceb25577c4207b54a129150995fa3
Opcode Fuzzy Hash: c3b5bca125879fb242c10ce2405aa785ada2991ed7d7b55791116bb53dbb5a4e
Instruction Fuzzy Hash: 7A2125B4804395DFCF40DFABC084B68BBB8BB4A305F11856AE51A87354E7B05985CF86

Function 10017098 Relevance: 6.6, Strings: 5, Instructions: 376COMMON

Download Yara Rule

Strings

|f , xrefs: 1001737E
WTZ, xrefs: 10017433
Z, xrefs: 100174A5
3e, xrefs: 10017161
YTV, xrefs: 10017348

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: WTZ$YTV$|f $3e$Z
API String ID: 0-1675320682
Opcode ID: f950995bf78a32174e2873fdb3132a83a2ab750323c54d57c26a091d4605fac4
Instruction ID: 66bf57b02342690ae9af1cea3f4108fdcceb21c9ff1c101dcb033c265f68e1a4
Opcode Fuzzy Hash: f950995bf78a32174e2873fdb3132a83a2ab750323c54d57c26a091d4605fac4
Instruction Fuzzy Hash: C6023571D0031DDBCF28CFA5D94AADEBBB2FB44354F208199E119BA2A1D7B45A85CF40

Function 1001A916 Relevance: 6.5, Strings: 5, Instructions: 287COMMON

Download Yara Rule

Strings

p#, xrefs: 1001AC2D
h,}, xrefs: 1001A9A1
a{, xrefs: 1001AC83
,i, xrefs: 1001AB1B
ng, xrefs: 1001AA8F

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: a{$,i$h,}$p#$ng
API String ID: 0-4078567710
Opcode ID: 69db0cc2c3aeaaa5c3d225db33449619f3bae1b340577ee1d95541010ca89dcf
Instruction ID: 7189b50cdb7cad40f007e04e7fbf58ca1861ae8f3a44cb07541391f0cceca69f
Opcode Fuzzy Hash: 69db0cc2c3aeaaa5c3d225db33449619f3bae1b340577ee1d95541010ca89dcf
Instruction Fuzzy Hash: E3E10FB15083809FD7A8CF65C589A4BFBE1FB85748F50891DF69A86220C7B59589CF03

Function 1001E5ED Relevance: 6.5, Strings: 5, Instructions: 255COMMON

Download Yara Rule

Strings

z8%, xrefs: 1001E8ED
.&c, xrefs: 1001E716
z8%, xrefs: 1001EA6A
Cc, xrefs: 1001E889
qh), xrefs: 1001E7B4

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .&c$qh)$z8%$z8%$Cc
API String ID: 0-2743671612
Opcode ID: b5cfeff35a7a3b332ba63f1d9cc46acf5e92daca859e4714dd25723463be95cb
Instruction ID: 72eeead001b069b47831c26b821a0d15640e5af7adca2d33b01bbaa6f6a403c4
Opcode Fuzzy Hash: b5cfeff35a7a3b332ba63f1d9cc46acf5e92daca859e4714dd25723463be95cb
Instruction Fuzzy Hash: 64C12F714083819BC398CF65C48551FFBE1FBC5784F608A1DF6A68A260D3B5DA49CF92

Function 1000C4E5 Relevance: 6.5, Strings: 5, Instructions: 252COMMON

Download Yara Rule

Strings

}', xrefs: 1000C7EF
}u, xrefs: 1000C500
W6, xrefs: 1000C80C
\A{, xrefs: 1000C7D6
W|, xrefs: 1000C6B1

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }'$W6$\A{$}u$W|
API String ID: 0-1907099679
Opcode ID: f56a06ae7da62d0bc798d8c4c1489dc864e5b38bc39b08e021e9523d03ad996e
Instruction ID: f835184ca736a2e9423f607d538261cd1bfdc0f8ace2d1a06bf2b2c7047734e1
Opcode Fuzzy Hash: f56a06ae7da62d0bc798d8c4c1489dc864e5b38bc39b08e021e9523d03ad996e
Instruction Fuzzy Hash: A9C1FFB25083809FE358CF65C48A90BFBF2FBC4798F20891DF5A586260D7B59949CF46

Function 10016998 Relevance: 6.4, Strings: 5, Instructions: 172COMMON

Download Yara Rule

Strings

G0*, xrefs: 10016ABD
9:, xrefs: 100169FF
1C7, xrefs: 100169F8
-, xrefs: 10016A4F
O', xrefs: 10016BC0

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: 1C7$9:$G0*$-$O'
API String ID: 4033686569-3620061630
Opcode ID: efd11a429bc393f337fe78b0ff09bfb655d90c11e94818fed1efcf439fef0cbd
Instruction ID: b083de8463aa5142ce971b951a62e6421028c14343941be5a0b53751c1df4e2c
Opcode Fuzzy Hash: efd11a429bc393f337fe78b0ff09bfb655d90c11e94818fed1efcf439fef0cbd
Instruction Fuzzy Hash: C291FF71C0130DABCF58CFE5D98A8DEBBB2FB44318F208159E415BA260D7B51A5ACF94

Function 6D60A4E0 Relevance: 6.0, APIs: 4, Instructions: 42keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D60D952: GetWindowLongA.USER32(?,000000F0), ref: 6D60D95D

GetKeyState.USER32(00000010), ref: 6D60A506
GetKeyState.USER32(00000011), ref: 6D60A50F
GetKeyState.USER32(00000012), ref: 6D60A518
SendMessageA.USER32(?,00000111,0000E146,00000000), ref: 6D60A52E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 7f491be72a0cceae6e2c98d5b5ded3d699f1572ab0edd9eb8b23b6346f284399
Instruction ID: fc7e5dcab592ffbcf29e171e383e063dbde7d3517d31432bf8186d276785cf9e
Opcode Fuzzy Hash: 7f491be72a0cceae6e2c98d5b5ded3d699f1572ab0edd9eb8b23b6346f284399
Instruction Fuzzy Hash: B3F0E9BB75029BA6EB0D26B55F10FE505256FDDBD4F014431F785AA0C0CFD0C80246B4

Function 6D6025F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 296COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(c:\,?,00000080,?,00000000,00000000,?,00000080), ref: 6D6027B9

Strings

%08X%08X, xrefs: 6D602703, 6D602738
c:\, xrefs: 6D6027B4

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: InformationVolume
String ID: %08X%08X$c:\
API String ID: 2039140958-3129558565
Opcode ID: 8973ea428ad6b4c1a9c29ac30de4f679693841f137114b4ef8d71e3d8cc7fda6
Instruction ID: bd214ba8dc91946c205a15f57e1d9ae61f5092197cc2698a604a02f7bccc7b03
Opcode Fuzzy Hash: 8973ea428ad6b4c1a9c29ac30de4f679693841f137114b4ef8d71e3d8cc7fda6
Instruction Fuzzy Hash: F1B17C712087429FE359CB69C850B6BB7E9FFC9328F14875CE159CB2A1DB309905CB92

Function 1001EEC2 Relevance: 5.3, Strings: 4, Instructions: 349COMMON

Download Yara Rule

Strings

F, xrefs: 1001F0A9
u, xrefs: 1001F54E
:<R, xrefs: 1001F1A6
!i}, xrefs: 1001F067

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !i}$:<R$F$u
API String ID: 0-712849541
Opcode ID: 09eb7c3b5cfc0642d3eb159325cb21f2c350489a53eb2a9265293d0e1fd2f9ad
Instruction ID: e9951d65d66cc20938487db1079c6fe9e7e69cec811bd55f77d28f4ebd816fb6
Opcode Fuzzy Hash: 09eb7c3b5cfc0642d3eb159325cb21f2c350489a53eb2a9265293d0e1fd2f9ad
Instruction Fuzzy Hash: 080255715083808FC7A8CF61C585A5BBBE1FBD4758F60890DF68A8A261D7B1D989CF43

Function 1000958A Relevance: 5.3, Strings: 4, Instructions: 262COMMON

Download Yara Rule

Strings

|8{T, xrefs: 100097F7
)$, xrefs: 100095ED
A[, xrefs: 100097D9
faBu, xrefs: 10009A20

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: A[$faBu$|8{T$)$
API String ID: 0-2976587679
Opcode ID: ec93d3bf07f91e99e0ca5409f0abfadcb698196a58892a72ed7a9e9f3a6d53db
Instruction ID: 4cfabb151a415fde5112c8c5bfc3cddf3fb4ffc85d9229d0b55a423f7f398b36
Opcode Fuzzy Hash: ec93d3bf07f91e99e0ca5409f0abfadcb698196a58892a72ed7a9e9f3a6d53db
Instruction Fuzzy Hash: A6D110725083809FD3A8CF25D58A94BFBF1FBC5748F108A1DF2A986260D7B58949CF42

Function 10001A5F Relevance: 5.2, Strings: 4, Instructions: 176COMMON

Download Yara Rule

Strings

~|;, xrefs: 10001C5D
G, xrefs: 10001C26
X, xrefs: 10001B76
I,I, xrefs: 10001BF6

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G$I,I$X$~|;
API String ID: 0-2912738583
Opcode ID: 77c2b16034b4554d9885431044c5ebd67010afa8c4d0da19a09aebd2032817ea
Instruction ID: 3ec3020a0955cb98c1bac5e7baaca2078f278e56f0c787796e7cc02ce95d2cfa
Opcode Fuzzy Hash: 77c2b16034b4554d9885431044c5ebd67010afa8c4d0da19a09aebd2032817ea
Instruction Fuzzy Hash: D68112B1509781AFD388CF64D58680BFBF1FB84748F405A1DF596A6260D3B5D908CB87

Function 10017E3D Relevance: 5.2, Strings: 4, Instructions: 167COMMON

Download Yara Rule

Strings

mz, xrefs: 10017EFF
;Dh, xrefs: 1001803D
)0g, xrefs: 10017E68
)0g, xrefs: 10018072

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )0g$)0g$;Dh$mz
API String ID: 0-1774774541
Opcode ID: fba09aa33dc81b2521ad7f9275d737a16c6a115bb55e1870d6aaac202352e3ec
Instruction ID: 11f08e02bfdb034d464a7c79d73db381c8108470516bb2517386122046a683ff
Opcode Fuzzy Hash: fba09aa33dc81b2521ad7f9275d737a16c6a115bb55e1870d6aaac202352e3ec
Instruction Fuzzy Hash: CC713075108385ABD398CE61C88991FBBE1FBD8748F409A1DF5D69A220C3B5DA49CF43

Function 10013983 Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

0As, xrefs: 10013ADA
6p, xrefs: 10013B02
\m, xrefs: 10013AE2
lV, xrefs: 10013A51

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0As$6p$\m$lV
API String ID: 0-925760428
Opcode ID: dee23f884468536b0a5b5edf1e1d81506725524f780b5c5b8c18997d6d46b82b
Instruction ID: 84b28240dd5f3930e8cfcc6b1da8a56b30838a45346fa4f39edebd7272517dd8
Opcode Fuzzy Hash: dee23f884468536b0a5b5edf1e1d81506725524f780b5c5b8c18997d6d46b82b
Instruction Fuzzy Hash: 7561347150C3419BC354CE21C98981FBFE6FBC47A8F504A1DF6969A260D3B5DA898F82

Function 6D6078E8 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81e66dafe32fa9b1dc70c1d6575e62ccbd270a4d64db42346ccf21a67bb4890
Instruction ID: 450f01e9475197176c9b399e73a8cc1401c9b2688957833b3fe3632e65fe4401
Opcode Fuzzy Hash: b81e66dafe32fa9b1dc70c1d6575e62ccbd270a4d64db42346ccf21a67bb4890
Instruction Fuzzy Hash: 05F03C31A5414EAFDF0AAFA6CE08AEE3F79BF19395B00C024F929D5010DB31D650DBA0

Function 1000E65A Relevance: 4.0, Strings: 3, Instructions: 259COMMON

Download Yara Rule

Strings

ajW, xrefs: 1000E7CF
~0, xrefs: 1000E88D
rxj<, xrefs: 1000E7DF

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: rxj<$ajW$~0
API String ID: 0-4188916868
Opcode ID: acaebf906b5d1b4fb3e6917d85a80d437da6bad1f0f4abfd0e3e441dfc5d7667
Instruction ID: 1455f6d3bd2cdd338bb3ced186e14630516c4729c4618bf93efa1ef574ac1606
Opcode Fuzzy Hash: acaebf906b5d1b4fb3e6917d85a80d437da6bad1f0f4abfd0e3e441dfc5d7667
Instruction Fuzzy Hash: E9C112B15083819BD3A8CF61C58581FBBE1FBC8788F104A1EF69666265D7B1DA09CF43

Function 10012B1F Relevance: 4.0, Strings: 3, Instructions: 242COMMON

Download Yara Rule

Strings

6s:, xrefs: 10012C8F
="&, xrefs: 10012C48
@J, xrefs: 10012DC6

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6s:$="&$@J
API String ID: 0-1291149906
Opcode ID: 721145b223498ec0f1a49e0d4607bde14810ad7390df8733dc3e63dc860cbfd8
Instruction ID: 9e950f91ca8bedf06035c1a71bb38ddd9e777c444e10e256619bf9c256a899d2
Opcode Fuzzy Hash: 721145b223498ec0f1a49e0d4607bde14810ad7390df8733dc3e63dc860cbfd8
Instruction Fuzzy Hash: 8AB110B15083819FD7A8CF25C98591BFBF1FB85348F50492EF5968A220D7B1CA99CF42

Function 1000CDE0 Relevance: 4.0, Strings: 3, Instructions: 229COMMON

Download Yara Rule

Strings

B%T, xrefs: 1000CE20
$>, xrefs: 1000CF38
Fo%, xrefs: 1000D118

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $>$B%T$Fo%
API String ID: 0-816726572
Opcode ID: 55595bb8180c5911231260298d0d3a0c9e1793ea1c1e78128bcee741f44b2285
Instruction ID: 29bc5aaf8945821ea7ade7caff5cbd00d213cc82dac986d7be516789f7c8ca3c
Opcode Fuzzy Hash: 55595bb8180c5911231260298d0d3a0c9e1793ea1c1e78128bcee741f44b2285
Instruction Fuzzy Hash: 75C11E710083809FD768DF20C58A41FBBF1FBD4788F604A1DF6A696260C7B18A49CF82

Function 10012783 Relevance: 4.0, Strings: 3, Instructions: 201COMMON

Download Yara Rule

Strings

8oW, xrefs: 100128DA
-M^6, xrefs: 10012839
ab, xrefs: 1001290D

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -M^6$8oW$ab
API String ID: 0-4042031332
Opcode ID: a5f24092e32d3a9c857a4c2ab682468fe3bfb63a33d7ffcafa9aec599312b2c7
Instruction ID: 32143eb62b5b3ce313cbe3f865b2224ea15b83bda0ce18bf617bb1a839084d23
Opcode Fuzzy Hash: a5f24092e32d3a9c857a4c2ab682468fe3bfb63a33d7ffcafa9aec599312b2c7
Instruction Fuzzy Hash: DA9144B16083419FC768CE61D98991BBBE1FFC5388F00891DF6855A260D7B2D9A9CF43

Function 100022F7 Relevance: 3.9, Strings: 3, Instructions: 191COMMON

Download Yara Rule

Strings

8, xrefs: 1000258E
P\%, xrefs: 10002579
j6k, xrefs: 10002312

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: P\%$j6k$8
API String ID: 0-3665046756
Opcode ID: 87e90175376fd117733453265d6c76854319db59a287c61951172c501d175640
Instruction ID: 609a0d2847fa531313edf52411c26786b532a1175dbf8011a9420c1fc0a6df7f
Opcode Fuzzy Hash: 87e90175376fd117733453265d6c76854319db59a287c61951172c501d175640
Instruction Fuzzy Hash: E2911FB14083819FD398CF65C98A81FBBF1FB84788F505A1DF69596220D3B68A19DF43

Function 10017730 Relevance: 3.9, Strings: 3, Instructions: 182COMMON

Download Yara Rule

Strings

^w, xrefs: 1001779B
-w}, xrefs: 10017854
8z, xrefs: 100178F6

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -w}$^w$8z
API String ID: 0-2264566183
Opcode ID: 70022e4a20332d3ef59d5ceec16eb0767f7e5c972c2db16544fb374251f58d0a
Instruction ID: 27dfddf48f449b8b7f5bd6a8470976e6f78dfad4ac1bc1404c4f45e340148b0c
Opcode Fuzzy Hash: 70022e4a20332d3ef59d5ceec16eb0767f7e5c972c2db16544fb374251f58d0a
Instruction Fuzzy Hash: 078130715083419FC358CE21C58691FBBF2FBC8758F508A2DF29A9A260D7B1DA49CB43

Function 1000BB14 Relevance: 3.9, Strings: 3, Instructions: 149COMMON

Download Yara Rule

Strings

N{A, xrefs: 1000BBE3
7]R, xrefs: 1000BB34
Ltu, xrefs: 1000BB7C

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 7]R$Ltu$N{A
API String ID: 0-3184169258
Opcode ID: 22fa71c6b708005f2509732b31736f2ff453d5a187519ebed40b0efb6c44d4ca
Instruction ID: eb42cd8d5ff788ab70213680a14bf161691961874a4d8cc78244dc792375bba0
Opcode Fuzzy Hash: 22fa71c6b708005f2509732b31736f2ff453d5a187519ebed40b0efb6c44d4ca
Instruction Fuzzy Hash: 0C613371C0121AEBDF08CFA5D98A5EEFBB2FF18314F208199E511BA260D7B51A45CF90

Function 10007761 Relevance: 3.9, Strings: 3, Instructions: 142COMMON

Download Yara Rule

Strings

~, xrefs: 10007947
*/, xrefs: 1000792A
=a2, xrefs: 100078CA

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: */$=a2$~
API String ID: 0-332255120
Opcode ID: 8cc541b1c3842fdbeee96673c88ddf90f38b9387c3a14b9ae6b16896d8285e58
Instruction ID: 6e71d6fcdef145d4f9dce0efa790ce3b0b828dd921448c972288cb2cd6746e15
Opcode Fuzzy Hash: 8cc541b1c3842fdbeee96673c88ddf90f38b9387c3a14b9ae6b16896d8285e58
Instruction Fuzzy Hash: 0A5152719083429BC348CF25C58941FFBE1FBC4398F504A2EF99996225D7B5CA48CF82

Function 10013231 Relevance: 3.9, Strings: 3, Instructions: 125COMMON

Download Yara Rule

Strings

;0, xrefs: 100133B2
$W1, xrefs: 10013277
;0, xrefs: 10013272

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $W1$;0$;0
API String ID: 0-91903146
Opcode ID: 17d40303852087ffd0255f1e625073349ba253020fc485cac8795162a00bb6a5
Instruction ID: 4f256a7d5660320d08b6d7e8e9440d24dab260266773ff9a2826a645a3f619fc
Opcode Fuzzy Hash: 17d40303852087ffd0255f1e625073349ba253020fc485cac8795162a00bb6a5
Instruction Fuzzy Hash: 5B5166719083419BD358DF25D48A40FBBE1EBC83A8F10492DF9999A221D770DA89CB97

Function 1001CFA0 Relevance: 3.9, Strings: 3, Instructions: 110COMMON

Download Yara Rule

Strings

6Z, xrefs: 1001D0B7
uV, xrefs: 1001D150
VZ&, xrefs: 1001D045

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6Z$VZ&$uV
API String ID: 0-3689900115
Opcode ID: f616f49b9d7bdd31c6dddbbdda0d23d408ccc6974a6b0e82ee55db1157acff6a
Instruction ID: 4460ce29a2ff2a327a7b84e21a426b8ce18bd19001f0f04f94890c4ba210162a
Opcode Fuzzy Hash: f616f49b9d7bdd31c6dddbbdda0d23d408ccc6974a6b0e82ee55db1157acff6a
Instruction Fuzzy Hash: 97414771508342AFC758EE21D84541FBBE1FBC8698F104A1EF58656260D775CA89CF87

Function 10019285 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

8j, xrefs: 10019429
gC, xrefs: 10019383

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8j$gC
API String ID: 0-1253789705
Opcode ID: 93b65ea9ac4323a1333c898bc226b600c947aad5e7244faaa75801157a379fdb
Instruction ID: 958e4bd6533b1d5e662f84a42c0ce0b20dd8945e92bd222b1e6eb6c9df49f7b0
Opcode Fuzzy Hash: 93b65ea9ac4323a1333c898bc226b600c947aad5e7244faaa75801157a379fdb
Instruction Fuzzy Hash: 41B111B5D00319EBDF18CFE5D88AADEBBB2FB44714F208059E125BA254C3B45A45CF90

Function 10001DCA Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

1Z, xrefs: 10001E1E
ICG{, xrefs: 10001DFF

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 1Z$ICG{
API String ID: 0-3858990741
Opcode ID: 19d7b763f59c274b39ad01ee0b929f100e2e12b0f30b27bb5447f1327c964cb4
Instruction ID: da3ab727ab2f2d0fb984cf28a879d63f0a2c5b71c5460bd5113b15aa7d50eb82
Opcode Fuzzy Hash: 19d7b763f59c274b39ad01ee0b929f100e2e12b0f30b27bb5447f1327c964cb4
Instruction Fuzzy Hash: 4C9143729093409FD398CF24D88A40FBBE1FBD5798F408A1DF98996264D7B5D909CF02

Function 100205F6 Relevance: 2.7, Strings: 2, Instructions: 166COMMON

Download Yara Rule

Strings

x}, xrefs: 10020808
", xrefs: 10020833

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "$x}
API String ID: 0-146941907
Opcode ID: a127a5fe5477d2b72d35e0e762179c02e217160014e532ff9ca0c06a32aaf90b
Instruction ID: f1aa3e4366c30d42da9680169faee129bef8cff435b5c237dca8dd2186290a3f
Opcode Fuzzy Hash: a127a5fe5477d2b72d35e0e762179c02e217160014e532ff9ca0c06a32aaf90b
Instruction Fuzzy Hash: 5E715272509340AFC798CF65C94990BBBF2FBC4B58F905A0DF69656220D7B68909CF83

Function 10014E54 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

}m`, xrefs: 10014EA2
-A, xrefs: 10014F5D

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }m`$-A
API String ID: 0-3093481195
Opcode ID: 87e7d8104ef8cc2791b0dfc9e4b40d4090cb19fabad17ace80fb2e6409c610f3
Instruction ID: 4bb36778868bcf284b14b5f43e4a4192316160feee54e56514b5228092365473
Opcode Fuzzy Hash: 87e7d8104ef8cc2791b0dfc9e4b40d4090cb19fabad17ace80fb2e6409c610f3
Instruction Fuzzy Hash: 7C7132B1C00209EFDF59CFE0C94A9DEBBB2FB08314F208149E516BA260D7B65A59CF50

Function 10013E89 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

a%, xrefs: 10013F5F
7s, xrefs: 10013F36

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 7s$a%
API String ID: 0-3959665897
Opcode ID: beca20e54f3b74eb281645ddaea50704b02d72558b78ea1c942aa823cec2d618
Instruction ID: 113e2eff4106986ccd654863a9107856f8d764fe031eeabcc587d9d604aef2d2
Opcode Fuzzy Hash: beca20e54f3b74eb281645ddaea50704b02d72558b78ea1c942aa823cec2d618
Instruction Fuzzy Hash: ED71DDB14083809FC754CF65C98A81BFBF1BBC9758F408A1DF99996260D3B6DA48CF06

Function 1000A4DE Relevance: 2.6, Strings: 2, Instructions: 145COMMON

Download Yara Rule

Strings

L-0, xrefs: 1000A654
b>v, xrefs: 1000A57D

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: L-0$b>v
API String ID: 0-2557773390
Opcode ID: 02d4e96a6b00c6bfb40fd27bc6dae8a6bd038d84f847921e912e914f7a37eef0
Instruction ID: 5169e6eee87753159c4ed22f7aa6e96b919b6107a42dda1e827d7dd1eb603d5a
Opcode Fuzzy Hash: 02d4e96a6b00c6bfb40fd27bc6dae8a6bd038d84f847921e912e914f7a37eef0
Instruction Fuzzy Hash: 015173B150C342AFD754CF20C88981FBBF1FBC5798F508A1DF58A96220D3B59A899B47

Function 10007013 Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

Y1, xrefs: 1000702A
]8, xrefs: 10007079

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Y1$]8
API String ID: 0-3302549726
Opcode ID: 570eec4fe22fb7e64ec8a49df5c19a0d57e10de8d951410669059738569a32ea
Instruction ID: 22b6b26c5257d77bec63d21bf165f972417590e7814434d8060e742bf22e0264
Opcode Fuzzy Hash: 570eec4fe22fb7e64ec8a49df5c19a0d57e10de8d951410669059738569a32ea
Instruction Fuzzy Hash: CB5199716093029FE358CF28C94595BBBE1FFC4B98F50882CF89986261D775DA19CF82

Function 10009343 Relevance: 2.6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

H(, xrefs: 100093F9
A., xrefs: 100093A6

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: H($A.
API String ID: 0-2251998262
Opcode ID: 369bf18cad9c9a825925ee672bc48449f96ee962289b027eed8e27e2b62fd5b7
Instruction ID: ad5db7e1c1f9006debee6a4a1a1af56749a7d2c908ab58347c95ae7549e427d1
Opcode Fuzzy Hash: 369bf18cad9c9a825925ee672bc48449f96ee962289b027eed8e27e2b62fd5b7
Instruction Fuzzy Hash: 30414871A083018FD314CF29D88491BBBF2EBC9744F00892DF99897251C775E9598F96

Function 10016E97 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

Ez, xrefs: 10016F08
m}., xrefs: 10016FB5

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Ez$m}.
API String ID: 0-3270494409
Opcode ID: d2ccd05eaa8bc6cd6895ff0ce8a3f5fcc6c75b7c7f095afd7c738746a23d30b6
Instruction ID: 937db364299756ffa32702f5a60d51d2def98d7fc3a1a72e5d3e3d51f2d8a005
Opcode Fuzzy Hash: d2ccd05eaa8bc6cd6895ff0ce8a3f5fcc6c75b7c7f095afd7c738746a23d30b6
Instruction Fuzzy Hash: C5510F710093419FC398DF25D58980BBBF1FBC8758F809A1DF49A96220C3B0EA498F92

Function 1001FAD1 Relevance: 2.6, Strings: 2, Instructions: 111COMMON

Download Yara Rule

Strings

zI, xrefs: 1001FB55
[8V, xrefs: 1001FAFD

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [8V$zI
API String ID: 0-7124573
Opcode ID: 7ee5508a42d793d338c3a3453ab651a2523bc2996baf11e9e386dead470e74bc
Instruction ID: 99b3f636261f3252003b2f1ed336f0af3223e238865436ef2090dcdd92977a1a
Opcode Fuzzy Hash: 7ee5508a42d793d338c3a3453ab651a2523bc2996baf11e9e386dead470e74bc
Instruction Fuzzy Hash: 0841CD715083068BD314CE25D5A482FBBE2FBD4758F10892EF9869B250D3B4DA499B83

Function 10013094 Relevance: 2.6, Strings: 2, Instructions: 103COMMON

Download Yara Rule

Strings

.c, xrefs: 10013122
Q, xrefs: 100130ED

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Q$.c
API String ID: 0-2625308445
Opcode ID: 0b7d7f54afde24db4bd51453a3d3c7343f1ebadcef81c582e73d1cfa7f7e7fd7
Instruction ID: 3b5efa14c838de30df227b98d6ca38e826de3aa9765ea5ef4d643aa9db03aa09
Opcode Fuzzy Hash: 0b7d7f54afde24db4bd51453a3d3c7343f1ebadcef81c582e73d1cfa7f7e7fd7
Instruction Fuzzy Hash: 3B41F2B1C01219EBDF15CFA4C94A8EEBBB5FB04304F208199D111B6260E3B95B44DFA4

Function 1001F7F4 Relevance: 2.6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

5(b, xrefs: 1001F818
2%m, xrefs: 1001F87F

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2%m$5(b
API String ID: 0-1732443568
Opcode ID: cc0cc2f081a2bb8332fabe4028bae2f4742cdaab324a5af8df168e7ea1618577
Instruction ID: 99be4c1ee476046a936ae62456a4332f82e2883c85743bd0d42d5da74ebd3ff3
Opcode Fuzzy Hash: cc0cc2f081a2bb8332fabe4028bae2f4742cdaab324a5af8df168e7ea1618577
Instruction Fuzzy Hash: 62414471D0020AABDF08CFA1D94A5EEBBB1FF54700F208059D911BA290D7B65B55CF91

Function 6D60BF21 Relevance: 2.0, APIs: 1, Instructions: 452COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D60BF28

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3e429e22ddc17dac6e80993a2be38803cc7a64f92aec2e1f23d96d8939126869
Instruction ID: 16ae372e7c9ff3a0ea27d2f34d7b92b06d27fe3c247ba966ad2dfc6059d6f5b5
Opcode Fuzzy Hash: 3e429e22ddc17dac6e80993a2be38803cc7a64f92aec2e1f23d96d8939126869
Instruction Fuzzy Hash: F4F14B7061420AAFDB09CF68CA80AFE77B9BF0D354F02C519E91AAB251DB35D901CB64

Function 6D61A853 Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,?,?), ref: 6D61A861

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 8ba153687f8a1ad49635d7829e03e92c9084d030b380727229d276c5a6b7b67c
Instruction ID: 5d7761d59c52fe6569bf7a621944ca13323064442e882a63e1621d53c7b045e2
Opcode Fuzzy Hash: 8ba153687f8a1ad49635d7829e03e92c9084d030b380727229d276c5a6b7b67c
Instruction Fuzzy Hash: 22D012371041087BCF051AA5DC0688D7F65EB45330714C219F529850A1D733D9A1EB80

Function 6D61A53D Relevance: 1.5, APIs: 1, Instructions: 10networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 6D61A54E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 13e7a706f95c1ae0a298b20ed4a0da968ee37aeb8eb6530366d3641ba8ff0fbc
Instruction ID: 6dc822b848b051b4600b197c1ae6b4852aad2acb447b89a27c077c900ba70dcc
Opcode Fuzzy Hash: 13e7a706f95c1ae0a298b20ed4a0da968ee37aeb8eb6530366d3641ba8ff0fbc
Instruction Fuzzy Hash: 92C0023604414CFB8F025F82DD05D9A7F2AFB99360B18C015FA1805021C733D571EB91

Function 100135A3 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

[A, xrefs: 10013667

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: [A
API String ID: 0-1337053708
Opcode ID: 2df50b8a457a62284f47b4bef2842306c5353f661bbadacc302428e25ed516ad
Instruction ID: b95e6eb9715c6d04fe1dd4054615cedac6f17f3c6daa82a623d61c6691136f8b
Opcode Fuzzy Hash: 2df50b8a457a62284f47b4bef2842306c5353f661bbadacc302428e25ed516ad
Instruction Fuzzy Hash: E7A1EDB55093819FC398CF6AC58940BFBE4FBC4758F108A1DF99596221D3B4DA89CF82

Function 1001DF2B Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

>fq, xrefs: 1001E0BA

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: >fq
API String ID: 0-3306265603
Opcode ID: 341142587422d417f17cd13d35d93696e78c733875d16982bff68ebc8564f8c7
Instruction ID: ee4000c96145e652893a148b816c90257a549f4cea63a67573ebb9f4c1be231e
Opcode Fuzzy Hash: 341142587422d417f17cd13d35d93696e78c733875d16982bff68ebc8564f8c7
Instruction Fuzzy Hash: 79513271508341AFC789CF25C98980BBBF1FBC8758F505A1CF58656220D3B1CA89CF82

Function 10021A0A Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

&Cj, xrefs: 10021A95

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &Cj
API String ID: 0-3048372160
Opcode ID: d7484a658b88edb967a0cc4a66cb019a3fcb705f29091c344cf0e0ec6a1b9aa4
Instruction ID: f0d0493d0ded3528bc3347fc06d6bb6e1d40e5f90677d51a160d333ff0dca75f
Opcode Fuzzy Hash: d7484a658b88edb967a0cc4a66cb019a3fcb705f29091c344cf0e0ec6a1b9aa4
Instruction Fuzzy Hash: 7F5146B5D0020DEBCF08CFE5C9868EEBBB6FF48314F108199E511B6260E7745A458FA4

Function 1000188C Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

Si, xrefs: 1000197D

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Si
API String ID: 0-3544519720
Opcode ID: 278147f5c3bf1fb876cbd81278b4c6a324d2545211b611b3f3f851bcff42cebc
Instruction ID: 563ad8a1516a503bb69f8f1d316a6e2f42b8ecd842467e56bdf0f88f8bb4c872
Opcode Fuzzy Hash: 278147f5c3bf1fb876cbd81278b4c6a324d2545211b611b3f3f851bcff42cebc
Instruction Fuzzy Hash: D8417A715083468FD718CF60959546FBBE5FBC5388F004A1EF586A6225D771DA09CF83

Function 100223B9 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

][-, xrefs: 100224AB

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ][-
API String ID: 0-642903904
Opcode ID: 12d6bf39a696b811b87ec668ef6ee674d6c4fe829f873bdf6dd9df4a1cb0bc10
Instruction ID: 08524ce2a89b4792a71547428fe5d425b111d9be0e2a9651941297c2d82a0788
Opcode Fuzzy Hash: 12d6bf39a696b811b87ec668ef6ee674d6c4fe829f873bdf6dd9df4a1cb0bc10
Instruction Fuzzy Hash: 11419C71608301ABD318CF65E44541FBBE1FBC8758F148A1EE499A7264D3B1CA49CB93

Function 1001F9AF Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

T, xrefs: 1001FA3A

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: T
API String ID: 0-4218349378
Opcode ID: 5cbdb13f17435192ceeabd7ce887680e0570211b9ea0a79361a8cac6a7ca349d
Instruction ID: 215545912d2a55678726980c4123d9061eee2f6a618b539d8b0e41853702a231
Opcode Fuzzy Hash: 5cbdb13f17435192ceeabd7ce887680e0570211b9ea0a79361a8cac6a7ca349d
Instruction Fuzzy Hash: E4319CB25083029BC314CF25D88541BFBE1FBD4758F118A2DE8E98B211D379D94ACB93

Function 1000186B Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

Si, xrefs: 1000197D

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Si
API String ID: 0-3544519720
Opcode ID: 772288a6c65f622235bba70c83a109ef0ccd7a2ca8f4960e84c22babaf34fb0b
Instruction ID: cf7eb8e7adca427df201870ff9314845844219015ac21f0a141867c8400424a4
Opcode Fuzzy Hash: 772288a6c65f622235bba70c83a109ef0ccd7a2ca8f4960e84c22babaf34fb0b
Instruction Fuzzy Hash: 6A3157B25093428FD758CF60859A06FFBE0FF95798F004A1EF596A6121D7B0CA498F87

Function 10002F36 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

zE, xrefs: 10002FB5

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: zE
API String ID: 0-1652785882
Opcode ID: b641ca8c5750b17f19e4ec43b43a65263363f4c16b8fb94a6cd6cfed2e7dd6fd
Instruction ID: 1b2a09295ae9001e5d485b22bf9e19d340439bd1bbcf6398235ba256c6f14f94
Opcode Fuzzy Hash: b641ca8c5750b17f19e4ec43b43a65263363f4c16b8fb94a6cd6cfed2e7dd6fd
Instruction Fuzzy Hash: F421AD714083429FC305DF26D58A40FFBE4FBC0694F508A6CF5AA97225C7B5DA19CB92

Function 1000CA3C Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

o`, xrefs: 1000CA7E

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: o`
API String ID: 0-2455046745
Opcode ID: 2d71cbd1b263e8fc0cf64166de4a08ed7d43f85a706d30546d994ae3fdd29e7e
Instruction ID: 394579689d9e54e0afd95de8dd2fe927bc51fad7cb2ca5b849331732b4244631
Opcode Fuzzy Hash: 2d71cbd1b263e8fc0cf64166de4a08ed7d43f85a706d30546d994ae3fdd29e7e
Instruction Fuzzy Hash: 4021EF75D01209EBDF08CFE0CA4A5AEFBB1FB44708F20818AD115A7240DBB51B45DF80

Function 6D62FE6E Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 5b0afeeff36af20c4c085e2c8578b2f3dba51581f5d6bc6a6382df1fab4d5de1
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 21D17D73C1F9F30A832A856E546853BEE726FC6A5131BC3E0DCE43F689D6265D049AD0

Function 6D62FA4E Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 029b831018b69380cdccd5637d238bfbd4271b718af6acd5d51f42558e4d2d2f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: E4D19077D0F9B30A833A856E446853BEA726FC6B5531BC7E1DCE02F689D6265C048AD0

Function 6D62F642 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 54d9cdbbaeeb908c23bef83569b0d8a17a4f33e4b01f6ccad52407dc9eb6346d
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: B9C16277C1F9F306833A856E505863BEAB26FC6A5431BC3E1DCE43F68996269D0489D0

Function 6D62F26E Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 1caeea7aaf1b1afa6a36f3d46140872ac07d9a373fd2d1ed823d7a8a635138cf
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 25C17177D1F5F306833A856E506853BEEB26FC6A4431AC3E1DCE43F689D6265D018AD0

Function 10018966 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee7669f7dea7091e3b2f9a38d437239e7b7a0ef554e2888d791353f3ece53ce
Instruction ID: 48bb1da2c74c8d2812f5c34bef7cbd78dc4073a8142469eba11b3aac63512bd6
Opcode Fuzzy Hash: bee7669f7dea7091e3b2f9a38d437239e7b7a0ef554e2888d791353f3ece53ce
Instruction Fuzzy Hash: D09111B15083819FC358CF65C98A95BFBF1FBC5758F008A1DF5968A260D3B58A49CB82

Function 1001604B Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a510fda98223d10257bcb803cfd692c3c2debb1c13b50d92633ddf5ea6a8b6c
Instruction ID: 6b290a1f31ac2aa0e4ce790392c06206769418007f342d4a6c1511aa16cb173c
Opcode Fuzzy Hash: 7a510fda98223d10257bcb803cfd692c3c2debb1c13b50d92633ddf5ea6a8b6c
Instruction Fuzzy Hash: 7A7162725093419FD348CE25D98541FBBE1FBC8748F005A1DF69AAA260D7B4CA49CB53

Function 100186EE Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 76a1d633259e6425bbfde50e2ef722b9fb6e092e7419154cb287dfc7aa8c04d0
Instruction ID: 881840bf1d00eefb94fa32f8fe24be30a9665a2762c66187f7fb75114483e09a
Opcode Fuzzy Hash: 76a1d633259e6425bbfde50e2ef722b9fb6e092e7419154cb287dfc7aa8c04d0
Instruction Fuzzy Hash: 775179B250C3409FC798CE21D88942FBBE0FB84798F504A1DF99AA6250D774DA49CF87

Function 10021FC7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c61fdc0ac5cca11b49d2a104ae38f70e177914beaf73ce245e2f8eea679fed6
Instruction ID: a78208f61c8311b5c6a605ada647cf8b7d903180f010fd9ab786229a57083075
Opcode Fuzzy Hash: 0c61fdc0ac5cca11b49d2a104ae38f70e177914beaf73ce245e2f8eea679fed6
Instruction Fuzzy Hash: 6E617471509301AFD388CF25D58A40BBBF1EBC8758F50991DF499A6260D3B0DA49CF87

Function 10017B9E Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ea0b58b7ce2fc6767d65ef364a369dc025e088d061202e099b0601af30ddc4b7
Instruction ID: 89149b1edfb1503e2a720db03ce8bd1c71790577fc8018d956c4ea62a2dd3d65
Opcode Fuzzy Hash: ea0b58b7ce2fc6767d65ef364a369dc025e088d061202e099b0601af30ddc4b7
Instruction Fuzzy Hash: 985114B1D00219EBDF14CFE6D9468EEBBB2FF88314F20815AE511B6260D7B59A51CF90

Function 1001A683 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085fa649f1bf50db60e967f6246070b1a1cc04d7c49565a1decda229ba8295b7
Instruction ID: df1bbbfad493a06ed738c44e510a26fd49316a8c6364c0a9daf49013a3afa941
Opcode Fuzzy Hash: 085fa649f1bf50db60e967f6246070b1a1cc04d7c49565a1decda229ba8295b7
Instruction Fuzzy Hash: 625187715083418BC748CF25D94582FFBE2FFD9748F004A1EF589AA2A1C775CA888B97

Function 100166C8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08be4f400afe8638c854dd42a0da104b59195b135d46cfbe8a384d3e629d9a2e
Instruction ID: 31f8ad8689140ec2cd41670962a6780cdd02cc7c4ccd9297dd0f79dbf170bc91
Opcode Fuzzy Hash: 08be4f400afe8638c854dd42a0da104b59195b135d46cfbe8a384d3e629d9a2e
Instruction Fuzzy Hash: A0415AB1A083018FC714CF19C98581BBBF1FBC8758F014A2DF985A7211D771EA59CB86

Function 1000E4F5 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d75d1772c7219b20785abb7a195f1a2e2e441af678795809dd8cd4dcf7f945f3
Instruction ID: 20668c357db5dbc051cc17fa721243281cc9f90233a10cf4a93b051b1a28d49d
Opcode Fuzzy Hash: d75d1772c7219b20785abb7a195f1a2e2e441af678795809dd8cd4dcf7f945f3
Instruction Fuzzy Hash: 4E418C72A093518FD314CF28C48544BFBE1FF98358F014A2DE9C9A7251D774EA49CB92

Function 1001F5D9 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a078ab523a5daffc0b0976a2c64f30202ec81ba3f21039fdb029f83dbc7004
Instruction ID: dc23ce73b9b9f602255d6d2230a7f652b5b5074c8eecde653bbeb20d4d613a44
Opcode Fuzzy Hash: 69a078ab523a5daffc0b0976a2c64f30202ec81ba3f21039fdb029f83dbc7004
Instruction Fuzzy Hash: 604199726083109FC354CF29C88546BFBE0FF88318F414A2DF98AA7250D775EA49CB86

Function 10018EF8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e57496d2c4da7939a623119ac7073f5259244425f4165802adbd11dc9958119
Instruction ID: 8fb414e6dcb22846a577ad4547a530b8f6bd8bb4613af401ca5bac371c8748a5
Opcode Fuzzy Hash: 4e57496d2c4da7939a623119ac7073f5259244425f4165802adbd11dc9958119
Instruction Fuzzy Hash: 3F4155726183009FD358CF2AC88584BBBE6EBC8358F408A2DF99997250D7B6D9458F42

Function 10019054 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd6b85d14858a20a4312930a7159a801d78a2fb2e3c1ccbf8bb7f41841aedae
Instruction ID: 4f88acb775b8067980cd5ece45ecebd0a7b592b62766faf2ea7e9d1879352c6a
Opcode Fuzzy Hash: bfd6b85d14858a20a4312930a7159a801d78a2fb2e3c1ccbf8bb7f41841aedae
Instruction Fuzzy Hash: C241EEB6C01209EBCF19CFE6C94A9EEBBB0FB48344F208159D421B6260D3B55B55DFA1

Function 100117D2 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041cf32466fb9e9b6543021d9aa768da6172e6cdea6da53cb281fa82c51a11e2
Instruction ID: a0e3cb91599f4b8ecb10dde277323d7d22c9379355dc7e4644ec24634e9710a2
Opcode Fuzzy Hash: 041cf32466fb9e9b6543021d9aa768da6172e6cdea6da53cb281fa82c51a11e2
Instruction Fuzzy Hash: 4231BCB1C0120EEBDF08CFE5DA4A5EEBBB4BB14344F208199D511BA264D7B05B48DFA1

Function 1000806B Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdc00781864607f5becd072fc887cab80e09326d7b9d7a31d15e5c76ac6b8b67
Instruction ID: 05b5d74ee12a3209803b1ae2f6a3b0fbbc0b40bcba2af016df34f59342d34899
Opcode Fuzzy Hash: bdc00781864607f5becd072fc887cab80e09326d7b9d7a31d15e5c76ac6b8b67
Instruction Fuzzy Hash: 92312072D0020AEBDB58CFE5DA8A4AEBBB1FF40354F2084A8D565B7210D3B16B05DF80

Function 100032AC Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349177992.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1349162111.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.1349204749.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 6D62B5BE Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 45registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(Native), ref: 6D62B5CF
RegisterClipboardFormatA.USER32(OwnerLink), ref: 6D62B5D8
RegisterClipboardFormatA.USER32(ObjectLink), ref: 6D62B5E2
RegisterClipboardFormatA.USER32(Embedded Object), ref: 6D62B5EC
RegisterClipboardFormatA.USER32(Embed Source), ref: 6D62B5F6
RegisterClipboardFormatA.USER32(Link Source), ref: 6D62B600
RegisterClipboardFormatA.USER32(Object Descriptor), ref: 6D62B60A
RegisterClipboardFormatA.USER32(Link Source Descriptor), ref: 6D62B614
RegisterClipboardFormatA.USER32(FileName), ref: 6D62B61E
RegisterClipboardFormatA.USER32(FileNameW), ref: 6D62B628
RegisterClipboardFormatA.USER32(Rich Text Format), ref: 6D62B632
RegisterClipboardFormatA.USER32(RichEdit Text and Objects), ref: 6D62B63C

Strings

Embedded Object, xrefs: 6D62B5E4
ObjectLink, xrefs: 6D62B5DA
Object Descriptor, xrefs: 6D62B602
FileName, xrefs: 6D62B616
RichEdit Text and Objects, xrefs: 6D62B634
Rich Text Format, xrefs: 6D62B62A
FileNameW, xrefs: 6D62B620
Link Source, xrefs: 6D62B5F8
Embed Source, xrefs: 6D62B5EE
Link Source Descriptor, xrefs: 6D62B60C
OwnerLink, xrefs: 6D62B5D1
Native, xrefs: 6D62B5C8

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
API String ID: 1228543026-2889995556
Opcode ID: 37e319a3c42809fd683adb3accb25652b677994d84977a5487a99b74ed6b07b0
Instruction ID: 4c302e67fb3a1eaa8b040d8e3adcfcb91d215e239c66b8ce0f54cac013e89263
Opcode Fuzzy Hash: 37e319a3c42809fd683adb3accb25652b677994d84977a5487a99b74ed6b07b0
Instruction Fuzzy Hash: D0014AB1D007697ACB70AF769D0885ABEA0FEC9264350C92BF41887A06FB34E450CFC4

Function 6D6055A0 Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 416fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000007,00000000,00000003,02000000,00000000,73341224), ref: 6D605602
ReadDirectoryChangesW.KERNEL32(00000000,?,00000228,00000001,0000017F,?,00000000,00000000), ref: 6D605635
_memset.LIBCMT ref: 6D605658
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000063,00000000,00000000), ref: 6D605684
_memset.LIBCMT ref: 6D6056C4
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000063,00000000,00000000), ref: 6D6056E8
__localtime64_s.LIBCMT ref: 6D605770
__localtime64_s.LIBCMT ref: 6D60578F
__localtime64_s.LIBCMT ref: 6D6057B1
__time64.LIBCMT ref: 6D60585D
__localtime64_s.LIBCMT ref: 6D6058CB
__localtime64_s.LIBCMT ref: 6D6058EA
__localtime64_s.LIBCMT ref: 6D6058A9

Part of subcall function 6D62DFF3: _memset.LIBCMT ref: 6D62E036

__time64.LIBCMT ref: 6D605727

Part of subcall function 6D62E2AB: GetSystemTimeAsFileTime.KERNEL32(?), ref: 6D62E2B6
Part of subcall function 6D62E2AB: __aulldiv.LIBCMT ref: 6D62E2D6

ReadDirectoryChangesW.KERNEL32(?,?,00000228,00000001,0000017F,?,00000000,00000000), ref: 6D605E9F

Strings

%d:%d:%d, xrefs: 6D6057D0, 6D605906, 6D605DDF

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __localtime64_s$_memset$ByteChangesCharDirectoryFileMultiReadTimeWide__time64$CreateSystem__aulldiv
String ID: %d:%d:%d
API String ID: 3191029907-941173414
Opcode ID: 009656ca01e7980b431fd0e0ee036d3ec4375c389551d7eacc8370db894ac8d7
Instruction ID: c00d824d5313bc8123bf44c58f3c25788a6038a9605f5d7ebf846d0f54107d5c
Opcode Fuzzy Hash: 009656ca01e7980b431fd0e0ee036d3ec4375c389551d7eacc8370db894ac8d7
Instruction Fuzzy Hash: EBE1C471248341ABE324DB64CD41FEB73E8AFC8714F104A2DF6599B1D1EB71A504CB96

Function 6D60BB17 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D60BB21

Part of subcall function 6D61FF53: __EH_prolog3.LIBCMT ref: 6D61FF5A

CallNextHookEx.USER32(?,?,?,?), ref: 6D60BB65

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

GetClassLongA.USER32(?,000000E6), ref: 6D60BBA9
GlobalGetAtomNameA.KERNEL32 ref: 6D60BBD3
SetWindowLongA.USER32(?,000000FC,Function_0001A84D), ref: 6D60BC28
_memset.LIBCMT ref: 6D60BC72
GetClassLongA.USER32(?,000000E0), ref: 6D60BCA2
GetClassNameA.USER32(?,?,00000100), ref: 6D60BCC3
GetWindowLongA.USER32(?,000000FC), ref: 6D60BCE7
GetPropA.USER32(?,AfxOldWndProc423), ref: 6D60BD01
SetPropA.USER32(?,AfxOldWndProc423,?), ref: 6D60BD0C
GetPropA.USER32(?,AfxOldWndProc423), ref: 6D60BD14
GlobalAddAtomA.KERNEL32(AfxOldWndProc423), ref: 6D60BD1C
SetWindowLongA.USER32(?,000000FC,Function_0001B9CA), ref: 6D60BD2A
CallNextHookEx.USER32(?,00000003,?,?), ref: 6D60BD42
UnhookWindowsHookEx.USER32(?), ref: 6D60BD56

Strings

ime, xrefs: 6D60BBDC
#32768, xrefs: 6D60BC84, 6D60BC89, 6D60BCD3
AfxOldWndProc423, xrefs: 6D60BCFA, 6D60BCFF, 6D60BD0A, 6D60BD12, 6D60BD1B

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Long$ClassHookPropWindow$AtomCallGlobalH_prolog3NameNext$Exception@8H_prolog3_ThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423$ime
API String ID: 1191297049-4034971020
Opcode ID: c2fea34e30f851c807a6dc30f4aad405585b220477c62aa6625747aad6e04468
Instruction ID: 365cf3bf1edc0348ea5f7b7f3de2b6f377c4f08f83caa5686025a2783cc9c0ac
Opcode Fuzzy Hash: c2fea34e30f851c807a6dc30f4aad405585b220477c62aa6625747aad6e04468
Instruction Fuzzy Hash: 6961D03150422AABCF19AF69CE08BEE7B78AF0D764F008554F509A72D1DB34D984CBE5

Function 6D6179A3 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 158libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D6179AD
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6D617C74,?,?), ref: 6D6179DD
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6D6179F1
ConvertDefaultLocale.KERNEL32(?), ref: 6D617A2D
ConvertDefaultLocale.KERNEL32(?), ref: 6D617A3B
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6D617A58
ConvertDefaultLocale.KERNEL32(?), ref: 6D617A83
ConvertDefaultLocale.KERNEL32(000003FF), ref: 6D617A8C
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 6D617AA5
EnumResourceLanguagesA.KERNEL32(00000000,00000010,00000001,Function_000272C5,?), ref: 6D617AC2
ConvertDefaultLocale.KERNEL32(?), ref: 6D617AF5
ConvertDefaultLocale.KERNEL32(00000000), ref: 6D617AFE
GetModuleFileNameA.KERNEL32(6D5F0000,?,00000105), ref: 6D617B41
_memset.LIBCMT ref: 6D617B61

Strings

GetUserDefaultUILanguage, xrefs: 6D6179E5
GetSystemDefaultUILanguage, xrefs: 6D617A3D
ntdll.dll, xrefs: 6D617AA0
kernel32.dll, xrefs: 6D6179C6

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 3537336938-2299501126
Opcode ID: 62b15bf4ab8e8a0de5b88834e8a8462cbdfdc78e0e30a4c3280b6762d784065f
Instruction ID: b876e2c9e4ae634228a6198e2de3612c8752b72a4031511fa98061f5d251ac56
Opcode Fuzzy Hash: 62b15bf4ab8e8a0de5b88834e8a8462cbdfdc78e0e30a4c3280b6762d784065f
Instruction Fuzzy Hash: DB511B71D042289BCB65DF69CC44BEEBAB4AB5D304F0181EAE54DE3280DB749E85CF94

Function 6D606AC8 Relevance: 28.9, APIs: 19, Instructions: 420stringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D606ACF
_memset.LIBCMT ref: 6D606AF7
lstrlenA.KERNEL32(?,?,?,6D648700,00000000,6D646930,00000000), ref: 6D606B07
_memset.LIBCMT ref: 6D606B71
_memset.LIBCMT ref: 6D606D87
VariantClear.OLEAUT32(?), ref: 6D606DE6
VariantClear.OLEAUT32(?), ref: 6D606E0E
SysStringLen.OLEAUT32(?), ref: 6D606E68
SysFreeString.OLEAUT32(?), ref: 6D606E88
SysStringLen.OLEAUT32(?), ref: 6D606E8D
SysFreeString.OLEAUT32(?), ref: 6D606EA1
SysStringLen.OLEAUT32(?), ref: 6D606EA6
SysFreeString.OLEAUT32(?), ref: 6D606EBA
__CxxThrowException@8.LIBCMT ref: 6D606ED4
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 6D606EF2
VariantClear.OLEAUT32(?), ref: 6D606F02

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: String$Variant$ClearFree_memset$ChangeException@8H_prolog3ThrowTypelstrlen
String ID:
API String ID: 4128688680-0
Opcode ID: ab06775256c2da9a6e78724f59801bf509364eafc2a0356e36154aa27236bd8e
Instruction ID: 448749a7f1cfa563a69f63be8a940decc8cd6c9420736fbe08f2e759ac81ded9
Opcode Fuzzy Hash: ab06775256c2da9a6e78724f59801bf509364eafc2a0356e36154aa27236bd8e
Instruction Fuzzy Hash: 11F19E7190424ADFDF09CFE8CA90AEEBBB5FF09304F108069E955AB290D7749995CF90

Function 6D600700 Relevance: 28.5, APIs: 14, Strings: 2, Instructions: 492windowthreadCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001036,00000000,00000001), ref: 6D6009B6
SendMessageA.USER32(?,00001200,00000000,00000000), ref: 6D6009CC
SendMessageA.USER32(?,0000101C,00000000,00000000), ref: 6D6009E6
SendMessageA.USER32(?,00001009,00000000,00000000), ref: 6D6009FF

Part of subcall function 6D610EBA: __EH_prolog3.LIBCMT ref: 6D610EC1

Part of subcall function 6D6110EB: __EH_prolog3.LIBCMT ref: 6D6110F2
Part of subcall function 6D6110EB: __CxxThrowException@8.LIBCMT ref: 6D611128

Part of subcall function 6D610E7C: __EH_prolog3.LIBCMT ref: 6D610E83

Part of subcall function 6D60DA80: ShowWindow.USER32(?,?,?,6D6120A5,00000000,0000E146,00000000,?,?,6D5FD30A,73341224), ref: 6D60DA91

IsWindowVisible.USER32(?), ref: 6D600AE4
SendMessageA.USER32(?,0000110A,00000000,00000000), ref: 6D600B10
SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 6D600B21
CreateThread.KERNEL32(00000000,00000000,6D600150,00000000,00000000,00000000), ref: 6D600B37
SetThreadPriority.KERNEL32(?,00000001), ref: 6D600C45
CreateThread.KERNEL32(00000000,00000000,6D5FF460,00000000,00000000,00000000), ref: 6D600C56
SetThreadPriority.KERNEL32(00000000,00000000), ref: 6D600C61

Strings

Setting\ScanSet.dat, xrefs: 6D600737
Searching, xrefs: 6D600CA2

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$Thread$H_prolog3$CreatePriorityWindow$Exception@8ShowThrowVisible
String ID: Searching$Setting\ScanSet.dat
API String ID: 612925004-365256678
Opcode ID: fd7a17f152f7230ebc24fd00b45f408afb7cdaf821e3030f5296fe00b124b78d
Instruction ID: 3280047647ac267b7a6654c1ead8ba601fa9187321c2a7a43a303ce9c1d917a8
Opcode Fuzzy Hash: fd7a17f152f7230ebc24fd00b45f408afb7cdaf821e3030f5296fe00b124b78d
Instruction Fuzzy Hash: D302C770248701ABE318CF69CD51FABB7E5AF88754F108A1CF29A9B2D0DBB1B405CB55

Function 6D61DD13 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00003020), ref: 6D61DD31
GetDlgItem.USER32(?,00003020), ref: 6D61DD64
GetWindowRect.USER32(00000000,?), ref: 6D61DD72
MapDialogRect.USER32(?,?), ref: 6D61DD96
SetWindowPos.USER32(?,00000000,00000000,00000000,?,00000020,00000016), ref: 6D61DDC3
GetDlgItem.USER32(00000020,?), ref: 6D61DDD8
GetWindowRect.USER32(00000000,?), ref: 6D61DDEA
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015), ref: 6D61DE09
GetWindowRect.USER32(00000020,?), ref: 6D61DE20
GetWindowRect.USER32(?,?), ref: 6D61DE61
GetDlgItem.USER32(?,00000001), ref: 6D61DE68
GetWindowRect.USER32(00000000,?), ref: 6D61DE77
GetDlgItem.USER32(?,?), ref: 6D61DEA2
ShowWindow.USER32(00000000,00000000), ref: 6D61DEB0
EnableWindow.USER32(00000000,00000000), ref: 6D61DEB8

Strings

, xrefs: 6D61DD8F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Rect$Item$DialogEnableShow
String ID:
API String ID: 763981185-3916222277
Opcode ID: edcbe99edacf9d58334bed3fae1b71997633fb0d7f7742d464f46f53d7f8e097
Instruction ID: 13f9509dae37b36c7f33efd05883de55974a2277a385adfcf2ba2c1c042298c1
Opcode Fuzzy Hash: edcbe99edacf9d58334bed3fae1b71997633fb0d7f7742d464f46f53d7f8e097
Instruction Fuzzy Hash: DC512572900609AFDF15DBEACD88EEFBBB9FF89700F108419E116A2150DB75A940DF64

Function 6D6077A0 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,77074A40,6D6078F5,?,?,?,?,?,?,?,6D609B38,00000000,00000002,00000028), ref: 6D6077CB
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 6D6077E7
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6D6077F8
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 6D607809
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 6D60781A
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 6D60782B
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 6D60783C
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 6D60784D

Strings

GetSystemMetrics, xrefs: 6D6077E1
MonitorFromRect, xrefs: 6D607803
MonitorFromPoint, xrefs: 6D607814
MonitorFromWindow, xrefs: 6D6077F2
EnumDisplayMonitors, xrefs: 6D607825
USER32, xrefs: 6D6077C1
GetMonitorInfoA, xrefs: 6D607836
EnumDisplayDevicesA, xrefs: 6D607847

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: 3de6d411288dd94b75cf1a212cff60ce45cc7d70ddb03547483f8aa0b92d4c92
Instruction ID: 4b0c08ac6adc5d404ab51bc4062de8e2c46fea79660b0827124959c61eb12453
Opcode Fuzzy Hash: 3de6d411288dd94b75cf1a212cff60ce45cc7d70ddb03547483f8aa0b92d4c92
Instruction Fuzzy Hash: 4821D872E20262EBDB05EF778DC8A3A7BF4A68E215310843FE116D3A41D77650C29F52

Function 6D62A7A6 Relevance: 26.0, APIs: 17, Instructions: 453windowkeyboardCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 6D62A7FB
IsWindowEnabled.USER32(?), ref: 6D62A857
__EH_prolog3_catch.LIBCMT ref: 6D62A8A5
GetFocus.USER32 ref: 6D62A8C5
GetParent.USER32(?), ref: 6D62A910
GetParent.USER32(?), ref: 6D62A920
GetKeyState.USER32(00000012), ref: 6D62A9DE
IsDialogMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D62AA93
GetFocus.USER32 ref: 6D62AAA6
GetFocus.USER32 ref: 6D62AAB3
IsWindow.USER32(?), ref: 6D62AACB
GetFocus.USER32 ref: 6D62AAD7
IsWindow.USER32(?), ref: 6D62AAED
GetFocus.USER32 ref: 6D62AAF3
GetKeyState.USER32(00000010), ref: 6D62AB1C
MessageBeep.USER32(00000000), ref: 6D62AC13

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Focus$Window$MessageParentState$BeepDialogEnabledH_prolog3_catch
String ID:
API String ID: 656273425-0
Opcode ID: 01e2cd39602b410050255585ba96c12069804b739d1d5e0e70a785cc6d19aa54
Instruction ID: 80f309bcd15faca7a0145b9ac4a84b96c954539e77f655fb86fd69e728154833
Opcode Fuzzy Hash: 01e2cd39602b410050255585ba96c12069804b739d1d5e0e70a785cc6d19aa54
Instruction Fuzzy Hash: FBF1C031D04206AFDF119FA5CA44FBE7BB5AF4D394F128029E919A7160DBB4D881CF91

Function 6D609A48 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D60D952: GetWindowLongA.USER32(?,000000F0), ref: 6D60D95D

GetParent.USER32(?), ref: 6D609A77
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 6D609A9A
GetWindowRect.USER32(?,?), ref: 6D609AB4
GetWindowLongA.USER32(00000000,000000F0), ref: 6D609ACA
CopyRect.USER32(?,?), ref: 6D609B17
CopyRect.USER32(?,?), ref: 6D609B21
GetWindowRect.USER32(00000000,?), ref: 6D609B2A
CopyRect.USER32(?,?), ref: 6D609B46

Strings

(, xrefs: 6D609AE0

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: 2d3ffdad832e6fc5d721ea6ed7342779c904338bd3a7232f9fc0a8a952ed2918
Instruction ID: c6dcd6e9d76ef3d63b4b96acfe7e9ee085e86163139e88b55b180cc1ae9fad75
Opcode Fuzzy Hash: 2d3ffdad832e6fc5d721ea6ed7342779c904338bd3a7232f9fc0a8a952ed2918
Instruction Fuzzy Hash: D4515F72904219ABDB08DBA8CD84FEEBBBAAF49314F094115E915E3144D730E941CB50

Function 6D603CC0 Relevance: 24.4, APIs: 16, Instructions: 364windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D603CF3
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D603D09
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D603D1F
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D603D35
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D603D4B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D603D5F

Part of subcall function 6D6110EB: __EH_prolog3.LIBCMT ref: 6D6110F2
Part of subcall function 6D6110EB: __CxxThrowException@8.LIBCMT ref: 6D611128

SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D603EDD
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D603F24
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D603F6B

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$Exception@8H_prolog3Throw
String ID:
API String ID: 2952110909-0
Opcode ID: fa009338a175cbf7a78981e07447c8d61b3014927d9c46779395c0e0e01242f5
Instruction ID: acdc34a6e96a49a72c827168ab4526cf3bfb29f5d55b3ea4d10bd6c531febc26
Opcode Fuzzy Hash: fa009338a175cbf7a78981e07447c8d61b3014927d9c46779395c0e0e01242f5
Instruction Fuzzy Hash: FDD16070744B02ABE728CF69CD91F66B3E5AF4C715F104A1CE28A9B6D0CB74F8458B58

Function 6D6280B2 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 129registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_LBSelChangedNotify), ref: 6D628118
RegisterClipboardFormatA.USER32(commdlg_ShareViolation), ref: 6D628124
RegisterClipboardFormatA.USER32(commdlg_FileNameOK), ref: 6D628130
RegisterClipboardFormatA.USER32(commdlg_ColorOK), ref: 6D62813C
RegisterClipboardFormatA.USER32(commdlg_help), ref: 6D628148
RegisterClipboardFormatA.USER32(commdlg_SetRGBColor), ref: 6D628154

Strings

commdlg_ColorOK, xrefs: 6D628132
commdlg_ShareViolation, xrefs: 6D62811A
commdlg_FileNameOK, xrefs: 6D628126
commdlg_SetRGBColor, xrefs: 6D62814A
commdlg_LBSelChangedNotify, xrefs: 6D628113
commdlg_help, xrefs: 6D62813E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: commdlg_ColorOK$commdlg_FileNameOK$commdlg_LBSelChangedNotify$commdlg_SetRGBColor$commdlg_ShareViolation$commdlg_help
API String ID: 1228543026-3888057576
Opcode ID: 2a4f4a8f1701ae5b8c6c88d92c3407e64fdecdf11dd2c696292ae8b4cc6614c3
Instruction ID: ba213edc4320d914a82d82988b3d7f966ee06384d5eb4e083c960f11980d4a88
Opcode Fuzzy Hash: 2a4f4a8f1701ae5b8c6c88d92c3407e64fdecdf11dd2c696292ae8b4cc6614c3
Instruction Fuzzy Hash: 2C41D0309086069FCF25DF26CD88EAE3BB1EB8E394F118825E94597660D7359881CFE5

Function 6D603570 Relevance: 22.8, APIs: 15, Instructions: 323windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D6035A3
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D6035B9
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D6035CF
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D6035E5
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D60381B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D6035F9

Part of subcall function 6D6110EB: __EH_prolog3.LIBCMT ref: 6D6110F2
Part of subcall function 6D6110EB: __CxxThrowException@8.LIBCMT ref: 6D611128

SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D603746
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D60378D
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D6037D4
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D603862
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D603874
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6038C1
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6038D3
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6038E5
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6038F7

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$Exception@8H_prolog3Throw
String ID:
API String ID: 2952110909-0
Opcode ID: 68046a9d0e4f9e4f08e7f064547e8988247b0629263629ad4eb3581d595bb9fd
Instruction ID: edce1745e255c276aca74388de1e4ef66f5c7b7b2e7404a1d2c68b2593a26bca
Opcode Fuzzy Hash: 68046a9d0e4f9e4f08e7f064547e8988247b0629263629ad4eb3581d595bb9fd
Instruction Fuzzy Hash: FCB15F74784B02AFE728CB65CD92FA6B3E5AB4C715F10461CE24A9B6C0CF74F8458B58

Function 6D63434F Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6D6587C8,0000000C,6D63448A,00000000,00000000,?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C), ref: 6D634361
__crt_waiting_on_module_handle.LIBCMT ref: 6D63436C

Part of subcall function 6D632367: Sleep.KERNEL32(000003E8,00000000,?,6D634275,KERNEL32.DLL,?,?,6D634646,00000000,?,6D62E427,00000000,?,?,?,6D62E48A), ref: 6D632373
Part of subcall function 6D632367: GetModuleHandleW.KERNEL32(00000000,?,6D634275,KERNEL32.DLL,?,?,6D634646,00000000,?,6D62E427,00000000,?,?,?,6D62E48A,?), ref: 6D63237C

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6D634395
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 6D6343A5
__lock.LIBCMT ref: 6D6343C7
InterlockedIncrement.KERNEL32(?), ref: 6D6343D4
__lock.LIBCMT ref: 6D6343E8
___addlocaleref.LIBCMT ref: 6D634406

Strings

`dm, xrefs: 6D634378
EncodePointer, xrefs: 6D634389
KERNEL32.DLL, xrefs: 6D63435B, 6D634360, 6D63436B
DecodePointer, xrefs: 6D63439D
Lw, xrefs: 6D6343D4

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL$`dm$Lw
API String ID: 1028249917-1225377582
Opcode ID: 1a4121b09179cdb8596b41bc59b5deb09e54c6f69b5aad3bbdb44c989c1c855a
Instruction ID: ac5949cc6ac61621a52eaf233539c4213de6d625688b407ad3d8b9f6500d7af0
Opcode Fuzzy Hash: 1a4121b09179cdb8596b41bc59b5deb09e54c6f69b5aad3bbdb44c989c1c855a
Instruction Fuzzy Hash: 30119070804711ABE720DF79C840B9AFBF0EF4C314F119519E599D3292CB75A541CF59

Function 6D604F40 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 184windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6D604F97
LoadBitmapA.USER32(?), ref: 6D604FCE
SelectObject.GDI32(?,?), ref: 6D604FEC
GetObjectA.GDI32(?,00000018,?), ref: 6D604FFE
GetSystemMetrics.USER32(00000000), ref: 6D60500B
GetSystemMetrics.USER32(00000001), ref: 6D605015
BitBlt.GDI32(?,0000003C,00000014,?,?,?,?,?,00CC0020), ref: 6D6050AB

Strings

gfff, xrefs: 6D605019
gfff, xrefs: 6D605035

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MetricsObjectSystem$BitmapCompatibleCreateLoadSelect
String ID: gfff$gfff
API String ID: 2961984297-3084402119
Opcode ID: fa259526341a3f8cb92eed00863e6a4874bc4b25f2b40c60e30376186cf4b39e
Instruction ID: be7c55b28ea0f0c5c9a3b679657e7324b4dac9ebd5d653d83f8061c4a4efa9d5
Opcode Fuzzy Hash: fa259526341a3f8cb92eed00863e6a4874bc4b25f2b40c60e30376186cf4b39e
Instruction Fuzzy Hash: 5C6137B52087459FC324DF5ACA84A2BB7F8FB99704F008A1DF58687650D770F944CBA2

Function 6D6050C9 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 162windowsleepCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6D604F97
LoadBitmapA.USER32(?), ref: 6D604FCE
SelectObject.GDI32(?,?), ref: 6D604FEC
GetObjectA.GDI32(?,00000018,?), ref: 6D604FFE
GetSystemMetrics.USER32(00000000), ref: 6D60500B
GetSystemMetrics.USER32(00000001), ref: 6D605015
BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 6D6050FB
Sleep.KERNEL32(00000BB8), ref: 6D605121
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00000042), ref: 6D605143

Strings

gfff, xrefs: 6D605019
gfff, xrefs: 6D605035

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MetricsObjectSystem$BitmapCompatibleCreateLoadSelectSleep
String ID: gfff$gfff
API String ID: 1121727421-3084402119
Opcode ID: 12b7079bd3b743211fcc97ef7db660a5426cf557c1bbf456d35d66079654024b
Instruction ID: 13464139754435ba0fb596c69629e013e6fc53f517cd53d44a2a94fb449696fa
Opcode Fuzzy Hash: 12b7079bd3b743211fcc97ef7db660a5426cf557c1bbf456d35d66079654024b
Instruction Fuzzy Hash: C15127B52087459FC328DF56C984A2BB7F8FB99704F008A1DF58A83651D770F945CBA2

Function 6D615EDA Relevance: 21.1, APIs: 14, Instructions: 99synchronizationthreadinjectionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D615EFA
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6D615F18
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 6D615F22
CloseHandle.KERNEL32(?), ref: 6D615F70
CloseHandle.KERNEL32(?), ref: 6D615F75

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

ResumeThread.KERNEL32(00000000), ref: 6D615F7A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6D615F85
CloseHandle.KERNEL32(?), ref: 6D615F94
SuspendThread.KERNEL32(?), ref: 6D615F9F
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6D615FAF
CloseHandle.KERNEL32(?), ref: 6D615FB8
SetEvent.KERNEL32(00000004), ref: 6D615FC2
CloseHandle.KERNEL32(?), ref: 6D615FDA

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CloseHandle$Event$CreateObjectSingleThreadWait$Exception@8H_prolog3ResumeSuspendThrow_memset
String ID:
API String ID: 2577798173-0
Opcode ID: c02b9037254b496cca12d1b59f258125ea39dc5eeb59552bc1f30ad82c761240
Instruction ID: 56072f52447e37d032e5294d9c8c87200746689a97c295e548cbe1022809d972
Opcode Fuzzy Hash: c02b9037254b496cca12d1b59f258125ea39dc5eeb59552bc1f30ad82c761240
Instruction Fuzzy Hash: 82316C72C08209BFDF01AFE9CC849AEFFB9EF49314B108529E615A2550D73199818F90

Function 6D5FC7B0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 189threadinjectionCOMMON

Download Yara Rule

APIs

GetExitCodeThread.KERNEL32(?,73341224,73341224), ref: 6D5FC7F1
SuspendThread.KERNEL32(?), ref: 6D5FC871
SuspendThread.KERNEL32(?), ref: 6D5FC87E
ResumeThread.KERNEL32(?), ref: 6D5FC8A0
ResumeThread.KERNEL32(?), ref: 6D5FC8A9

Part of subcall function 6D60D9DE: IsWindow.USER32(?), ref: 6D60D9F2

GetExitCodeThread.KERNEL32(?,?), ref: 6D5FC909
SuspendThread.KERNEL32(?), ref: 6D5FC98D
SuspendThread.KERNEL32(?), ref: 6D5FC996
ResumeThread.KERNEL32(?), ref: 6D5FC9B4
ResumeThread.KERNEL32(?), ref: 6D5FC9BD

Strings

Searching, xrefs: 6D5FC8B7, 6D5FC9CB

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Thread$ResumeSuspend$CodeExit$Window
String ID: Searching
API String ID: 1881788215-291028053
Opcode ID: 868ab3f29b96bf9ef566cf0b0dbdc299663f81c29a71bd9f68f2e5c4fd3ab7d1
Instruction ID: 70aba36159b07449eb2e6be9051e7d439415baf0cd53ba7c93d18c8064c80312
Opcode Fuzzy Hash: 868ab3f29b96bf9ef566cf0b0dbdc299663f81c29a71bd9f68f2e5c4fd3ab7d1
Instruction Fuzzy Hash: 316171712047029BC708DB64C890ABBB3E5EF89354F018A1DF16A9B691DB34E906CF95

Function 6D605077 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 141windowsleepCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6D604F97
LoadBitmapA.USER32(?), ref: 6D604FCE
SelectObject.GDI32(?,?), ref: 6D604FEC
GetObjectA.GDI32(?,00000018,?), ref: 6D604FFE
GetSystemMetrics.USER32(00000000), ref: 6D60500B
GetSystemMetrics.USER32(00000001), ref: 6D605015
BitBlt.GDI32(?,0000003C,00000014,?,?,?,?,?,00CC0020), ref: 6D6050AB
Sleep.KERNEL32(00000BB8), ref: 6D605121
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00000042), ref: 6D605143

Strings

gfff, xrefs: 6D605019
gfff, xrefs: 6D605035

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MetricsObjectSystem$BitmapCompatibleCreateLoadSelectSleep
String ID: gfff$gfff
API String ID: 1121727421-3084402119
Opcode ID: ff5c00bd877d6c1a3b1e8b8df0d365e7103d546b4b02d1bf6797a440cb9c1ae0
Instruction ID: 9d0fbcdbbc1968c9e7a7b9aab609a9cb92943a7d6523ba3a49abbafa23e10285
Opcode Fuzzy Hash: ff5c00bd877d6c1a3b1e8b8df0d365e7103d546b4b02d1bf6797a440cb9c1ae0
Instruction Fuzzy Hash: 435149B16087459FC328DF5ACA84A6BB7F8FB9D304F008A1DF58686251D7B0F945CB92

Function 6D605079 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 141windowsleepCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6D604F97
LoadBitmapA.USER32(?), ref: 6D604FCE
SelectObject.GDI32(?,?), ref: 6D604FEC
GetObjectA.GDI32(?,00000018,?), ref: 6D604FFE
GetSystemMetrics.USER32(00000000), ref: 6D60500B
GetSystemMetrics.USER32(00000001), ref: 6D605015
BitBlt.GDI32(?,0000003C,00000014,?,?,?,?,?,00CC0020), ref: 6D6050AB
Sleep.KERNEL32(00000BB8), ref: 6D605121
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00000042), ref: 6D605143

Strings

gfff, xrefs: 6D605019
gfff, xrefs: 6D605035

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MetricsObjectSystem$BitmapCompatibleCreateLoadSelectSleep
String ID: gfff$gfff
API String ID: 1121727421-3084402119
Opcode ID: 0429d80fa7b455a6a7bd943d7d067eae16dcb529e1c8713ab5d5c6ac77d9acf2
Instruction ID: e3e8c9b6c244e370c3f178a75e944c34c232fdaba5e1a66109485d6ba8b0e685
Opcode Fuzzy Hash: 0429d80fa7b455a6a7bd943d7d067eae16dcb529e1c8713ab5d5c6ac77d9acf2
Instruction Fuzzy Hash: 7D5138B16087459FC328DF5AC984A6BB7F8FB99304F008A1DF58A87251D770F944CB92

Function 6D61417F Relevance: 18.3, APIs: 12, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D614186
PathRemoveFileSpecW.SHLWAPI(00000000,?), ref: 6D6141E7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000,000000FF), ref: 6D614221
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 6D614244
_strlen.LIBCMT ref: 6D614259
CoTaskMemFree.OLE32(?), ref: 6D614269
PathRemoveFileSpecW.SHLWAPI(?), ref: 6D61432C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 6D614344
CoTaskMemFree.OLE32(?), ref: 6D61434F
PathRemoveFileSpecW.SHLWAPI(00000000), ref: 6D614382

Part of subcall function 6D61413B: __EH_prolog3.LIBCMT ref: 6D614142

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000,000000FF), ref: 6D6143BE
CoTaskMemFree.OLE32(?), ref: 6D6143C9

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ByteCharMultiWide$FileFreePathRemoveSpecTask$H_prolog3$_strlen
String ID:
API String ID: 40125332-0
Opcode ID: 40bc5b7168a7163f3aac43961bd82572ea9f38c5729ccaff3d16efefbfdf1e3b
Instruction ID: 9ce5fc64db104201526bc4b2981d7e75939d2086a602d0dbff105453995bd696
Opcode Fuzzy Hash: 40bc5b7168a7163f3aac43961bd82572ea9f38c5729ccaff3d16efefbfdf1e3b
Instruction Fuzzy Hash: ADC13D71A04609DFCB04DFA8C994DAEB7F9FF8C3147118658E526AB3A1DB31AD01CB60

Function 6D6043E0 Relevance: 18.3, APIs: 12, Instructions: 263windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D604411
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D604427
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D60443D
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D604451

Part of subcall function 6D6110EB: __EH_prolog3.LIBCMT ref: 6D6110F2
Part of subcall function 6D6110EB: __CxxThrowException@8.LIBCMT ref: 6D611128

SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D60456A
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D6045B1
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D6045F8
SendMessageA.USER32(?,000000F1,?,00000000), ref: 6D60463F
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D604651
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D604692
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6046A4
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6046B6

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$Exception@8H_prolog3Throw
String ID:
API String ID: 2952110909-0
Opcode ID: e68f38fe20fb372413b72e35996a784909e7416c72ed423e417574bb8e14ae89
Instruction ID: c93e358047c0806b95f0d260067dbe91f5385ba491e6c39fa41aa5afc219a6ed
Opcode Fuzzy Hash: e68f38fe20fb372413b72e35996a784909e7416c72ed423e417574bb8e14ae89
Instruction Fuzzy Hash: 80914F71744B02ABE728CB65CD91F66B3E5AB5C724F10461CE24A9B6D0CFB4F8418B58

Function 6D6172DF Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32), ref: 6D617308
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 6D617325
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 6D617332
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 6D61733F
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 6D61734C

Strings

CreateActCtxA, xrefs: 6D61731F
KERNEL32, xrefs: 6D617303
ReleaseActCtx, xrefs: 6D617327
DeactivateActCtx, xrefs: 6D617341
ActivateActCtx, xrefs: 6D617334

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: c18b7ca8c3749f116a386e489af51db5c30bef30b7b0419eeb409447305b823e
Instruction ID: 172555ab4f10f5aa049266fef7e6a7a9fb20638c825109ffd0a9e76857ccfd1b
Opcode Fuzzy Hash: c18b7ca8c3749f116a386e489af51db5c30bef30b7b0419eeb409447305b823e
Instruction Fuzzy Hash: 6711DA71D09245EBCF11EFAFCCC496ABFB4A65B3543208A7FE604D7241D7704489CA61

Function 6D612346 Relevance: 16.6, APIs: 11, Instructions: 139COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D61234D
FindResourceA.KERNEL32(?,?,00000005), ref: 6D612380
LoadResource.KERNEL32(?,00000000), ref: 6D612388

Part of subcall function 6D60A12E: UnhookWindowsHookEx.USER32(?), ref: 6D60A15E

LockResource.KERNEL32(?,00000024,6D5F9D32), ref: 6D612399
GetDesktopWindow.USER32 ref: 6D6123CC
IsWindowEnabled.USER32(?), ref: 6D6123DA
EnableWindow.USER32(?,00000000), ref: 6D6123E9

Part of subcall function 6D60DAA7: IsWindowEnabled.USER32(?), ref: 6D60DAB0

Part of subcall function 6D60DAC2: EnableWindow.USER32(?,6D646930), ref: 6D60DAD3

EnableWindow.USER32(?,00000001), ref: 6D6124CE
GetActiveWindow.USER32 ref: 6D6124D9
SetActiveWindow.USER32(?), ref: 6D6124E7
FreeResource.KERNEL32(?), ref: 6D612503

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 1a7debdbd3fda3b4b215445c172b4909c036a614cd0369ab9f88cd4f3cdb544d
Instruction ID: da1531e4b7596444f07a3374fb4596a0486e780d8a502fe687ac81e5a2ca719f
Opcode Fuzzy Hash: 1a7debdbd3fda3b4b215445c172b4909c036a614cd0369ab9f88cd4f3cdb544d
Instruction Fuzzy Hash: 69519F70A08616CFDF219FBACD45BBEBBB1BF4E705F118029E255A6190CB748940CF95

Function 6D62B3D6 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 116librarymemoryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6D61FA2F: __EH_prolog3_catch.LIBCMT ref: 6D61FA36

GetModuleHandleA.KERNEL32(KERNEL32.DLL,00000000,?,6D62B3B7,?,?,?,6D61E592,?,?,?,0000001C,6D61E6BA,00000000,?), ref: 6D62B423
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6D62B42F
FindResourceExA.KERNEL32(00000000,00000005,?,0000FC11), ref: 6D62B473
FindResourceA.KERNEL32(00000000,?,00000005), ref: 6D62B48C
LoadResource.KERNEL32(00000000,00000000,?,?,?,6D61E592,?,?,?,0000001C,6D61E6BA,00000000,?), ref: 6D62B49A
GlobalAlloc.KERNEL32(00000040,00000000,?,6D62B3B7,?,?,?,6D61E592,?,?,?,0000001C,6D61E6BA,00000000,?), ref: 6D62B4CA

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Strings

GetUserDefaultUILanguage, xrefs: 6D62B429
KERNEL32.DLL, xrefs: 6D62B41E
MS UI Gothic, xrefs: 6D62B44F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Resource$Find$AddressAllocException@8GlobalH_prolog3H_prolog3_catchHandleLoadModuleProcThrow
String ID: GetUserDefaultUILanguage$KERNEL32.DLL$MS UI Gothic
API String ID: 202444263-1344381877
Opcode ID: 5121fd17510ec2eb7051dbe810f36b8f7469a43892c2ab2f9f82a337338646d3
Instruction ID: 72d910310ba1b4544dd73bc7bd1b741f4b3c03a4feba0bc20e140a7723dd996b
Opcode Fuzzy Hash: 5121fd17510ec2eb7051dbe810f36b8f7469a43892c2ab2f9f82a337338646d3
Instruction Fuzzy Hash: 4631D6B1A04202ABDB04AF6ACC95E7A7779EF48314B05C024FD55CB298EF70DD41DBA4

Function 6D60B9CA Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D60B9D1
GetPropA.USER32(?,AfxOldWndProc423), ref: 6D60B9E0
CallWindowProcA.USER32(?,?,00000110,?,00000000), ref: 6D60BA3A

Part of subcall function 6D60A6E4: GetWindowRect.USER32(?,10000000), ref: 6D60A70E

SetWindowLongA.USER32(?,000000FC,?), ref: 6D60BA61
RemovePropA.USER32(?,AfxOldWndProc423), ref: 6D60BA69
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 6D60BA70
GlobalDeleteAtom.KERNEL32(?), ref: 6D60BA7A
CallWindowProcA.USER32(?,?,?,?,00000000), ref: 6D60BACE

Strings

AfxOldWndProc423, xrefs: 6D60B9D9, 6D60B9DE, 6D60BA67, 6D60BA6F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$AtomCallGlobalProcProp$DeleteFindH_prolog3_catchLongRectRemove
String ID: AfxOldWndProc423
API String ID: 2109165785-1060338832
Opcode ID: 8b4a2457891edb3b3cf617de4dc29e89ec86b39fa5c60c99dbfc1103d451997a
Instruction ID: 7a3174ac4ad5a8879727228d2316a53f3d3668651336c344415c02f94e401376
Opcode Fuzzy Hash: 8b4a2457891edb3b3cf617de4dc29e89ec86b39fa5c60c99dbfc1103d451997a
Instruction Fuzzy Hash: C8312D7284421ABBCF05AFA4CE48EFF7AB8FF0E355F008119F605A5051DB3599509BA5

Function 6D618D96 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 6D618DB1
GetSystemMetrics.USER32(00000048), ref: 6D618DD5
CreateFontA.GDI32(00000000), ref: 6D618DDC
SelectObject.GDI32(?,00000000), ref: 6D618DF2
GetCharWidthA.GDI32(?,00000036,00000036,6D65C47C), ref: 6D618E03
SelectObject.GDI32(?,?), ref: 6D618E13
DeleteObject.GDI32(00000000), ref: 6D618E16
ReleaseDC.USER32(00000000,?), ref: 6D618E20

Strings

Marlett, xrefs: 6D618DB7

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Object$Select$CharCreateDeleteFontMetricsReleaseSystemWidth
String ID: Marlett
API String ID: 1397664628-3688754224
Opcode ID: 00c47c794d883f899e0e51f820aacdd50941354f378a0b698f3452b8f9fac451
Instruction ID: 6154bfa6ec2b0cb00e7894de55248f15e6c2ee73ff58f35d55827e10f7a5c3b2
Opcode Fuzzy Hash: 00c47c794d883f899e0e51f820aacdd50941354f378a0b698f3452b8f9fac451
Instruction Fuzzy Hash: F4113C31901224BBCB21ABA78D4DEEF7F7DEF4B7A0F108000F209A2151C7714A81DAE0

Function 6D628E0A Relevance: 15.1, APIs: 10, Instructions: 97COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,00000000,?,?,?), ref: 6D628E21
GetWindowRect.USER32(?,?), ref: 6D628E39
SetRect.USER32(?,?,00000000,?,?), ref: 6D628E79
InvalidateRect.USER32(?,?,00000001), ref: 6D628E88
SetRect.USER32(?,?,00000000,?,?), ref: 6D628E9F
InvalidateRect.USER32(?,?,00000001), ref: 6D628EAE
SetRect.USER32(?,00000000,?,?,?), ref: 6D628EDF
InvalidateRect.USER32(?,?,00000001), ref: 6D628EEA
SetRect.USER32(?,00000000,?,?,?), ref: 6D628F01
InvalidateRect.USER32(?,?,00000001), ref: 6D628F0C

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Rect$Invalidate$Window$Proc
String ID:
API String ID: 570070710-0
Opcode ID: 8e3a3df2baeba3b08be3dc548cf27609ead4ac02382528adcc2e58ae35b868c4
Instruction ID: f807f1f614fda8fd4151281f0afd6d705369855c146019a81395e35b972b8933
Opcode Fuzzy Hash: 8e3a3df2baeba3b08be3dc548cf27609ead4ac02382528adcc2e58ae35b868c4
Instruction Fuzzy Hash: DC31D5B290021ABFDF04DFA5CD88FEABB79FB09300F104115FA45A75A4D771AA54CBA1

Function 6D604B40 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179registrywindowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,000000C8), ref: 6D604C18
RegCreateKeyA.ADVAPI32 ref: 6D604C8C
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D604CB0
RegSetValueExA.ADVAPI32(?,StartAutoRun,00000000,00000001,80000002,?), ref: 6D604CEB

Part of subcall function 6D610EBA: __EH_prolog3.LIBCMT ref: 6D610EC1

Part of subcall function 6D611464: CloseHandle.KERNEL32(00000001,00000000,?,6D611621,00000214,6D6116EB), ref: 6D611475
Part of subcall function 6D611464: GetLastError.KERNEL32(?,00000000,?,6D611621,00000214,6D6116EB), ref: 6D61149A

Part of subcall function 6D610E7C: __EH_prolog3.LIBCMT ref: 6D610E83

RegDeleteValueA.ADVAPI32(?,StartAutoRun), ref: 6D604CFD

Part of subcall function 6D6115E3: __EH_prolog3_catch_GS.LIBCMT ref: 6D6115ED

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 6D604C67
StartAutoRun, xrefs: 6D604CE5, 6D604CF7
Setting\Setting.dat, xrefs: 6D604B8C

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3Value$CloseCreateDeleteErrorFileH_prolog3_catch_HandleLastMessageModuleNameSend
String ID: Setting\Setting.dat$Software\Microsoft\Windows\CurrentVersion\Run$StartAutoRun
API String ID: 1775175586-2829586130
Opcode ID: 894d2b2ff88f56afbf1c6182515f4123202aaeb6caffa46c31345c449428ca22
Instruction ID: f7f725d64d08c9b40659fa293518aadb21c67f6ed41eb4716a9dc62f13ab847d
Opcode Fuzzy Hash: 894d2b2ff88f56afbf1c6182515f4123202aaeb6caffa46c31345c449428ca22
Instruction Fuzzy Hash: 4E619F712487419FD324DB28CD50FABB7E4AFDD714F108A1DE25A9B2D0DB70A909CB92

Function 6D5FBB50 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 6D5FBB5E
ScreenToClient.USER32(?,?), ref: 6D5FBB70

Part of subcall function 6D6185A6: SendMessageA.USER32(?,00001111,00000000,?), ref: 6D6185C8

SendMessageA.USER32(?,0000110B,00000009,00000000), ref: 6D5FBC44

Part of subcall function 6D6185DE: SendMessageA.USER32(?,0000110C,00000000,?), ref: 6D618608

SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 6D5FBBE2

Part of subcall function 6D618619: SendMessageA.USER32(?,0000110D,00000000,00000018), ref: 6D618652

SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 6D5FBC09
SendMessageA.USER32(?,0000110B,00000009,00000000), ref: 6D5FBBC0

Part of subcall function 6D5FBAE0: SendMessageA.USER32(?,0000110A,00000004,?), ref: 6D5FBAF7
Part of subcall function 6D5FBAE0: SendMessageA.USER32(?,0000110A,00000001,00000000), ref: 6D5FBB37

SendMessageA.USER32(?,0000110B,00000009,00000000), ref: 6D5FBC17

Strings

@, xrefs: 6D5FBB92

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$ClientCursorScreen
String ID: @
API String ID: 41388912-2766056989
Opcode ID: 441fe7e522aea31598167f9b78ab037257177dab70c7b0fa502b51aa53229be4
Instruction ID: 476ba1370848533ca147cd9fd373a6c34202a7367d86cb66b3dad2d82cbbc2fb
Opcode Fuzzy Hash: 441fe7e522aea31598167f9b78ab037257177dab70c7b0fa502b51aa53229be4
Instruction Fuzzy Hash: 9D31D575204706ABD718EA659C40FBBB3EDFBC8755F00081CFA4A971C0DF619909CB60

Function 6D627F32 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 6D627F5A
GetStockObject.GDI32(0000000D), ref: 6D627F62
GetObjectA.GDI32(00000000,0000003C,?), ref: 6D627F6F
GetDC.USER32(00000000), ref: 6D627F7E
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6D627F92
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 6D627F9E
ReleaseDC.USER32(00000000,00000000), ref: 6D627FAA

Strings

System, xrefs: 6D627F55, 6D627FBF

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 0f964f6484783f120935dfe003cacb1e97cde94e27ebccff8d4dc203f4338a03
Instruction ID: 69a7c80778a133c2c2248f5df4b9d9562838e7f49e61b213f44ac6e2cfc95ad4
Opcode Fuzzy Hash: 0f964f6484783f120935dfe003cacb1e97cde94e27ebccff8d4dc203f4338a03
Instruction Fuzzy Hash: DF114271A44219EBEF10ABA2CD45FEE7B78EB4A741F014015F605A6180DB709D46CBB4

Function 6D5F2D90 Relevance: 13.9, APIs: 9, Instructions: 393windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D6099BD: __EH_prolog3_catch.LIBCMT ref: 6D6099C4

Part of subcall function 6D6110EB: __EH_prolog3.LIBCMT ref: 6D6110F2
Part of subcall function 6D6110EB: __CxxThrowException@8.LIBCMT ref: 6D611128

SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F3027
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F3051

Part of subcall function 6D60D8C8: GetDlgItem.USER32(?,?), ref: 6D60D8D9

SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F306E
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F3129
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F317A
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F31B9

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$Exception@8H_prolog3H_prolog3_catchItemThrow
String ID:
API String ID: 2494371950-0
Opcode ID: 4675ee65bbc28b115a48f10cde804c223e68fcb7638b72fd1f0f2aa997d6d2aa
Instruction ID: e7a36ce24c95891c12a9755422cf15fd18c0aeefef4796fd290a490a718bb8a1
Opcode Fuzzy Hash: 4675ee65bbc28b115a48f10cde804c223e68fcb7638b72fd1f0f2aa997d6d2aa
Instruction Fuzzy Hash: 1AD1A470784B02ABE638CB55CD91F7A73A5AB8D714F104A1CE34A9FAD0CB74F8428B55

Function 6D5FCEF0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 6D606101: _malloc.LIBCMT ref: 6D60611F

_memset.LIBCMT ref: 6D5FCF78
EnumProcesses.PSAPI(?,00001000,?,?,00000000,00000103), ref: 6D5FCF8F
OpenProcess.KERNEL32(00000410,00000000,?,?,00001000,?,?,00000000,00000103), ref: 6D5FCFB9
EnumProcessModules.PSAPI(00000000,?,00000004,?), ref: 6D5FCFD6
GetModuleFileNameExA.PSAPI(00000000,?,?,00000104,00000000,?,00000004,?), ref: 6D5FCFEE
GetShortPathNameA.KERNEL32(?,?,00000100), ref: 6D5FD003
__itow.LIBCMT ref: 6D5FD014
CloseHandle.KERNEL32(?,?,00001000,?,?,00000000,00000103), ref: 6D5FD0BE
CloseHandle.KERNEL32(?), ref: 6D5FD0C5

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CloseEnumHandleNameProcess$FileModuleModulesOpenPathProcessesShort__itow_malloc_memset
String ID:
API String ID: 2756701432-0
Opcode ID: 3d71553006c3ed1866c4b19820433560c2d74cea9a477e532cc38441b95f2334
Instruction ID: 8af19129795c4279f4ef58e76c4f8858d1db13b69b8736feb5a05d2f7112d1f9
Opcode Fuzzy Hash: 3d71553006c3ed1866c4b19820433560c2d74cea9a477e532cc38441b95f2334
Instruction Fuzzy Hash: 57518371608341AFD314DF68C841BEFB7E8EFC9314F018A1DE259CB290EB74A9558B96

Function 6D5FAA20 Relevance: 13.6, APIs: 9, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6D5FA8B0: ~_Task_impl.LIBCPMT ref: 6D5FA8E6
Part of subcall function 6D5FA8B0: ~_Task_impl.LIBCPMT ref: 6D5FA8F6
Part of subcall function 6D5FA8B0: ~_Task_impl.LIBCPMT ref: 6D5FA906
Part of subcall function 6D5FA8B0: ~_Task_impl.LIBCPMT ref: 6D5FA913

Part of subcall function 6D611C14: __EH_prolog3.LIBCMT ref: 6D611C1B

Part of subcall function 6D5F3300: ~_Task_impl.LIBCPMT ref: 6D5F3333

Part of subcall function 6D5FA970: ~_Task_impl.LIBCPMT ref: 6D5FA9A6

Part of subcall function 6D618E30: __EH_prolog3.LIBCMT ref: 6D618E37

~_Task_impl.LIBCPMT ref: 6D5FABA4
~_Task_impl.LIBCPMT ref: 6D5FABB4
~_Task_impl.LIBCPMT ref: 6D5FABC4
~_Task_impl.LIBCPMT ref: 6D5FABD4
~_Task_impl.LIBCPMT ref: 6D5FABE4
~_Task_impl.LIBCPMT ref: 6D5FABF4
~_Task_impl.LIBCPMT ref: 6D5FAC04
~_Task_impl.LIBCPMT ref: 6D5FAC14
~_Task_impl.LIBCPMT ref: 6D5FAC24

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Task_impl$H_prolog3
String ID:
API String ID: 1204490572-0
Opcode ID: 4e8f5a9c0234c0f8072c3d064238725fcdbdc5fb7368d6014e7b03973ed9c375
Instruction ID: 9e3288f9ead24901518b531f7e979d84ed869100df9b8aff481a8c7df2f6d26f
Opcode Fuzzy Hash: 4e8f5a9c0234c0f8072c3d064238725fcdbdc5fb7368d6014e7b03973ed9c375
Instruction Fuzzy Hash: 75614E3400D7818EE319CB78C954BDABBE0AFA9718F45494CD5EA13281DF746A0DCAB3

Function 6D628C54 Relevance: 13.6, APIs: 9, Instructions: 131timekeyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 6D628C61
GetCursorPos.USER32(?), ref: 6D628C80
ScreenToClient.USER32(?,?), ref: 6D628C8D
GetCapture.USER32 ref: 6D628CE3

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

ClientToScreen.USER32(?,?), ref: 6D628D2A
WindowFromPoint.USER32(?,?), ref: 6D628D36
IsChild.USER32(?,00000000), ref: 6D628D4B
KillTimer.USER32(?,0000E001), ref: 6D628D88
KillTimer.USER32(?,0000E000), ref: 6D628DA4

Part of subcall function 6D60C635: GetForegroundWindow.USER32 ref: 6D60C649
Part of subcall function 6D60C635: GetLastActivePopup.USER32(?), ref: 6D60C65A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClientKillScreenTimerWindow$ActiveCaptureChildCursorException@8ForegroundFromH_prolog3LastPointPopupStateThrow
String ID:
API String ID: 1544770960-0
Opcode ID: c039a0f45b7af21efa1c289d411007933c8c094c4034e3ca10ab858c1b258865
Instruction ID: 2a9d5e65d71ee05be9629ff0477b2553d6cbbffc8219940d0b388501790854cc
Opcode Fuzzy Hash: c039a0f45b7af21efa1c289d411007933c8c094c4034e3ca10ab858c1b258865
Instruction Fuzzy Hash: 5F41A231600606EFDF109B69CD48AAE7BB5BF58324F108B69E565D76B0EB31D948CF40

Function 6D61A6A2 Relevance: 13.6, APIs: 9, Instructions: 120windowtimenetworkCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D61A6A9
SetTimer.USER32(?,00000001,?,00000000), ref: 6D61A6DA
PeekMessageA.USER32(?,?,00000373,00000374,00000001), ref: 6D61A70B
KillTimer.USER32(?,?), ref: 6D61A749
WSASetLastError.WS2_32(00002714), ref: 6D61A75F

Part of subcall function 6D6162A8: __CxxThrowException@8.LIBCMT ref: 6D6162BE

PeekMessageA.USER32(?,?,00000113,00000113,00000001), ref: 6D61A799
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6D61A7B2
PostMessageA.USER32(?,00000373,00000000,00000000), ref: 6D61A823

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Message$Peek$Timer$ErrorException@8H_prolog3_catchKillLastPostThrow
String ID:
API String ID: 892135707-0
Opcode ID: 8f42662f54cfed0eb0f56577df399edea8145defd577a296746692b61334a1b2
Instruction ID: d1b361b2de39e9dfc9a8b4ce029a2f168401570f1499ea7cfba3dc528f2da8fa
Opcode Fuzzy Hash: 8f42662f54cfed0eb0f56577df399edea8145defd577a296746692b61334a1b2
Instruction Fuzzy Hash: 7F410FB490820AEFEF019FA9CC44EBEBBB9FF08355F108625E515E6150D774DA46CBA0

Function 6D61FD10 Relevance: 13.6, APIs: 9, Instructions: 96memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D61FD17
EnterCriticalSection.KERNEL32(?,00000010,6D61FFD3,?,00000000,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FD28
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FD46
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FD7A
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FDE6
_memset.LIBCMT ref: 6D61FE05
TlsSetValue.KERNEL32(?,00000000), ref: 6D61FE16
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FE37

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: af80b4a9eb9441d65210465b2e754b3c6f484e7f4be546d4122953bc387c9005
Instruction ID: c39ce3668604f92b0603c12fbd8a2acdaab1a3c8f6e3febe8db4c4936f0aa8c4
Opcode Fuzzy Hash: af80b4a9eb9441d65210465b2e754b3c6f484e7f4be546d4122953bc387c9005
Instruction Fuzzy Hash: 393108B2808606EFDB14EF68CC84DAAB7B1FF09354B11C52DE66997551CB30AD95CF80

Function 6D6033C0 Relevance: 13.6, APIs: 9, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D6033DA
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D603424
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D603436
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D603448
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D60345A
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D60349D
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6034AF
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6034C1
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6034D3

Part of subcall function 6D60DAC2: EnableWindow.USER32(?,6D646930), ref: 6D60DAD3

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$EnableWindow
String ID:
API String ID: 1554173715-0
Opcode ID: 428ff62414be679faa212be92c02b71ecb3a19537ad660f87806abd91af2e821
Instruction ID: ee59e2baa4aca8d6be0010078101caf0682d6912370323e1173cf0b5360c691e
Opcode Fuzzy Hash: 428ff62414be679faa212be92c02b71ecb3a19537ad660f87806abd91af2e821
Instruction Fuzzy Hash: 34212C313C4702BAF634E674CC92FE6B2985F84F10F118928F35AAE4C09EE078449B68

Function 6D61D9DA Relevance: 13.6, APIs: 9, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 6D61D9FA
GetWindowLongA.USER32(00000000,000000F0), ref: 6D61DA0C
IsWindowEnabled.USER32(?), ref: 6D61DA18
GetDlgItem.USER32(?), ref: 6D61DA33
GetWindowLongA.USER32(00000000,000000F0), ref: 6D61DA3B
IsWindowEnabled.USER32(?), ref: 6D61DA47
GetFocus.USER32 ref: 6D61DA68
IsWindowEnabled.USER32(00000000), ref: 6D61DA6F
SetFocus.USER32(?), ref: 6D61DA7C

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Enabled$FocusItemLong
String ID:
API String ID: 1558694495-0
Opcode ID: 03c698c16c330bd15b0061f4c646c04c798ce3cb0dca11e33687a20fe8e32a2d
Instruction ID: b58db0527d1c5a6916d934ce3342ef2db7246cd43ab2be22c59c47be5ea44023
Opcode Fuzzy Hash: 03c698c16c330bd15b0061f4c646c04c798ce3cb0dca11e33687a20fe8e32a2d
Instruction Fuzzy Hash: E1213B71208206ABDF01EFAACC48BAE7B79FF89395B10C115F90596260DB31D994DF90

Function 6D6322A7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6D6322D8
__calloc_crt.LIBCMT ref: 6D6322E4
__getptd.LIBCMT ref: 6D6322F1
CreateThread.KERNEL32(?,?,6D632224,00000000,?,a_am), ref: 6D632328
GetLastError.KERNEL32(?,774D2EE0,00000000,?,?,6D615F61,?,?,6D615DBE,?,?,?), ref: 6D632332
__dosmaperr.LIBCMT ref: 6D63234A

Part of subcall function 6D62E99E: __getptd_noexit.LIBCMT ref: 6D62E99E

Part of subcall function 6D6334CC: __decode_pointer.LIBCMT ref: 6D6334D7

Strings

a_am, xrefs: 6D632309, 6D632318

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID: a_am
API String ID: 1803633139-2329633268
Opcode ID: 51451cb722e0df4d3b9dbdb91aad42e2e933f27366af9f1081a2748ea48995cf
Instruction ID: d3689325e74b63779f65f38bf8cd800fa5e25cf172c670f0aed6467ced825a2a
Opcode Fuzzy Hash: 51451cb722e0df4d3b9dbdb91aad42e2e933f27366af9f1081a2748ea48995cf
Instruction Fuzzy Hash: 3E11C472508329AFEB15AFA4DC408EE7BA5EF0C328B135039F61897050D771D9418AA4

Function 6D622F8C Relevance: 12.3, APIs: 8, Instructions: 297memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D622F93

Part of subcall function 6D6213DB: SysStringLen.OLEAUT32(?), ref: 6D6213E5
Part of subcall function 6D6213DB: CoGetClassObject.OLE32(?,?,00000000,6D64FFFC,?), ref: 6D621403

CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 6D62311D
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 6D62313E
GlobalAlloc.KERNEL32(00000000,00000000), ref: 6D62318B
GlobalLock.KERNEL32(00000000), ref: 6D623199
GlobalUnlock.KERNEL32(?), ref: 6D6231B1
CreateILockBytesOnHGlobal.OLE32(8007000E,00000001,?), ref: 6D6231D4
StgOpenStorageOnILockBytes.OLE32(?,00000000,00000012,00000000,00000000,?), ref: 6D6231F0

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: GlobalLock$Bytes$Create$AllocClassDocfileH_prolog3ObjectOpenStorageStringUnlock
String ID:
API String ID: 317715441-0
Opcode ID: 238cfd2cfaa91b1c06dccb681fc23a2d639c2ada295869ebd182f46ec042cf32
Instruction ID: 6ea06a90d091173cf56608bc7e4dddb2db6243f86aeaf3c1b69db7d1d7a52215
Opcode Fuzzy Hash: 238cfd2cfaa91b1c06dccb681fc23a2d639c2ada295869ebd182f46ec042cf32
Instruction Fuzzy Hash: 87C1E6B090024AAFDB04DFA4C8889AEBBB9FF49344B10496DF915AB251C775D951CFA0

Function 6D61E207 Relevance: 12.1, APIs: 8, Instructions: 147windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D60CDF3: _memset.LIBCMT ref: 6D60CE23

IsWindowEnabled.USER32(00000000), ref: 6D61E270
EnableWindow.USER32(00000000,00000000), ref: 6D61E27C
GetCapture.USER32 ref: 6D61E289
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 6D61E298
EnableWindow.USER32(00000000,00000001), ref: 6D61E34F
GetActiveWindow.USER32 ref: 6D61E359
SetActiveWindow.USER32(00000000), ref: 6D61E365
EnableWindow.USER32(00000000,00000001), ref: 6D61E395

Part of subcall function 6D60A12E: UnhookWindowsHookEx.USER32(?), ref: 6D60A15E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Enable$Active$CaptureEnabledHookMessageSendUnhookWindows_memset
String ID:
API String ID: 1406488295-0
Opcode ID: f0a58fc00616821a0e03b0ee8d1c9a2b45902aee84b79ab850549275dfa04dab
Instruction ID: f6f7c5191122ae5ff14da76ebd1df25a646ff3192c14755280b5d2646f846bd0
Opcode Fuzzy Hash: f0a58fc00616821a0e03b0ee8d1c9a2b45902aee84b79ab850549275dfa04dab
Instruction Fuzzy Hash: 604191706087019FDB159FB9C988BAE77F8BF4D718F014528E24AD6982DBB4D8408B54

Function 6D613BFF Relevance: 12.1, APIs: 8, Instructions: 105windowstringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 6D613C12
_memset.LIBCMT ref: 6D613C2B
GetFocus.USER32 ref: 6D613C33

Part of subcall function 6D60A12E: UnhookWindowsHookEx.USER32(?), ref: 6D60A15E

IsWindowEnabled.USER32(?), ref: 6D613C62
EnableWindow.USER32(?,00000000), ref: 6D613C7B
EnableWindow.USER32(00000000,00000001), ref: 6D613CFC
IsWindow.USER32(?), ref: 6D613D01
SetFocus.USER32(?), ref: 6D613D0E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$EnableFocus$EnabledHookUnhookWindows_memsetlstrlen
String ID:
API String ID: 3424750955-0
Opcode ID: 776ace7311d0836e37a83d8ce7000633c0026edebaee31b360cbfe9c312c29b5
Instruction ID: 720421afb64f978ec6afd3f228b1b450fbc46af21dc8c3add4d26910318d4d7c
Opcode Fuzzy Hash: 776ace7311d0836e37a83d8ce7000633c0026edebaee31b360cbfe9c312c29b5
Instruction Fuzzy Hash: 4E31BD30648A00EFDB129F79CD48B6ABBF5FF49708F11852CE61A87260CB71E845CB90

Function 6D5F5990 Relevance: 12.1, APIs: 8, Instructions: 81COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 6D5F5A19
GetSysColor.USER32(0000000F), ref: 6D5F5A20
CreateSolidBrush.GDI32(00000000), ref: 6D5F5A23
GetStockObject.GDI32(00000011), ref: 6D5F5A34
GetObjectA.GDI32(00000000,?,?), ref: 6D5F5A3B
CreateFontIndirectA.GDI32(?), ref: 6D5F5A42
GetSysColor.USER32(0000000F), ref: 6D5F5A76
CreateSolidBrush.GDI32(00000000), ref: 6D5F5A79

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ColorCreate$BrushObjectSolid$FontIndirectStock
String ID:
API String ID: 2423990618-0
Opcode ID: 8bf7e70a9f50104a8158d132a3d5ff75ac8614ce962e34fe6bd09c26dfc91847
Instruction ID: 8c23635fd0c2cd064dc0e68325acc5d01c23465510abebd21c53e3eb94d42a74
Opcode Fuzzy Hash: 8bf7e70a9f50104a8158d132a3d5ff75ac8614ce962e34fe6bd09c26dfc91847
Instruction Fuzzy Hash: F1318DB1A04740DFD764EF79C904B9BBBE8FB89714F00891EE58AC7241DB79A444CBA1

Function 6D6176CD Relevance: 12.1, APIs: 8, Instructions: 66memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?,?,?,?,?,?,6D60B633,?), ref: 6D6176EC
lstrcmpA.KERNEL32(?,?,?,?,?,?,?,6D60B633,?), ref: 6D6176F8
OpenPrinterA.WINSPOOL.DRV(?,?,00000000,?,?,?,?,?,6D60B633,?), ref: 6D61770A
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000,?,?,?,?,?,6D60B633,?), ref: 6D61772A
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 6D617732
GlobalLock.KERNEL32(00000000,?,?,?,?,?,6D60B633,?), ref: 6D61773C
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6D60B633,?), ref: 6D617749
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6D60B633,?), ref: 6D617761

Part of subcall function 6D6200CD: GlobalFlags.KERNEL32(?), ref: 6D6200DC
Part of subcall function 6D6200CD: GlobalUnlock.KERNEL32(?,?,6D61775B,?,00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6D60B633), ref: 6D6200EE
Part of subcall function 6D6200CD: GlobalFree.KERNEL32(?), ref: 6D6200F9

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 077aa8aa6847764e9df0d6115e2bdfd638d3a999284d2f1b7c1c85eba536885e
Instruction ID: 45864643b7c03dd83cc27418cce9f15874d21a5803605baa85fb9a5384a67527
Opcode Fuzzy Hash: 077aa8aa6847764e9df0d6115e2bdfd638d3a999284d2f1b7c1c85eba536885e
Instruction Fuzzy Hash: F811CE71A04604BBEF229BBACC88DBF7AFDEB89B04B008519F605C2020DB75CA50D724

Function 6D632224 Relevance: 12.0, APIs: 8, Instructions: 42threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6D63222A

Part of subcall function 6D6342C1: TlsGetValue.KERNEL32(00000000,6D63444D,?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C,6D634C7F,00000000,00000000), ref: 6D6342CA
Part of subcall function 6D6342C1: __decode_pointer.LIBCMT ref: 6D6342DC
Part of subcall function 6D6342C1: TlsSetValue.KERNEL32(00000000,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C,6D634C7F,00000000,00000000,?,6D63455A,0000000D), ref: 6D6342EB

___fls_getvalue@4.LIBCMT ref: 6D632235

Part of subcall function 6D6342A1: TlsGetValue.KERNEL32(?,?,6D63223A,00000000), ref: 6D6342AF

___fls_setvalue@8.LIBCMT ref: 6D632248

Part of subcall function 6D6342F5: __decode_pointer.LIBCMT ref: 6D634306

GetLastError.KERNEL32(00000000,?,00000000), ref: 6D632251
ExitThread.KERNEL32 ref: 6D632258
GetCurrentThreadId.KERNEL32 ref: 6D63225E
__freefls@4.LIBCMT ref: 6D63227E
__IsNonwritableInCurrentImage.LIBCMT ref: 6D632291

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 1925773019-0
Opcode ID: 05695bd3acbba5504f15e86b48c0f93e42faffeb0cdc9150c13029aaba28b397
Instruction ID: 4eba00f63cc9f5dc67cad8fddb3ea5f494a6592056a21d0230c93c5a920ddf51
Opcode Fuzzy Hash: 05695bd3acbba5504f15e86b48c0f93e42faffeb0cdc9150c13029aaba28b397
Instruction Fuzzy Hash: BE01A770404221ABC714EBE2CC08A597BB8BF4D318713E454E908A7512DB71D485CFD5

Function 6D61F826 Relevance: 12.0, APIs: 8, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 6D61F835
GetSystemMetrics.USER32(0000000C), ref: 6D61F83C
GetSystemMetrics.USER32(00000002), ref: 6D61F843
GetSystemMetrics.USER32(00000003), ref: 6D61F84D
GetDC.USER32(00000000), ref: 6D61F857
GetDeviceCaps.GDI32(00000000,00000058), ref: 6D61F868
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6D61F870
ReleaseDC.USER32(00000000,00000000), ref: 6D61F878

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: cba3f1431ad020804932cf117e203e741ed1b2d8da9b2e7027cbe1e7a6dc3c7f
Instruction ID: 87bddd40e160275d823d6760ad9543b50fdf091e255576c8d5a00d8c712f326c
Opcode Fuzzy Hash: cba3f1431ad020804932cf117e203e741ed1b2d8da9b2e7027cbe1e7a6dc3c7f
Instruction Fuzzy Hash: CBF0BDB1E40724ABEB106FB29C4DB667F78FB46761F008516F6059B2C0DBB598518FD0

Function 6D5F3DB0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000001,00000080,00000000), ref: 6D5F3E96
CloseHandle.KERNEL32(00000000), ref: 6D5F3EA1
_memset.LIBCMT ref: 6D5F3F13
_memset.LIBCMT ref: 6D5F3F26
DeleteFileA.KERNEL32(?,?,00001002,00000000,?,00000000,00000000), ref: 6D5F3F8E

Strings

%smingrisofttemp.txt, xrefs: 6D5F3E72

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: File_memset$CloseCreateDeleteHandle
String ID: %smingrisofttemp.txt
API String ID: 3034448655-1600845768
Opcode ID: f74b3e616a7408786de82184879b8139673439dfa9216c1eb7f81651bcce49c6
Instruction ID: 185ec15bceeb1194ee9f44fff5acf55f52d9661571fecfea25cc4bf5cf60512e
Opcode Fuzzy Hash: f74b3e616a7408786de82184879b8139673439dfa9216c1eb7f81651bcce49c6
Instruction Fuzzy Hash: 9CC108709082459FEB09CBA8CD50FEEB7B4FF59314F118258E619AF2D1DB34AA05CB94

Function 6D5F3980 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000001,00000080,00000000), ref: 6D5F3A66
CloseHandle.KERNEL32(00000000), ref: 6D5F3A71
_memset.LIBCMT ref: 6D5F3AE3
_memset.LIBCMT ref: 6D5F3AF6
DeleteFileA.KERNEL32(?,?,00001002,00000000,?,00000000,00000000), ref: 6D5F3B5E

Strings

%smingrisofttemp.txt, xrefs: 6D5F3A42

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: File_memset$CloseCreateDeleteHandle
String ID: %smingrisofttemp.txt
API String ID: 3034448655-1600845768
Opcode ID: 298f332066511e2b727d12651e3b42df7498d249d14306aefe65b7bd530d0712
Instruction ID: bdaca94402409be490512b2dc67ac0d23ffb67d12524b81ea91c8606af5355fd
Opcode Fuzzy Hash: 298f332066511e2b727d12651e3b42df7498d249d14306aefe65b7bd530d0712
Instruction Fuzzy Hash: E5C107719082459FEB09DBA8CC50FEEB7B4FF58314F118658E619AB2D1DB30AA05CB91

Function 6D6315AE Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D631610
_memcpy_s.LIBCMT ref: 6D631685
__fileno.LIBCMT ref: 6D6316E5
__read.LIBCMT ref: 6D6316EC
__filbuf.LIBCMT ref: 6D631710
_memset.LIBCMT ref: 6D631756
_memset.LIBCMT ref: 6D631781

Part of subcall function 6D62E99E: __getptd_noexit.LIBCMT ref: 6D62E99E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: 437b102b762bc2e9ead4c8ebfdd34d86786d971c69784b87cf61bc706c8f742e
Instruction ID: 9089b478ac50039d65bdaedfbfedd599a78b8b62229bb353e87ea666b5eb5013
Opcode Fuzzy Hash: 437b102b762bc2e9ead4c8ebfdd34d86786d971c69784b87cf61bc706c8f742e
Instruction Fuzzy Hash: 8D510770D00325EFCB118FA9CC445EE7BB5EF9A364F16A629E43992190D738DA61CF90

Function 6D626FDC Relevance: 10.6, APIs: 7, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D626FE3
_memset.LIBCMT ref: 6D62704F

Part of subcall function 6D61C792: _memset.LIBCMT ref: 6D61C79E

VariantClear.OLEAUT32(?), ref: 6D62708F
SysFreeString.OLEAUT32(00000000), ref: 6D627110
SysFreeString.OLEAUT32(00000000), ref: 6D62711F
SysFreeString.OLEAUT32(00000000), ref: 6D62712E
VariantClear.OLEAUT32(00000000), ref: 6D627143

Part of subcall function 6D626A9D: __EH_prolog3_GS.LIBCMT ref: 6D626AA7
Part of subcall function 6D626A9D: VariantClear.OLEAUT32(?), ref: 6D626B0C

Part of subcall function 6D61C76E: VariantCopy.OLEAUT32(?,?), ref: 6D61C77F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Variant$ClearFreeString$_memset$CopyH_prolog3H_prolog3_
String ID:
API String ID: 3746181197-0
Opcode ID: e5e993e83032849ca1e49de57d1c81479a40116b1331fbbb693e6196d3202646
Instruction ID: 7ecc8dc407a35ae9a9a2410add45a20439dfeeb0f1e61d2c648706c3ea2d45c5
Opcode Fuzzy Hash: e5e993e83032849ca1e49de57d1c81479a40116b1331fbbb693e6196d3202646
Instruction Fuzzy Hash: 855116B1D0020ADFDB10DFA4C889BEEBBB4BF08305F148529E119E7291D775A945CF60

Function 6D627DDE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?,76A05E50,System,0000000A), ref: 6D627E0A
lstrlenA.KERNEL32(?), ref: 6D627E55
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 6D627E6F
_wcslen.LIBCMT ref: 6D627E93

Strings

System, xrefs: 6D627E06

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWide_wcslenlstrlen
String ID: System
API String ID: 4253822919-3470857405
Opcode ID: e9fb87e08c105ba5a30a110bfad10a140942e9f0d3c035b4ab8d8c97e0c4c0b5
Instruction ID: 11b9415699cab85b728a2229bcdabf86f98560d564c70b16c839f6d0231ac438
Opcode Fuzzy Hash: e9fb87e08c105ba5a30a110bfad10a140942e9f0d3c035b4ab8d8c97e0c4c0b5
Instruction Fuzzy Hash: 0041B071D04219EFDB04DFA4C884AAEBBB9FF08320F14852AE416EB284D7709D85CF90

Function 6D61956A Relevance: 10.6, APIs: 7, Instructions: 127windowCOMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 6D6195B4

Part of subcall function 6D60D952: GetWindowLongA.USER32(?,000000F0), ref: 6D60D95D

SendMessageA.USER32(?,0000043D,00000000,00000000), ref: 6D61960D
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 6D61961B
SendMessageA.USER32(?,0000043C,?,00000000), ref: 6D61962C
SendMessageA.USER32(?,0000043C,?,00000000), ref: 6D61963B
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 6D619646
InvalidateRect.USER32(?,00000000,00000001,00000000,00000000), ref: 6D6196B9

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$InvalidateLongRectWindow_memcmp
String ID:
API String ID: 235743446-0
Opcode ID: 6bd1e73f516f7f94e1c92396ed231f59510dd89455f1086ccc726a9c58ec914b
Instruction ID: 0e2b9e266dd2401a8ac7941322687a32d576cf0816bcd440eeeac9c3b7073d46
Opcode Fuzzy Hash: 6bd1e73f516f7f94e1c92396ed231f59510dd89455f1086ccc726a9c58ec914b
Instruction Fuzzy Hash: 10418E30744308BBEB109B64CC55FEABBB4BF08B54F004529F7956A2D1D7B1A940CBA4

Function 6D609C08 Relevance: 10.6, APIs: 7, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6D609C3B
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6D609C5F
UpdateWindow.USER32(?), ref: 6D609C7A
SendMessageA.USER32(?,00000121,00000000,?), ref: 6D609C9B
SendMessageA.USER32(?,0000036A,00000000,00000002), ref: 6D609CB3
UpdateWindow.USER32(?), ref: 6D609CF6
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6D609D27

Part of subcall function 6D60D952: GetWindowLongA.USER32(?,000000F0), ref: 6D60D95D

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: a719ea9356ef9e0b53587db75e86b86627b5300996c774331e22730d04b195ba
Instruction ID: fec9009c2458c3a7335e4ddb451b46fb0f11f58352f71bab8c83afd2b013c6c1
Opcode Fuzzy Hash: a719ea9356ef9e0b53587db75e86b86627b5300996c774331e22730d04b195ba
Instruction Fuzzy Hash: 3541BE70D04646ABCF158FA6CA84FAEBFF6FF89748F14852AE555A2190D7318640CB50

Function 6D60A1B8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D60A247
SendMessageA.USER32(00000000,00000405,00000000,?), ref: 6D60A270
GetWindowLongA.USER32(?,000000FC), ref: 6D60A282
GetWindowLongA.USER32(?,000000FC), ref: 6D60A293
SetWindowLongA.USER32(?,000000FC,?), ref: 6D60A2AF

Strings

,, xrefs: 6D60A266

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: ,
API String ID: 2997958587-3772416878
Opcode ID: f2bba06a5935941c69b79da45092f54e572cb4538671afe067907149479df4aa
Instruction ID: 9fbb81b03951281cb0d505216b7d7cf5278e75509250a6426b22a9e5fdec1a35
Opcode Fuzzy Hash: f2bba06a5935941c69b79da45092f54e572cb4538671afe067907149479df4aa
Instruction Fuzzy Hash: CF31ED306447129FCB18EFB9C984E6AB7B8BF0C354B06462CE25A97690DB31E840CB94

Function 6D618147 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D618151
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 6D618237
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 6D618254
RegCloseKey.ADVAPI32(?), ref: 6D618274
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 6D61828F

Strings

Software\, xrefs: 6D6181B5

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CloseEnumH_prolog3_OpenQueryValue
String ID: Software\
API String ID: 1666054129-964853688
Opcode ID: aae89e21276f06217da7e1342e0de93e3f6736ba1a678a33578dd4ebe0d0060d
Instruction ID: ecba4eef6b0ba1a81715402db26cfee9f7b0b29a4a3772272a49eddb67878804
Opcode Fuzzy Hash: aae89e21276f06217da7e1342e0de93e3f6736ba1a678a33578dd4ebe0d0060d
Instruction Fuzzy Hash: 7A419171808569ABCF26DB64CC40FEEB7B9AF4E314F1046D9E249E6190DB309E918F94

Function 6D617FC9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6D617FD3
RegOpenKeyA.ADVAPI32(?,?,?), ref: 6D618061
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 6D618084

Strings

Software\Classes\, xrefs: 6D618014

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: EnumH_prolog3_catch_Open
String ID: Software\Classes\
API String ID: 689246474-1121929649
Opcode ID: b565817bcdac7ad734739a6b20f48eb895c69b0f518669b539d42e991900cd02
Instruction ID: 48dcd956bfe19b4767b1382dfa85e304c401a9bd77723d26da5b37c45010d40e
Opcode Fuzzy Hash: b565817bcdac7ad734739a6b20f48eb895c69b0f518669b539d42e991900cd02
Instruction Fuzzy Hash: 8731C432C08169ABCB22EB68CD00BDDB7B8EF0D314F0141D4EA99A7251DB311F948F91

Function 6D628407 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 6D628414
SendMessageA.USER32(?,00000365,00000000,00000000), ref: 6D62842F
GetFocus.USER32 ref: 6D628444
SendMessageA.USER32(?,00000365,00000000,00000000), ref: 6D628452
GetLastActivePopup.USER32(?), ref: 6D62847B
SendMessageA.USER32(?,00000365,00000000,00000000), ref: 6D628488

Part of subcall function 6D60B556: GetWindowLongA.USER32(?,000000F0), ref: 6D60B57C
Part of subcall function 6D60B556: GetParent.USER32(?), ref: 6D60B58A

SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 6D6284AE

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastLongParentPopupWindow
String ID:
API String ID: 3338174999-0
Opcode ID: 42f90713c95680ae779cfcddf52581b217bf7a2f0032a4b64d5c89bb579fad06
Instruction ID: 518ed4d66ac11cefa22921ce16c39afc144950047a888576331a1f264cde0869
Opcode Fuzzy Hash: 42f90713c95680ae779cfcddf52581b217bf7a2f0032a4b64d5c89bb579fad06
Instruction Fuzzy Hash: ED116DB0A04119FFDF056FA5CE85DAE7F38EF4D789B1080B5E644A2130E7309E409E64

Function 6D6282A3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 6D6282D3
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6D6282F6
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6D628312
RegCloseKey.ADVAPI32(?), ref: 6D628322
RegCloseKey.ADVAPI32(?), ref: 6D62832C

Strings

software, xrefs: 6D6282BB

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: f9e07d469a7ac6506b2cda3253f46f6cb41d1174a84ec47efe45d2579907b975
Instruction ID: 13fa52f40590aacb7436b564100e5e49dba6dbbdf1015c42bd3a497d605d37db
Opcode Fuzzy Hash: f9e07d469a7ac6506b2cda3253f46f6cb41d1174a84ec47efe45d2579907b975
Instruction Fuzzy Hash: A011E972D00159BBCB11DADACD84DEFBFBDEB8AB10B10406AE514A2111D3319A44DBA0

Function 6D6082C4 Relevance: 10.6, APIs: 7, Instructions: 61COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6D6082D2
GetWindowRect.USER32(?,?), ref: 6D6082ED
ScreenToClient.USER32(?,?), ref: 6D608300
ScreenToClient.USER32(?,?), ref: 6D608309
EqualRect.USER32(?,?), ref: 6D608313
DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000014), ref: 6D60833B
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014), ref: 6D608345

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$ClientRectScreen$DeferEqualParent
String ID:
API String ID: 443303494-0
Opcode ID: 23e26899a9fda2dad8714426076ff703662951c6e68fbfb665c95426e3a00a21
Instruction ID: d99305e382f68bc0d6771b2e93eca61cea5fa6d692977579bf029bb8c21f280d
Opcode Fuzzy Hash: 23e26899a9fda2dad8714426076ff703662951c6e68fbfb665c95426e3a00a21
Instruction Fuzzy Hash: E611FB7650060AAFDB05EFE5CD44EABBBBDEF89710B108519F91593214E731E940CBA0

Function 6D61A938 Relevance: 10.6, APIs: 7, Instructions: 56networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D61A93F
WSASetLastError.WS2_32(00002726,00000018,6D602A90,127.0.0.1,000015B3), ref: 6D61A95A
_memset.LIBCMT ref: 6D61A979
inet_addr.WS2_32(?), ref: 6D61A989
gethostbyname.WS2_32(?), ref: 6D61A998
htons.WS2_32(?), ref: 6D61A9AF
WSASetLastError.WS2_32(00002726), ref: 6D61A9CF

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ErrorLast$H_prolog3__memsetgethostbynamehtonsinet_addr
String ID:
API String ID: 3855310499-0
Opcode ID: 8bac161f347eb40ead490def0ae50c8116cb603f6f23099c10299ac959245b1b
Instruction ID: ded88c020b8918c961e67dd48808a4d902eca537d9a675ca2dfb09aa01cfc3a7
Opcode Fuzzy Hash: 8bac161f347eb40ead490def0ae50c8116cb603f6f23099c10299ac959245b1b
Instruction Fuzzy Hash: 09119A74A542089FCF00EFB9CC48AEDB7B4BF1D320F118955E509EB290D7709A89CB65

Function 6D62B32C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D62B34E
_strlen.LIBCMT ref: 6D62B354
GetDC.USER32(00000000), ref: 6D62B37D
EnumFontFamiliesExA.GDI32(00000000,?,6D62B2EA,?,00000000), ref: 6D62B398
ReleaseDC.USER32(00000000,00000000), ref: 6D62B3A0

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Strings

MS UI Gothic, xrefs: 6D62B353, 6D62B366

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: EnumException@8FamiliesFontH_prolog3ReleaseThrow_memset_strlen
String ID: MS UI Gothic
API String ID: 1352509449-1905310704
Opcode ID: 5dc67ba3674e608bae6d8140d3c89d6840afadb6aa76be14b492d16a0237bfe3
Instruction ID: d5c7f5a81b5fd5455d8ab96c73abb97654127bdbd9bf6a4f3714fec7ce1450a5
Opcode Fuzzy Hash: 5dc67ba3674e608bae6d8140d3c89d6840afadb6aa76be14b492d16a0237bfe3
Instruction Fuzzy Hash: 33019672901118ABCB10EBA9DD44EEF7BBCEF8E654F114015F905E3201DB30AB46CAA9

Function 6D61FDB1 Relevance: 10.6, APIs: 7, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32(?), ref: 6D61FDB8
__CxxThrowException@8.LIBCMT ref: 6D61FDC2

Part of subcall function 6D62E66E: RaiseException.KERNEL32(6D6154FB,6D607483,73341224,?,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D62E6B0

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FDD9
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FDE6

Part of subcall function 6D60742F: __CxxThrowException@8.LIBCMT ref: 6D607445

_memset.LIBCMT ref: 6D61FE05
TlsSetValue.KERNEL32(?,00000000), ref: 6D61FE16
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FE37

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: 75cb77c1a0b0af39e9d22b646de727c690bdaf1102868d5ebab0ad9468c82646
Instruction ID: dffad3468304af3ea65677f83801b8991e9b1db2a3b40eb75aee980efffef711
Opcode Fuzzy Hash: 75cb77c1a0b0af39e9d22b646de727c690bdaf1102868d5ebab0ad9468c82646
Instruction Fuzzy Hash: D1118EB0504206AFDB14EFA8CC88D6BBBB6FF49358720C429E55996562CB31EC64CF94

Function 6D635FAB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D635FB7

Part of subcall function 6D6344AF: __getptd_noexit.LIBCMT ref: 6D6344B2
Part of subcall function 6D6344AF: __amsg_exit.LIBCMT ref: 6D6344BF

__amsg_exit.LIBCMT ref: 6D635FD7
__lock.LIBCMT ref: 6D635FE7
InterlockedDecrement.KERNEL32(?), ref: 6D636004
InterlockedIncrement.KERNEL32(04A21648), ref: 6D63602F

Strings

Lw, xrefs: 6D63602F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: Lw
API String ID: 4271482742-4278538321
Opcode ID: 3891cfac5da0bd4dad55363295337b6956dfaac0b08d4d36ce7f9b8921d23c9f
Instruction ID: 1f413b773859e98610be886348fb43c5ace4768198713d4bf21ba170a4e0a75f
Opcode Fuzzy Hash: 3891cfac5da0bd4dad55363295337b6956dfaac0b08d4d36ce7f9b8921d23c9f
Instruction Fuzzy Hash: B2018031905732ABDB11EFA58501BAD7770AF4E728F135019E524A7AC0CB74A5C1CFD6

Function 6D61F7E0 Relevance: 10.5, APIs: 7, Instructions: 30COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 6D61F7EE
GetSysColor.USER32(00000010), ref: 6D61F7F5
GetSysColor.USER32(00000014), ref: 6D61F7FC
GetSysColor.USER32(00000012), ref: 6D61F803
GetSysColor.USER32(00000006), ref: 6D61F80A
GetSysColorBrush.USER32(0000000F), ref: 6D61F817
GetSysColorBrush.USER32(00000006), ref: 6D61F81E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: af20f9e0fdde13b8d1e1aeec7138d6e97e52eb1cc8af88fb3e79f7ede80d2257
Instruction ID: 10d45023be7dddbe3a07501e414e1702db8264db9e0e03a9651b7dbf9948f931
Opcode Fuzzy Hash: af20f9e0fdde13b8d1e1aeec7138d6e97e52eb1cc8af88fb3e79f7ede80d2257
Instruction Fuzzy Hash: C4F0FE719407449BD730BBB34909B47BAE5EFC4B10F02092AD2458B990D6B6E441DF40

Function 6D626A9D Relevance: 9.4, APIs: 6, Instructions: 403COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D626AA7
VariantClear.OLEAUT32(?), ref: 6D626B0C

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

VariantClear.OLEAUT32(?), ref: 6D626D4A
VariantClear.OLEAUT32(?), ref: 6D626DBC
VariantClear.OLEAUT32(?), ref: 6D626FCF

Part of subcall function 6D61C76E: VariantCopy.OLEAUT32(?,?), ref: 6D61C77F

Part of subcall function 6D61CB52: __EH_prolog3.LIBCMT ref: 6D61CB5C
Part of subcall function 6D61CB52: lstrlenA.KERNEL32(?,?,?,00000224), ref: 6D61CB7C
Part of subcall function 6D61CB52: SysAllocStringByteLen.OLEAUT32(?,00000000), ref: 6D61CB84

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Variant$Clear$H_prolog3$AllocByteCopyException@8H_prolog3_StringThrowlstrlen
String ID:
API String ID: 4164898889-0
Opcode ID: 081841b40c696a34ba15376d0318f8d0e6a187a9c7a776807186e072745b0d78
Instruction ID: 0d1592671c0b00341cf4a7f97b9e723ddcacc080a70137be540559f73511705c
Opcode Fuzzy Hash: 081841b40c696a34ba15376d0318f8d0e6a187a9c7a776807186e072745b0d78
Instruction Fuzzy Hash: 12F17C3180815DEADF16DBE4C880AFDBB79BF0D304F118096EA49A7190DF749A88DF65

Function 6D61F26D Relevance: 9.3, APIs: 6, Instructions: 256stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6D61F274
lstrlenA.KERNEL32(00000000,000000FF,00000050,6D62A011,00000000,00000001,?,?,000000FF,?,?,?,?,?,?,00000034), ref: 6D61F2A6

Part of subcall function 6D6061FC: _memcpy_s.LIBCMT ref: 6D60620D

_memset.LIBCMT ref: 6D61F376
VariantClear.OLEAUT32(?), ref: 6D61F450

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClearH_prolog3_catch_Variant_memcpy_s_memsetlstrlen
String ID:
API String ID: 4021759052-0
Opcode ID: 57bdcb0085ca07e58fd5c7174810374c6c0200b86113293a32c4786ed809e4b7
Instruction ID: 7d44b0e0a12d56ca5d04f2f6cc054ae7e1be9e66893075bde7d42b57d3c2becd
Opcode Fuzzy Hash: 57bdcb0085ca07e58fd5c7174810374c6c0200b86113293a32c4786ed809e4b7
Instruction Fuzzy Hash: C3A15D32C0865ADBCF01CFACD844AEEBBB0FF1D314F258159E558A7251C7319A51CBA5

Function 6D626751 Relevance: 9.2, APIs: 6, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D626758
VariantClear.OLEAUT32(?), ref: 6D62681C
CoTaskMemFree.OLE32(?,00000010,6D62694B), ref: 6D6268C9
CoTaskMemFree.OLE32(?,00000010,6D62694B), ref: 6D6268D7
ctype.LIBCPMT ref: 6D6268FF
ctype.LIBCPMT ref: 6D62690D

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: FreeTaskctype$ClearH_prolog3Variant
String ID:
API String ID: 151822039-0
Opcode ID: e415c2a2d440099001246bee1520ab13de7211bf65704c26cf1b16932da214af
Instruction ID: fc6572852329d3ecf13984f6e151240c4333195c6af2476328c9972e40dd075c
Opcode Fuzzy Hash: e415c2a2d440099001246bee1520ab13de7211bf65704c26cf1b16932da214af
Instruction Fuzzy Hash: F5713675A00642CFDB10DFE4C9C496AB7F2BF48304760496CE65A9BA61CB31E884CFA1

Function 6D5FB8D0 Relevance: 9.2, APIs: 6, Instructions: 166COMMON

Download Yara Rule

APIs

SetRect.USER32(?,?,?,?,?), ref: 6D5FB9D9
CreateSolidBrush.GDI32 ref: 6D5FBA7B
SelectObject.GDI32(?,00000000), ref: 6D5FBA85
FillRect.USER32(?,?,00000000), ref: 6D5FBA94
SelectObject.GDI32(?,00000000), ref: 6D5FBA9C
DeleteObject.GDI32(00000000), ref: 6D5FBAA3

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Object$RectSelect$BrushCreateDeleteFillSolid
String ID:
API String ID: 1259150129-0
Opcode ID: fa34c80e8c88d1764c81d1cb92ad89630cc6e847b174e1d5a4d4515f7c4fe399
Instruction ID: afd887895b573b832b035060c5e628936224082e9a0f391b6c0e2e874bd8747d
Opcode Fuzzy Hash: fa34c80e8c88d1764c81d1cb92ad89630cc6e847b174e1d5a4d4515f7c4fe399
Instruction Fuzzy Hash: 0451F071608311DFC304AF16C65846BBBF8FBC6741F00891EFAD192698E336D864CB92

Function 6D613D2B Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D613D32
CoTaskMemFree.OLE32(?,000000FF,?), ref: 6D613DCF
GetParent.USER32(?), ref: 6D613E38
SendMessageA.USER32(?,00000464,00000104,?), ref: 6D613E4C
GetParent.USER32(?), ref: 6D613E7F
SendMessageA.USER32(?,00000465,00000104,?), ref: 6D613E93

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageParentSend$FreeH_prolog3Task
String ID:
API String ID: 526180827-0
Opcode ID: 51c4204df105c26da49b4de9e1eac06aed4cda963d1406a5684eeed383fafc9b
Instruction ID: 99398414a4a85bdcb03d9120c7f8326c76c806d80535eea2ce5f5943f0bfab01
Opcode Fuzzy Hash: 51c4204df105c26da49b4de9e1eac06aed4cda963d1406a5684eeed383fafc9b
Instruction Fuzzy Hash: FA513B70A0421AEFCF08DFA4CD84EAEB775FF48358F114519E226AB5A0DB31A945CF90

Function 6D612190 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D612197
GlobalLock.KERNEL32(?,?,?), ref: 6D61226F
CreateDialogIndirectParamA.USER32(?,?,?,Function_00021BB2,00000000), ref: 6D61229E
DestroyWindow.USER32(00000000), ref: 6D612318
GlobalUnlock.KERNEL32(?), ref: 6D612328
GlobalFree.KERNEL32(?), ref: 6D612331

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Global$CreateDestroyDialogFreeH_prolog3_catchIndirectLockParamUnlockWindow
String ID:
API String ID: 3003189058-0
Opcode ID: f4afe3a9f47482053dd62c36c05a0c6a98d6c9c68dc6859e6b5efb4d63f220e2
Instruction ID: 7e5b8d13e66f0f7bf580bfde26890c86f5d2880febf3fae42b60d0cbc9c52ed0
Opcode Fuzzy Hash: f4afe3a9f47482053dd62c36c05a0c6a98d6c9c68dc6859e6b5efb4d63f220e2
Instruction Fuzzy Hash: DE51DF3190824A9FCF14DFA8CD85AFEBBB5BF0D304F514429E216A7290DB309A41CB64

Function 6D623C52 Relevance: 9.1, APIs: 6, Instructions: 126COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 6D623CF5
_memset.LIBCMT ref: 6D623D27
_memset.LIBCMT ref: 6D623D33
SysFreeString.OLEAUT32(?), ref: 6D623D75
SysFreeString.OLEAUT32(?), ref: 6D623D7F
SysFreeString.OLEAUT32(?), ref: 6D623D89

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: FreeString$_memset$ClearException@8H_prolog3ThrowVariant
String ID:
API String ID: 320298052-0
Opcode ID: 14c6f0378cd909a5d99923b892a4670959a7c21df4412bd3753bee07b22bd40a
Instruction ID: b9bfde90f35046655e2d2c315033ce4cde4329a3f4de1c9d790d43be0b33dd32
Opcode Fuzzy Hash: 14c6f0378cd909a5d99923b892a4670959a7c21df4412bd3753bee07b22bd40a
Instruction Fuzzy Hash: 67413971E01629FFCB01DFA4C884AEEBB79BF48B14F10851AF519A6140C731A689CFA5

Function 6D61F659 Relevance: 9.1, APIs: 6, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D61F67C
SysAllocString.OLEAUT32(00000000), ref: 6D61F6D9
SysAllocString.OLEAUT32(00000000), ref: 6D61F703

Part of subcall function 6D606A83: __EH_prolog3.LIBCMT ref: 6D606A8A

SysAllocString.OLEAUT32(00000000), ref: 6D61F758
SysAllocString.OLEAUT32(00000000), ref: 6D61F787
SysAllocString.OLEAUT32(00000000), ref: 6D61F7BC

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AllocString$H_prolog3_memset
String ID:
API String ID: 842698744-0
Opcode ID: 30879fb9d92e1fd949a7af4f99abae6129fb9f976de2a87d85dab587c76cd754
Instruction ID: a13c777ed4b24d57bee144db64c009c3e1ccddcfcbe36aedebf5bda3e425fdfe
Opcode Fuzzy Hash: 30879fb9d92e1fd949a7af4f99abae6129fb9f976de2a87d85dab587c76cd754
Instruction Fuzzy Hash: 5A41A9719082449FCB24EF79DC80B99B7B4EF58318F0186A9E5599B2A1DF70E9C4CF84

Function 6D6126E9 Relevance: 9.1, APIs: 6, Instructions: 115threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D612637: GetParent.USER32(?), ref: 6D61268B
Part of subcall function 6D612637: GetLastActivePopup.USER32(?), ref: 6D61269C
Part of subcall function 6D612637: IsWindowEnabled.USER32(?), ref: 6D6126B0
Part of subcall function 6D612637: EnableWindow.USER32(?,00000000), ref: 6D6126C3

EnableWindow.USER32(?,00000001), ref: 6D612736
GetWindowThreadProcessId.USER32(?,?), ref: 6D61274A
GetCurrentProcessId.KERNEL32(?,00000000), ref: 6D612754
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 6D61276C
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,00000000), ref: 6D6127E6
EnableWindow.USER32(00000000,00000001), ref: 6D61282B

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID:
API String ID: 1877664794-0
Opcode ID: c61dfb336e375cbe6137e40ae382a5d03c8968231f9452140e8990f202f1fcad
Instruction ID: 588d0f9cc3f5d6a642282e3ef867827c4e86e6430f7e77aef6b55e7782f8813b
Opcode Fuzzy Hash: c61dfb336e375cbe6137e40ae382a5d03c8968231f9452140e8990f202f1fcad
Instruction Fuzzy Hash: 8A41813190821A9BDB25DF69CC86BEB77B4FB0EB54F104694EA55A6180D7B0DAC08F90

Function 6D5FC190 Relevance: 9.1, APIs: 6, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetExitCodeThread.KERNEL32(?,?), ref: 6D5FC1B0
TerminateThread.KERNEL32(?,00000000), ref: 6D5FC1D5
TerminateThread.KERNEL32(?,00000000), ref: 6D5FC1E6
GetExitCodeThread.KERNEL32(?,?), ref: 6D5FC1F4
TerminateThread.KERNEL32(?,00000000), ref: 6D5FC213
TerminateThread.KERNEL32(?,00000000), ref: 6D5FC224

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Thread$Terminate$CodeExit
String ID:
API String ID: 2071244642-0
Opcode ID: 1ee008f5f241e11cbb6351dc686dca6f00891ce4d0db95c07f8ea708d5bbcb62
Instruction ID: 9d4590c49405adadc036c7aab3ed240df316dd3a85ba485aed356ad2d93dae52
Opcode Fuzzy Hash: 1ee008f5f241e11cbb6351dc686dca6f00891ce4d0db95c07f8ea708d5bbcb62
Instruction Fuzzy Hash: 56219771305301ABDB18DB65CC90FAAB3A9AF88714F11892DF2499B5C1CB707945CF59

Function 6D61914F Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D628FDF

Part of subcall function 6D6169B7: __EH_prolog3.LIBCMT ref: 6D6169BE
Part of subcall function 6D6169B7: GetWindowDC.USER32(00000000,00000004,6D60F5F6,?), ref: 6D6169EA

GetClientRect.USER32(?,?), ref: 6D628FFA
GetWindowRect.USER32(?,?), ref: 6D629007

Part of subcall function 6D6165EF: ScreenToClient.USER32(?,?), ref: 6D616600
Part of subcall function 6D6165EF: ScreenToClient.USER32(?,?), ref: 6D61660D

OffsetRect.USER32(?,?,?), ref: 6D62902E

Part of subcall function 6D6161D8: ExcludeClipRect.GDI32(?,?,?,?,?), ref: 6D616201
Part of subcall function 6D6161D8: ExcludeClipRect.GDI32(?,?,?,?,?), ref: 6D616216

OffsetRect.USER32(?,?,?), ref: 6D62904C

Part of subcall function 6D61621F: IntersectClipRect.GDI32(?,?,?,?,?), ref: 6D616248
Part of subcall function 6D61621F: IntersectClipRect.GDI32(?,?,?,?,?), ref: 6D61625D

SendMessageA.USER32(?,00000014,?,00000000), ref: 6D629076

Part of subcall function 6D616A0B: __EH_prolog3.LIBCMT ref: 6D616A12
Part of subcall function 6D616A0B: ReleaseDC.USER32(?,00000000), ref: 6D616A2F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Rect$Clip$ClientH_prolog3$ExcludeIntersectOffsetScreenWindow$MessageReleaseSend
String ID:
API String ID: 2952362992-0
Opcode ID: ceff1e1acc60754bf1de43216f8da45ca2ffe966dfe777bb38d507936e449521
Instruction ID: bbe3e6c9f4407e36ca7a1ae4a6afee6ab7074968f166194baf5cf02f65361f23
Opcode Fuzzy Hash: ceff1e1acc60754bf1de43216f8da45ca2ffe966dfe777bb38d507936e449521
Instruction Fuzzy Hash: 7721197291410AEFCF09DBE4CC54DFEB3B8BF18304F018119E216A7190DB34AA06CB60

Function 6D612637 Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 6D61266A
GetParent.USER32(?), ref: 6D612678
GetParent.USER32(?), ref: 6D61268B
GetLastActivePopup.USER32(?), ref: 6D61269C
IsWindowEnabled.USER32(?), ref: 6D6126B0
EnableWindow.USER32(?,00000000), ref: 6D6126C3

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: ad57b13894df21701ea78585406f2cedfa0d233399275c2ffbceac49fdd7ae94
Instruction ID: 5155230bcadf50a4605708d1b10ce22ff00fce8524e508d41d7d58efaf2611a8
Opcode Fuzzy Hash: ad57b13894df21701ea78585406f2cedfa0d233399275c2ffbceac49fdd7ae94
Instruction Fuzzy Hash: 8711A73258D73397DF322A6E8D85B6B66B86F4FFA4F024110ED14E7294DB60D80146E5

Function 6D633852 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 6D63387A

Part of subcall function 6D62CC57: __getptd.LIBCMT ref: 6D62CC65
Part of subcall function 6D62CC57: __getptd.LIBCMT ref: 6D62CC73

__getptd.LIBCMT ref: 6D633884

Part of subcall function 6D6344AF: __getptd_noexit.LIBCMT ref: 6D6344B2
Part of subcall function 6D6344AF: __amsg_exit.LIBCMT ref: 6D6344BF

__getptd.LIBCMT ref: 6D633892
__getptd.LIBCMT ref: 6D6338A0
__getptd.LIBCMT ref: 6D6338AB
_CallCatchBlock2.LIBCMT ref: 6D6338D1

Part of subcall function 6D62CCFC: __CallSettingFrame@12.LIBCMT ref: 6D62CD48

Part of subcall function 6D633978: __getptd.LIBCMT ref: 6D633987
Part of subcall function 6D633978: __getptd.LIBCMT ref: 6D633995

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 20e5cb3d74571225a5f38a540e410e4720ab5e32bc1a1887e83b3297f5119c7b
Instruction ID: 69eed866f65df2bcaac1f76172d85957de3911bfb9435046336667196fab85a9
Opcode Fuzzy Hash: 20e5cb3d74571225a5f38a540e410e4720ab5e32bc1a1887e83b3297f5119c7b
Instruction Fuzzy Hash: 3D11F3B1D14219DFDF00DFA4C444AADBBB1FF08318F12806AEA18A7251DB799A549F54

Function 6D6201FE Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 6D62020F
GetDlgCtrlID.USER32(00000000), ref: 6D620223
GetWindowLongA.USER32(00000000,000000F0), ref: 6D620233
GetWindowRect.USER32(00000000,?), ref: 6D620245
PtInRect.USER32(?,?,?), ref: 6D620255
GetWindow.USER32(?,00000005), ref: 6D620262

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: dffe149d2970904361edb2b2193ea6acd5b4b795e6079aa3295a1eee5915a26f
Instruction ID: fec488afcf314d8b9f56125050a21be2cb72f78b374fbf5ca11f86395b14bb36
Opcode Fuzzy Hash: dffe149d2970904361edb2b2193ea6acd5b4b795e6079aa3295a1eee5915a26f
Instruction Fuzzy Hash: 6E018F36501116BBCF16EFA68C08FEE3B38EF4A351F008022F91095099D731D9458ED4

Function 6D6256F1 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D6256FB
CoTaskMemAlloc.OLE32(?,?), ref: 6D62581F
_memset.LIBCMT ref: 6D625841
CoTaskMemFree.OLE32(?), ref: 6D625A44

Strings

, xrefs: 6D6258DC

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Task$AllocFreeH_prolog3__memset
String ID:
API String ID: 3303116700-3916222277
Opcode ID: f57c855b068404fe21dc9e45ef202ae5c4f11ca22886b3342a7eb3365062bdac
Instruction ID: 8510dfd1ffa1728587985c78e275419a1b8e5867f03d095bf0aa219f6706b993
Opcode Fuzzy Hash: f57c855b068404fe21dc9e45ef202ae5c4f11ca22886b3342a7eb3365062bdac
Instruction Fuzzy Hash: 98C13B70A04605DFCB24CFA9C884AADB7F5BF8C314F20855DE15ADB295DB71A941CF50

Function 6D603920 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

~_Task_impl.LIBCPMT ref: 6D60395C

Part of subcall function 6D612AD7: __EH_prolog3.LIBCMT ref: 6D612ADE

~_Task_impl.LIBCPMT ref: 6D60396C
~_Task_impl.LIBCPMT ref: 6D60397C
~_Task_impl.LIBCPMT ref: 6D60398C
~_Task_impl.LIBCPMT ref: 6D60399C
~_Task_impl.LIBCPMT ref: 6D6039AC

Part of subcall function 6D61E4F6: __EH_prolog3.LIBCMT ref: 6D61E4FD
Part of subcall function 6D61E4F6: GlobalFree.KERNEL32(?), ref: 6D61E52C

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Task_impl$H_prolog3$FreeGlobal
String ID:
API String ID: 36242457-0
Opcode ID: 466a1379b9c84c49905359e15578dca80fd6b8bc637d3d49873b7fbadc0fe1e3
Instruction ID: 2e2a9eb87ab6a15a65aaaa607e51cdd1700a97d8e3186f52913cfb2b8cd4a723
Opcode Fuzzy Hash: 466a1379b9c84c49905359e15578dca80fd6b8bc637d3d49873b7fbadc0fe1e3
Instruction Fuzzy Hash: 17117C3000C7919ED32DCF28D951B9ABBE4EB5D714F40890EEDAA42280DB74664CCBA7

Function 6D60CDF3 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 244COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D60CE23

Strings

AfxMDIFrame90s, xrefs: 6D60CEC4
AfxFrameOrView90s, xrefs: 6D60CEE9
@, xrefs: 6D60CF2F
@, xrefs: 6D60CFC8

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView90s$AfxMDIFrame90s
API String ID: 2102423945-455206835
Opcode ID: 24ec512162346842b59c9261fd3261c8e632179dfa950c5d2906b130989dce7e
Instruction ID: f590831dcb6c5436a3e72d7c7a3ea7a9bf06977c09565296faa03e3a7d9ffc81
Opcode Fuzzy Hash: 24ec512162346842b59c9261fd3261c8e632179dfa950c5d2906b130989dce7e
Instruction Fuzzy Hash: D4915171C44209BEEB44CFE4C684BEEBFF8AF4C384F118165EA19E6180E7748645CBA4

Function 6D601D50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001009,00000000,00000000), ref: 6D601DAB
SendMessageA.USER32(?,00001031,00000000,?), ref: 6D601E2E
SendMessageA.USER32(?,00001031,00000000,?), ref: 6D601E91
SendMessageA.USER32(?,00001031,?,00000000), ref: 6D601EF7

Strings

F, xrefs: 6D601E9B

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend
String ID: F
API String ID: 3850602802-1304234792
Opcode ID: 2c0c607a56311b3f60dbeea408df2ce449140fe37c8f92b12ca22599f0a7d931
Instruction ID: 6b6c320e4d9a3f454e915d57e18d5cd9f1ca4a44bcfd043548f76d0a56e57d2b
Opcode Fuzzy Hash: 2c0c607a56311b3f60dbeea408df2ce449140fe37c8f92b12ca22599f0a7d931
Instruction Fuzzy Hash: 73515871208301ABD318CF58C980F9BBBB8FF8A758F10461DF6598B290D775E945CBA1

Function 6D605964 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__localtime64_s.LIBCMT ref: 6D605996
__localtime64_s.LIBCMT ref: 6D6059B8
__localtime64_s.LIBCMT ref: 6D6059D7

Strings

%d:%d:%d, xrefs: 6D6059F3

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __localtime64_s
String ID: %d:%d:%d
API String ID: 773316593-941173414
Opcode ID: 1a1a9b39cffdc7069e6e42d8e3d3485058590d083d74770ce079f2353777044b
Instruction ID: e2f9c42a8c8070bd7c4922acf0cfffb7e870b53ffb57d703a073d7d700702181
Opcode Fuzzy Hash: 1a1a9b39cffdc7069e6e42d8e3d3485058590d083d74770ce079f2353777044b
Instruction Fuzzy Hash: 3451E5312487419BD324CB24CD51FEBB7F5BF89714F044A2DEA898B2C1EB71A508CB91

Function 6D60D6ED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetMenuCheckMarkDimensions.USER32 ref: 6D60D705
_memset.LIBCMT ref: 6D60D77D
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 6D60D7E0
LoadBitmapA.USER32(00000000,00007FE3), ref: 6D60D7F8

Strings

, xrefs: 6D60D75E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: 2f5c273970e00a5c52f9ef54decacde7598f1c08b68c3f4870ab0f2bb8c82989
Instruction ID: 9e6f8bf2c7df0603bc3d5dc1cdfed9a056854be20ddeb11800503914bbc77a78
Opcode Fuzzy Hash: 2f5c273970e00a5c52f9ef54decacde7598f1c08b68c3f4870ab0f2bb8c82989
Instruction Fuzzy Hash: 46313B71A042199FEB14CF69CD84BAD7BB4FB89304F5581A6E549DB280DB708989CF50

Function 6D60F533 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D60F53D
GetObjectA.GDI32(?,0000003C,?), ref: 6D60F590
GetDeviceCaps.GDI32(?,0000005A), ref: 6D60F602
OleCreateFontIndirect.OLEAUT32(00000020,6D6501CC), ref: 6D60F62F

Strings

, xrefs: 6D60F59D

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CapsCreateDeviceFontH_prolog3_IndirectObject
String ID:
API String ID: 2429671754-3916222277
Opcode ID: 0f96216147995c56d120f74a99e59fefce6f7fded2a56ffbb74dccfffc3a181f
Instruction ID: d7e9c3861643868d0c2023f049a7594fd3d85c580d1f6af23f92bcb310ac7f33
Opcode Fuzzy Hash: 0f96216147995c56d120f74a99e59fefce6f7fded2a56ffbb74dccfffc3a181f
Instruction Fuzzy Hash: 8F416974D092499FCB14DFE4CA84AECBBB0BF19308F10812AE559EB281E7708A45CF54

Function 6D5F4890 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 6D5F48A5

Part of subcall function 6D614C8F: GetMenuStringA.USER32(?,6D646930,00000000,00000000,00000000), ref: 6D614CAC
Part of subcall function 6D614C8F: GetMenuStringA.USER32(?,6D646930,00000000,00000001,00000000), ref: 6D614CCD

GetMenuItemID.USER32(?,00000000), ref: 6D5F48E0
ModifyMenuA.USER32(?,00000000,00000500,?,?), ref: 6D5F493F
GetSubMenu.USER32(?,00000000), ref: 6D5F494C

Strings

0idm, xrefs: 6D5F4891

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Menu$ItemString$CountModify
String ID: 0idm
API String ID: 2546154514-2767938644
Opcode ID: ad7d534b62c9b300734398969a586ed91956c2bdd31a8b0ee4ce6e358d384701
Instruction ID: dc48bd1ac7e240eb014b11fccc52f7c37980b12d0d9f7238ac3b0f4f716ac85f
Opcode Fuzzy Hash: ad7d534b62c9b300734398969a586ed91956c2bdd31a8b0ee4ce6e358d384701
Instruction Fuzzy Hash: 0931C0752007039BD724DE68C980FB7B3B8EBC9310F01892DF5568B690DB70E846CB60

Function 6D5FBD10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 6D61CBC5: __EH_prolog3.LIBCMT ref: 6D61CBCF
Part of subcall function 6D61CBC5: VariantClear.OLEAUT32 ref: 6D61CBD7

Part of subcall function 6D61C792: _memset.LIBCMT ref: 6D61C79E

Sleep.KERNEL32(00000514,?,?,?,?), ref: 6D5FBDD0
VariantClear.OLEAUT32(?), ref: 6D5FBDF8
VariantClear.OLEAUT32(?), ref: 6D5FBDFF
VariantClear.OLEAUT32(?), ref: 6D5FBE06

Strings

Ozzar, xrefs: 6D5FBDD6

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClearVariant$H_prolog3Sleep_memset
String ID: Ozzar
API String ID: 3417858741-2206785293
Opcode ID: ee00d4a6ab5688bc00d7dfc5027f19529626a953a924f0e14ced32a82e7eeff5
Instruction ID: 2739d0caacf4c2ac353408990fcf00a1522824bcf19851237fafb63ad8ac63df
Opcode Fuzzy Hash: ee00d4a6ab5688bc00d7dfc5027f19529626a953a924f0e14ced32a82e7eeff5
Instruction Fuzzy Hash: 1121947210C3409BC708EBA5C940EAFB7E8AFDC744F418A1DF24683551DB70A909CBA6

Function 6D607955 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 6D607995
GetSystemMetrics.USER32(00000000), ref: 6D6079AD
GetSystemMetrics.USER32(00000001), ref: 6D6079B4

Strings

DISPLAY, xrefs: 6D6079D1
B, xrefs: 6D607974

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: 5862c0310d9a024b3ea3d81e180a9232a4ea1276e3768199d5f14a3fe4693b17
Instruction ID: c48d9ed90f165487d874f174bcdcda755a48340bc6ced5bb8c505fbc74918679
Opcode Fuzzy Hash: 5862c0310d9a024b3ea3d81e180a9232a4ea1276e3768199d5f14a3fe4693b17
Instruction Fuzzy Hash: D011A772940229ABDB159FA58D81AAB7B68FF1E754B008062FD04EF046E7B1D840CBE1

Function 6D611D75 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

Edit, xrefs: 6D611DC9

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 7472d3ec77f4d327e482ac09eb86e2f191cf7fb19bdbead9634e4b811fcb54b0
Instruction ID: c3571b56610a915b7c344b4447aacbebd22a3d01da4a8974b092b4369a400581
Opcode Fuzzy Hash: 7472d3ec77f4d327e482ac09eb86e2f191cf7fb19bdbead9634e4b811fcb54b0
Instruction Fuzzy Hash: 0D110430B4C203ABEF11267ECC04FBABB79BF6E796F008024E5A1D10A0CF69D450C6A0

Function 6D5F4270 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D5F4299
SHBrowseForFolderA.SHELL32 ref: 6D5F42E2
_memset.LIBCMT ref: 6D5F42F9
SHGetPathFromIDListA.SHELL32(00000000,?,?,?,?), ref: 6D5F4307

Strings

qdm, xrefs: 6D5F42C6

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: _memset$BrowseFolderFromListPath
String ID: qdm
API String ID: 1504547611-1291759703
Opcode ID: 3029790aad8e9a9091738d013ee654d4388d682ee5623becc1d062f4d7458439
Instruction ID: 230c85a7dc95dd01ce9767c819f8b87a037ee1be0a3c1b4032d1e738363c528d
Opcode Fuzzy Hash: 3029790aad8e9a9091738d013ee654d4388d682ee5623becc1d062f4d7458439
Instruction Fuzzy Hash: BF115CB15083059FD714DF659484AAFB7E8FBCC308F418D2EE68987240D7349609CF92

Function 6D5FB350 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40processsynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D5FB35F
CreateProcessA.KERNEL32 ref: 6D5FB38C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6D5FB39D

Strings

D, xrefs: 6D5FB384
ProcessView.exe, xrefs: 6D5FB37D

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CreateObjectProcessSingleWait_memset
String ID: D$ProcessView.exe
API String ID: 288585173-1757985642
Opcode ID: 519a20dce409d15ff99ab7c4c3990313d9707cd60172cbc443114e4d23d996f2
Instruction ID: 90d7185e5a938a15efafb7d9bcf440e04aba9d3083b606024174103506d03124
Opcode Fuzzy Hash: 519a20dce409d15ff99ab7c4c3990313d9707cd60172cbc443114e4d23d996f2
Instruction Fuzzy Hash: 66F090B128430076E624EB548C46FDB37655B85F14F908518F3596A1D0DBB4A40C4BDA

Function 6D6335A1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D6335BB

Part of subcall function 6D6344AF: __getptd_noexit.LIBCMT ref: 6D6344B2
Part of subcall function 6D6344AF: __amsg_exit.LIBCMT ref: 6D6344BF

__getptd.LIBCMT ref: 6D6335CC
__getptd.LIBCMT ref: 6D6335DA

Strings

MOC, xrefs: 6D6335AD
csm, xrefs: 6D6335B4

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 6b3fda60975f7601937e8fbda3f8a7ff3e6f826b45d0c04d263418892c7c9922
Instruction ID: 6d80a2af9c166912ce96512077ca59a1d33ffedda0fe8c18c8d3dda871432c6d
Opcode Fuzzy Hash: 6b3fda60975f7601937e8fbda3f8a7ff3e6f826b45d0c04d263418892c7c9922
Instruction Fuzzy Hash: 90E012755183298FE3009B64C084BA876A4FF4D378F1720B1D60C8B222CBA6F8808A52

Function 6D5F4F00 Relevance: 7.6, APIs: 5, Instructions: 125windowCOMMON

Download Yara Rule

APIs

Rectangle.GDI32(?,?,?,?,?), ref: 6D5F4F6B
LoadBitmapA.USER32(?,000000A8), ref: 6D5F4F97
GetObjectA.GDI32(00000000,00000018,?), ref: 6D5F4FB3
CreateCompatibleDC.GDI32(?), ref: 6D5F4FCB

Part of subcall function 6D616BF1: SelectObject.GDI32(?,?), ref: 6D616BFC

StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 6D5F5026

Part of subcall function 6D61690F: DeleteDC.GDI32(00000000), ref: 6D616921

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Object$BitmapCompatibleCreateDeleteLoadRectangleSelectStretch
String ID:
API String ID: 2912706736-0
Opcode ID: c71ea091c9a614ea80467b62d7b4d444729a8629f522993552ccc9054915e5ce
Instruction ID: b8f84a4cdfa25c17b1c0b9e197622187fa6b79abb4c6b1e090f6aff199cedc9e
Opcode Fuzzy Hash: c71ea091c9a614ea80467b62d7b4d444729a8629f522993552ccc9054915e5ce
Instruction Fuzzy Hash: 694125762083419FC314DFA9C945B6BBBE8EBC9714F00891CF69583290DB71E909CBA2

Function 6D60F66C Relevance: 7.6, APIs: 5, Instructions: 123windowthreadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D60F673
SendMessageA.USER32(?,00000138,?,?), ref: 6D60F6EF
GetBkColor.GDI32(?), ref: 6D60F6F8
GetTextColor.GDI32(?), ref: 6D60F704
GetThreadLocale.KERNEL32(0000F1C0,00000014), ref: 6D60F79A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Color$H_prolog3LocaleMessageSendTextThread
String ID:
API String ID: 187318432-0
Opcode ID: 3fc8e44fd6211f36ec5c1d5ed18fae85b8801a5501f9f599e06ceb8b7d97ef88
Instruction ID: 19b407bc61b5706dfc8a8963452fdf49a9d10183031f23d7e7f88a02efeb6619
Opcode Fuzzy Hash: 3fc8e44fd6211f36ec5c1d5ed18fae85b8801a5501f9f599e06ceb8b7d97ef88
Instruction Fuzzy Hash: 0641BD325A4346DFCB19CFA8D900BAA73B0FF0D314F11891AE65A8B2A0D730E840CF49

Function 6D61E3A1 Relevance: 7.6, APIs: 5, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000004), ref: 6D61E453
GlobalLock.KERNEL32(00000000), ref: 6D61E45C
GlobalUnlock.KERNEL32(00000000), ref: 6D61E469
SetPropA.USER32(?,00000000), ref: 6D61E479
GlobalFree.KERNEL32(00000000), ref: 6D61E484

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Global$AllocException@8FreeH_prolog3LockPropThrowUnlock
String ID:
API String ID: 156920121-0
Opcode ID: fb80ffbbafc58bd0f1b590aadfb6da21ea359cea6ffe95d610740855fa1504a3
Instruction ID: 8a700b718fb6fd879501f8baf528b0c53eacf5d02be6f23ad4b04a5a2f09dab4
Opcode Fuzzy Hash: fb80ffbbafc58bd0f1b590aadfb6da21ea359cea6ffe95d610740855fa1504a3
Instruction Fuzzy Hash: 6631AF70608311AFDB149F6AC848A6A7BB4FF4D318B01852CF656CB6A1CB74D841CF90

Function 6D6051D0 Relevance: 7.6, APIs: 5, Instructions: 85threadCOMMON

Download Yara Rule

APIs

ShowCursor.USER32(00000000,73341224,?,?,?,?,?,?,6D641DCA,000000FF), ref: 6D6051FF

Part of subcall function 6D606101: _malloc.LIBCMT ref: 6D60611F

GetSystemMetrics.USER32(00000001), ref: 6D60521A
GetSystemMetrics.USER32(00000000), ref: 6D60521F
GetCursorPos.USER32(?), ref: 6D605227

Part of subcall function 6D60DA40: MoveWindow.USER32(?,?,?,?,?,?), ref: 6D60DA5D

CreateThread.KERNEL32(00000000,00000000,Function_00014F40,?,00000000,00000000), ref: 6D605293

Part of subcall function 6D616928: __EH_prolog3.LIBCMT ref: 6D61692F
Part of subcall function 6D616928: GetDC.USER32(00000000), ref: 6D61695B

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CursorMetricsSystem$CreateH_prolog3MoveShowThreadWindow_malloc
String ID:
API String ID: 3747044625-0
Opcode ID: c88cf430806fa70629c5fd8073c50f2a9ac94e22d37906a7cd04dc80b6793846
Instruction ID: 8b92943007cdc663a25f21ec425da2d455f3cc6d9f1bd94b9a426e70bc8ab8a0
Opcode Fuzzy Hash: c88cf430806fa70629c5fd8073c50f2a9ac94e22d37906a7cd04dc80b6793846
Instruction Fuzzy Hash: 02216DB1644A00AFD715CF6AC944A27BBE8EF89B04F004A1EE615C7661DB76E8418BA1

Function 6D60ABC0 Relevance: 7.6, APIs: 5, Instructions: 80windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D60ABCA
GetTopWindow.USER32(?), ref: 6D60ABEF
GetDlgCtrlID.USER32(00000000), ref: 6D60ABFE
SendMessageA.USER32(00000087,00000087,00000000,00000000), ref: 6D60AC57
GetWindow.USER32(00000000,00000002), ref: 6D60AC97

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$CtrlH_prolog3MessageSend
String ID:
API String ID: 849854284-0
Opcode ID: f4451c27c0db2f371ff873f87999be47e3b7dc42702fbd219429c1f10f0ad789
Instruction ID: 0598b38c460e9a8a3859ac132d91ae43354e9ee6e9d6bf511b47a3d82e3d03d9
Opcode Fuzzy Hash: f4451c27c0db2f371ff873f87999be47e3b7dc42702fbd219429c1f10f0ad789
Instruction Fuzzy Hash: 9221B171804219ABDF19DBA0CA44EEDBB75FF59344F128219E519E3090EB708A41CF50

Function 6D6310D8 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(00000000,6D658468,0000000C,6D6145FC,?,00004000,00000000,?,?), ref: 6D63110C
GetLastError.KERNEL32 ref: 6D631116
__dosmaperr.LIBCMT ref: 6D63111D
__alloc_osfhnd.LIBCMT ref: 6D63113E
__set_osfhnd.LIBCMT ref: 6D631168

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastType__alloc_osfhnd__dosmaperr__set_osfhnd
String ID:
API String ID: 43408053-0
Opcode ID: 254cb4ef4cadc59b418238c9d6897281252e5dc724fc4129478686657f1ed88d
Instruction ID: 8d4768438edbb1f9f0edf06a1f2371dcd12c162e355884599547a99b7ece0f79
Opcode Fuzzy Hash: 254cb4ef4cadc59b418238c9d6897281252e5dc724fc4129478686657f1ed88d
Instruction Fuzzy Hash: E62125309592259FCB028F79C8007D87B70AF4E368F1AA644D9648B1D3C7398182CF85

Function 6D612928 Relevance: 7.6, APIs: 5, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D60D8F2: GetDlgItem.USER32(?,?), ref: 6D60D903

SendMessageA.USER32(?,00000087,00000000,00000000), ref: 6D61296B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D61297F
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6129A5
GetWindow.USER32(?,00000002), ref: 6D6129AF
GetWindowLongA.USER32(00000000,000000F0), ref: 6D6129BF

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$Window$ItemLong
String ID:
API String ID: 1613074769-0
Opcode ID: 6c52803e81dd9eff4746e85798d51f41bbbdd714bf4d1e223e1894390ab74cea
Instruction ID: 3d2ed4279f3d25135f9d85c6d217db42e84c844f8ff8171f487792baab6916ae
Opcode Fuzzy Hash: 6c52803e81dd9eff4746e85798d51f41bbbdd714bf4d1e223e1894390ab74cea
Instruction Fuzzy Hash: 6F115C7120424ABFDF149F69CC81FBA7B69EF4A3A4F108525FD295A2A0C7309951CB90

Function 6D6194B6 Relevance: 7.6, APIs: 5, Instructions: 60windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 6D6194C1
SendMessageA.USER32(?,00000420,00000000,?), ref: 6D6194EC
SendMessageA.USER32(?,0000041F,00000000,?), ref: 6D619505
SendMessageA.USER32(?,0000043A,00000000,00000000), ref: 6D61951D
InvalidateRect.USER32(?,00000000,00000001), ref: 6D619537

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$InvalidateRectWindow
String ID:
API String ID: 3225880595-0
Opcode ID: b06035eb9a91e94698cb0389c7e96a6bf89163f2ed811eeeeb2f34435f54c756
Instruction ID: 15d4bb0a844ee7774a1dcddbfda6523370ccc390044883510fba73f70c51f819
Opcode Fuzzy Hash: b06035eb9a91e94698cb0389c7e96a6bf89163f2ed811eeeeb2f34435f54c756
Instruction Fuzzy Hash: 9F110AB1114308AFEB109F29CC40BB7B7E9FB45754F00442AF999D6150E7B0AC50DB60

Function 6D616F19 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?), ref: 6D616F2B
GetDeviceCaps.GDI32(?,00000058), ref: 6D616F65
GetDeviceCaps.GDI32(?,0000005A), ref: 6D616F6E

Part of subcall function 6D6166BC: MulDiv.KERNEL32(?,00000000,00000000), ref: 6D6166FE
Part of subcall function 6D6166BC: MulDiv.KERNEL32(?,00000000,00000000), ref: 6D61671B

MulDiv.KERNEL32(?,00000060,000009EC), ref: 6D616F92
MulDiv.KERNEL32(?,?,000009EC), ref: 6D616F9D

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: b43d15228c8c03ce85cdb805212e706c2918992faa50f99c776ed5660b6ce0d7
Instruction ID: 4c154d4fed17c1b3261addab31ca1c954fa8c6e0bbe78616ceb482cb86a32af7
Opcode Fuzzy Hash: b43d15228c8c03ce85cdb805212e706c2918992faa50f99c776ed5660b6ce0d7
Instruction Fuzzy Hash: AC11C23A604604EFDB11AFAACC44E1EBBBAEF89750B118419F98557360C771EC418BD0

Function 6D616E89 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?), ref: 6D616E9B
GetDeviceCaps.GDI32(?,00000058), ref: 6D616ED5
GetDeviceCaps.GDI32(?,0000005A), ref: 6D616EDE

Part of subcall function 6D616727: MulDiv.KERNEL32(?,00000000,00000000), ref: 6D616769
Part of subcall function 6D616727: MulDiv.KERNEL32(?,00000000,00000000), ref: 6D616786

MulDiv.KERNEL32(?,000009EC,00000060), ref: 6D616F02
MulDiv.KERNEL32(?,000009EC,?), ref: 6D616F0D

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 574521c7be55fd0c6864c1685e2627bdb715d614fc2268c6c49dd8c9e9d4e7e6
Instruction ID: ec833b1409b45d959ad80c1f58a8a4ecc084eb6f3469aac5ec7e8d3d3806c143
Opcode Fuzzy Hash: 574521c7be55fd0c6864c1685e2627bdb715d614fc2268c6c49dd8c9e9d4e7e6
Instruction Fuzzy Hash: 3B110276204604EFCB11AFAACC44E1EBBB9FF89750B118519F98697360C771EC418F80

Function 6D6018F0 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D60DA80: ShowWindow.USER32(?,?,?,6D6120A5,00000000,0000E146,00000000,?,?,6D5FD30A,73341224), ref: 6D60DA91

SendMessageA.USER32(?,00001036,00000000,00000100), ref: 6D601943
SendMessageA.USER32(?,00001001,00000000,00C0C0C0), ref: 6D601957
SendMessageA.USER32(?,00001026,00000000,00C0C0C0), ref: 6D60196B
SendMessageA.USER32(?,00001024,00000000,00FF0000), ref: 6D60197F
SendMessageA.USER32(?,00001016,00000001,00000000), ref: 6D601990

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$ShowWindow
String ID:
API String ID: 187340077-0
Opcode ID: b3b424b8b1bd3a1dc5d7a8f8b39a26eb52633490a9f34963ff51e23396a3fb33
Instruction ID: f39aafe6debe87c86630d762d4a4542825bb8145c31ac283478b7ebf0b9d1081
Opcode Fuzzy Hash: b3b424b8b1bd3a1dc5d7a8f8b39a26eb52633490a9f34963ff51e23396a3fb33
Instruction Fuzzy Hash: C4015EB26447047EE320AB758CC1FA7F29DFFC8B48F05091DF299A71D1CAF5A8448A64

Function 6D61A8A5 Relevance: 7.6, APIs: 5, Instructions: 55networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D61A8CB
htonl.WS2_32(00000000), ref: 6D61A8DF
htons.WS2_32(?), ref: 6D61A8EB

Part of subcall function 6D61A853: bind.WS2_32(?,?,?), ref: 6D61A861

inet_addr.WS2_32(?), ref: 6D61A907
WSASetLastError.WS2_32(00002726), ref: 6D61A917

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ErrorLast_memsetbindhtonlhtonsinet_addr
String ID:
API String ID: 3310600910-0
Opcode ID: 274e46a5bcfa0ca522b8b958466b6ca03fb931f6546ef2c52f1064c7ace8af9a
Instruction ID: df062dc07fddf9a66220d7b7c9373f2e7cd168327ec688bc7afa0bd44194e654
Opcode Fuzzy Hash: 274e46a5bcfa0ca522b8b958466b6ca03fb931f6546ef2c52f1064c7ace8af9a
Instruction Fuzzy Hash: DC11A971904109ABCB00EFA99C45EEE7B78EF89364F114515E615E7280D7705A49C7A1

Function 6D62000E Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?), ref: 6D62003A
_memset.LIBCMT ref: 6D620057
GetWindowTextA.USER32(00000000,00000000,00000100), ref: 6D620071
lstrcmpA.KERNEL32(00000000,?,?,?), ref: 6D620083
SetWindowTextA.USER32(00000000,?), ref: 6D62008F

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 0d3829e699a6c1c549ae804b87b7b73ec197130ca971281b9a9b86b14fe3be67
Instruction ID: 0cdf2e4b9be14c2107131da970bd7fbfb29517a5f04933116d8d9fa589db96d0
Opcode Fuzzy Hash: 0d3829e699a6c1c549ae804b87b7b73ec197130ca971281b9a9b86b14fe3be67
Instruction Fuzzy Hash: 3F01D6B26012196BDB11EFA68C84FDF777CEF4D740F014065E645D7140DB70DA888BA0

Function 6D6031B0 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

~_Task_impl.LIBCPMT ref: 6D6031EC

Part of subcall function 6D612AD7: __EH_prolog3.LIBCMT ref: 6D612ADE

~_Task_impl.LIBCPMT ref: 6D6031FC
~_Task_impl.LIBCPMT ref: 6D60320C
~_Task_impl.LIBCPMT ref: 6D60321C
~_Task_impl.LIBCPMT ref: 6D60322C

Part of subcall function 6D61E4F6: __EH_prolog3.LIBCMT ref: 6D61E4FD
Part of subcall function 6D61E4F6: GlobalFree.KERNEL32(?), ref: 6D61E52C

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Task_impl$H_prolog3$FreeGlobal
String ID:
API String ID: 36242457-0
Opcode ID: 3c325f0994aa8298ad8be537da23b86f03be2e1e49fab7ef6e303fac57052029
Instruction ID: a8b60867abd1e1ab7a7743b0828ddefe1f6de96a8d5e2022e016c27b747d6100
Opcode Fuzzy Hash: 3c325f0994aa8298ad8be537da23b86f03be2e1e49fab7ef6e303fac57052029
Instruction Fuzzy Hash: 6B01407000C7919FD329CF2CC951B9ABBE4EB5D724F40890EE9AA53281DB74654CC7A7

Function 6D632218 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D632607: _doexit.LIBCMT ref: 6D632613

___set_flsgetvalue.LIBCMT ref: 6D63222A

Part of subcall function 6D6342C1: TlsGetValue.KERNEL32(00000000,6D63444D,?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C,6D634C7F,00000000,00000000), ref: 6D6342CA
Part of subcall function 6D6342C1: __decode_pointer.LIBCMT ref: 6D6342DC
Part of subcall function 6D6342C1: TlsSetValue.KERNEL32(00000000,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C,6D634C7F,00000000,00000000,?,6D63455A,0000000D), ref: 6D6342EB

___fls_getvalue@4.LIBCMT ref: 6D632235

Part of subcall function 6D6342A1: TlsGetValue.KERNEL32(?,?,6D63223A,00000000), ref: 6D6342AF

___fls_setvalue@8.LIBCMT ref: 6D632248

Part of subcall function 6D6342F5: __decode_pointer.LIBCMT ref: 6D634306

GetLastError.KERNEL32(00000000,?,00000000), ref: 6D632251
ExitThread.KERNEL32 ref: 6D632258
GetCurrentThreadId.KERNEL32 ref: 6D63225E
__freefls@4.LIBCMT ref: 6D63227E
__IsNonwritableInCurrentImage.LIBCMT ref: 6D632291

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Value$CurrentThread__decode_pointer$ErrorExitImageLastNonwritable___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 132634196-0
Opcode ID: 51d0b81afd53c4889292ba15a1ad8efca349f833f6c77f6c3201ec0d97502ae5
Instruction ID: db28d9e4903640d04dccfb56d16240ec7dd92105f4310e5b70f598e9fd6ed658
Opcode Fuzzy Hash: 51d0b81afd53c4889292ba15a1ad8efca349f833f6c77f6c3201ec0d97502ae5
Instruction Fuzzy Hash: 6EE0BF31809225678F11B7F28C1999EBA6CAE4E258B536410FF18B3501DBB6A45286E9

Function 6D61A04E Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6D61A346

Part of subcall function 6D606101: _malloc.LIBCMT ref: 6D60611F

GetWindowRect.USER32(?,?), ref: 6D61A2D2

Strings

@, xrefs: 6D61A178

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Rect$EmptyWindow_malloc
String ID: @
API String ID: 299164714-2766056989
Opcode ID: ec1b882c632f140c44d85a7f9ec201b34216bf479e9c13b8ef4488c535ce8cb1
Instruction ID: b9b86378dc489c2d91d28bc7143a3da3782654cff5a88ccae1eed5d26d80ce83
Opcode Fuzzy Hash: ec1b882c632f140c44d85a7f9ec201b34216bf479e9c13b8ef4488c535ce8cb1
Instruction Fuzzy Hash: 73C15D71A0421AAFCF04CFA8CD44AEEB7B5FF4C314F148169E919EB250DB35A945CB90

Function 6D6048B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D61DD13: GetDlgItem.USER32(?,00003020), ref: 6D61DD31
Part of subcall function 6D61DD13: GetDlgItem.USER32(?,00003020), ref: 6D61DD64
Part of subcall function 6D61DD13: GetWindowRect.USER32(00000000,?), ref: 6D61DD72
Part of subcall function 6D61DD13: MapDialogRect.USER32(?,?), ref: 6D61DD96
Part of subcall function 6D61DD13: SetWindowPos.USER32(?,00000000,00000000,00000000,?,00000020,00000016), ref: 6D61DDC3
Part of subcall function 6D61DD13: GetDlgItem.USER32(00000020,?), ref: 6D61DDD8
Part of subcall function 6D61DD13: GetWindowRect.USER32(00000000,?), ref: 6D61DDEA
Part of subcall function 6D61DD13: SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015), ref: 6D61DE09
Part of subcall function 6D61DD13: GetWindowRect.USER32(00000020,?), ref: 6D61DE20

Part of subcall function 6D606101: _malloc.LIBCMT ref: 6D60611F

GetWindowRect.USER32(?,00000000), ref: 6D604907
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D604A65

Part of subcall function 6D60DAC2: EnableWindow.USER32(?,6D646930), ref: 6D60DAD3

Strings

F, xrefs: 6D604956
Setting\Setting.dat, xrefs: 6D6049E0

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Rect$Item$DialogEnableMessageSend_malloc
String ID: F$Setting\Setting.dat
API String ID: 3745574929-3159128719
Opcode ID: 36f72a32e60e81a4f29cf9d3f4055eee261ecac3b30907cc93ccb6fab10d693b
Instruction ID: 4003df5317f16cd7239eb20a0fb34301b5ab2141ba6cdc37ef0e2ce857b3ff3a
Opcode Fuzzy Hash: 36f72a32e60e81a4f29cf9d3f4055eee261ecac3b30907cc93ccb6fab10d693b
Instruction Fuzzy Hash: BB514DB1208340AFD314DF64CD84FABB7E9EF98704F01891DF69A97290DB74A908CB65

Function 6D60CB7F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

__snwprintf_s.LIBCMT ref: 6D60CBCC

Part of subcall function 6D62ED78: __vsnprintf_s_l.LIBCMT ref: 6D62ED8F

__snwprintf_s.LIBCMT ref: 6D60CBFE

Part of subcall function 6D62E99E: __getptd_noexit.LIBCMT ref: 6D62E99E

Strings

Afx:%p:%x:%p:%p:%p, xrefs: 6D60CBF4
Afx:%p:%x, xrefs: 6D60CBC2

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __snwprintf_s$__getptd_noexit__vsnprintf_s_l
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 3087765582-2801496823
Opcode ID: 547bb89000fb38b56eb58b381dc5706eb3d68168319e22a146308c7898853952
Instruction ID: 70c44d77c0bc192f3b7e1cb6976412acc19b464972288688c4e1689407311796
Opcode Fuzzy Hash: 547bb89000fb38b56eb58b381dc5706eb3d68168319e22a146308c7898853952
Instruction Fuzzy Hash: 24314CB1D44209AFCB11DFA9CA4099E7BF8EF5D354F128026FA09A7211E7348950CFA9

Function 6D5F9C80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

~_Task_impl.LIBCPMT ref: 6D5F9D54

Part of subcall function 6D611464: CloseHandle.KERNEL32(00000001,00000000,?,6D611621,00000214,6D6116EB), ref: 6D611475
Part of subcall function 6D611464: GetLastError.KERNEL32(?,00000000,?,6D611621,00000214,6D6116EB), ref: 6D61149A

GetWindowRect.USER32(?,73341224), ref: 6D5F9CEB
ClipCursor.USER32(?), ref: 6D5F9D0C

Strings

Setting\Password.dat, xrefs: 6D5F9CC0

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClipCloseCursorErrorHandleLastRectTask_implWindow
String ID: Setting\Password.dat
API String ID: 3265399267-1754286627
Opcode ID: 4bd8c08fa94fbf71adc4994a7909fb303b4758a96323a389e1ed60333af56816
Instruction ID: 11f3b7dcabbf2643762366ccbbee701955893e6d9e1337f43cecb94693229170
Opcode Fuzzy Hash: 4bd8c08fa94fbf71adc4994a7909fb303b4758a96323a389e1ed60333af56816
Instruction Fuzzy Hash: 2231847004C382DFD334DF25C880FAEB7E4AF99218F108D2DE59946581EB349908CF66

Function 6D605C57 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__localtime64_s.LIBCMT ref: 6D605C89
__localtime64_s.LIBCMT ref: 6D605CAB
__localtime64_s.LIBCMT ref: 6D605CCA

Strings

%d:%d:%d, xrefs: 6D605CE6

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __localtime64_s
String ID: %d:%d:%d
API String ID: 773316593-941173414
Opcode ID: 3805f4447be966ffca4b38663aa1a222844396d7c8622093d5f5a55e099ba8c4
Instruction ID: 0f4dd59fd2c3d3ebe1065b29d62053ee7e7259dd3eb67e8530fbdae494f57d8b
Opcode Fuzzy Hash: 3805f4447be966ffca4b38663aa1a222844396d7c8622093d5f5a55e099ba8c4
Instruction Fuzzy Hash: AF11A2725482009BD324CA648D40FABB3E8BF89714F15471DFA59971C1E775E904CB96

Function 6D627D7C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,?,A"am,6D628008,?,00000000,?,?,6D612241,?), ref: 6D627D98
GlobalLock.KERNEL32(00000000,?,?,?,6D612241,?), ref: 6D627DA6
GlobalUnlock.KERNEL32(?,?,?,?,6D612241,?), ref: 6D627DCF

Strings

A"am, xrefs: 6D627D7E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Global$AllocLockUnlock
String ID: A"am
API String ID: 3972497268-1992308169
Opcode ID: 5f30f9f883eecd2fdad887dd7ffcc0bf006adc857b1e1272559dc707ddb8d216
Instruction ID: aad48a276736cafbc63f804af67d7bd645a6a5503da9f0437aa4d34e2dde2ff4
Opcode Fuzzy Hash: 5f30f9f883eecd2fdad887dd7ffcc0bf006adc857b1e1272559dc707ddb8d216
Instruction Fuzzy Hash: 9BF06276A54201BFCB11AFB9C844DB77BECEF5D6117018839F55AC3500EB71D4448BA0

Function 6D60B3BB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6D620298: EnterCriticalSection.KERNEL32(6D65FF88,?,?,00000000,?,6D61FA4A,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D6202D2
Part of subcall function 6D620298: InitializeCriticalSection.KERNEL32(?,?,?,00000000,?,6D61FA4A,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D6202E4
Part of subcall function 6D620298: LeaveCriticalSection.KERNEL32(6D65FF88,?,?,00000000,?,6D61FA4A,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D6202F1
Part of subcall function 6D620298: EnterCriticalSection.KERNEL32(?,?,?,00000000,?,6D61FA4A,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D620301

Part of subcall function 6D61FA2F: __EH_prolog3_catch.LIBCMT ref: 6D61FA36

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 6D60B404
FreeLibrary.KERNEL32(?), ref: 6D60B414

Strings

HtmlHelpA, xrefs: 6D60B3FE
hhctrl.ocx, xrefs: 6D60B3E8

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 2853499158-63838506
Opcode ID: 13375e1d2bdbe4aa67830e0f52195bf5fc9849cbd3ea759bee5ee2e1728aa22f
Instruction ID: 5bd277ce4a65a47f6326b5e620e81954ba15b6fd4d69fa01a943f4e25385dab6
Opcode Fuzzy Hash: 13375e1d2bdbe4aa67830e0f52195bf5fc9849cbd3ea759bee5ee2e1728aa22f
Instruction Fuzzy Hash: BE012631548707EBDB266FAACE14F9A3BB8EF0C359F00C428F50E81110CB30D4508655

Function 6D633BFF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6D633C12

Part of subcall function 6D633B6D: ___BuildCatchObjectHelper.LIBCMT ref: 6D633BA3

_UnwindNestedFrames.LIBCMT ref: 6D633C29
___FrameUnwindToState.LIBCMT ref: 6D633C37

Strings

csm, xrefs: 6D633C0E, 6D633C23, 6D633C36, 6D633C54, 6D633C64

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 87a894ea43d7e24f0f20ccfed8e4440b6c518d93e1e630481add6b4707b553c5
Instruction ID: 3f670704d91a1b9e944c68385747dae6a61dc38cf14b1997fdc12da9be11d73f
Opcode Fuzzy Hash: 87a894ea43d7e24f0f20ccfed8e4440b6c518d93e1e630481add6b4707b553c5
Instruction Fuzzy Hash: 3C012F7140422ABBDF124E55CD40EEA7F6AEF1C394F029014FE1C64120DB32D8B1EBA9

Function 6D61EB40 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?), ref: 6D61EB69
GetProcAddress.KERNEL32(00000000,AfxmReleaseManagedReferences), ref: 6D61EB79

Strings

mfcm90.dll, xrefs: 6D61EB58
AfxmReleaseManagedReferences, xrefs: 6D61EB73

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AfxmReleaseManagedReferences$mfcm90.dll
API String ID: 1646373207-1752160237
Opcode ID: fda71f2f7669df23a4092882a096685b9d69cb9aa66634c7c9fc6ff93dee7c2e
Instruction ID: 9277319661a94950b2b096a9fd181e6a4da6eef9fcbcfa79d6b836e472008ee3
Opcode Fuzzy Hash: fda71f2f7669df23a4092882a096685b9d69cb9aa66634c7c9fc6ff93dee7c2e
Instruction Fuzzy Hash: 0AF08271700219AB9B00EFAA9C44EBFBBBCEF8D6547418829F512E7141CB70D905CBA0

Function 6D639248 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,6D62DB3A), ref: 6D63924D
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 6D63925D

Strings

KERNEL32, xrefs: 6D639248
IsProcessorFeaturePresent, xrefs: 6D639257

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 00de30cb68f20d43a89cb06e2cda935be7dfc62dfac17c6dd48979d8d076e3ef
Instruction ID: f5c92306233ca90d5029c6ebdcbab9c5c0acd8d855f188ab226799f7b27576a1
Opcode Fuzzy Hash: 00de30cb68f20d43a89cb06e2cda935be7dfc62dfac17c6dd48979d8d076e3ef
Instruction Fuzzy Hash: 88F03630510D1AD3EF00BBA59C1D7AF7A79BF86745F825490D192E1085DF7080B4C681

Function 6D5FBFF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,6D5FC0B9,73341224,?), ref: 6D5FC003
LoadLibraryA.KERNEL32(?,?,6D5FC0B9,73341224,?), ref: 6D5FC014
GetProcAddress.KERNEL32(00000000,ImageList_ReplaceIcon), ref: 6D5FC02E

Strings

ImageList_ReplaceIcon, xrefs: 6D5FC028

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: ImageList_ReplaceIcon
API String ID: 310444273-3264144174
Opcode ID: 09b4524a135b8538aa4a0e73a6b0598506d525286a1f20242f2c76356b40d8e2
Instruction ID: ec65b02f61dfcdbb10261e62703bd6d498b09aee6b4ab26b1efa9cd33f046659
Opcode Fuzzy Hash: 09b4524a135b8538aa4a0e73a6b0598506d525286a1f20242f2c76356b40d8e2
Instruction Fuzzy Hash: EBF0B275905B01CFC725DFA9C558A97BBF8AB0A711B00D82EE49AC7A01D734E882CF54

Function 6D626193 Relevance: 6.2, APIs: 4, Instructions: 174windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 6D6261C6
GetDesktopWindow.USER32 ref: 6D6261D6
GetWindowRect.USER32(?,?), ref: 6D6261EF
GetWindowRect.USER32(?,?), ref: 6D6261FB

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Rect$DesktopException@8H_prolog3ThrowVisible
String ID:
API String ID: 584671360-0
Opcode ID: 02ff0926689bc3d2f68afd653131849708041e97e8eb9e9ef176bbe703359fbd
Instruction ID: 666fa22a4b04ee022c63afbb862a7066b10aac1072e9099908f6c2e8c3449518
Opcode Fuzzy Hash: 02ff0926689bc3d2f68afd653131849708041e97e8eb9e9ef176bbe703359fbd
Instruction Fuzzy Hash: 7A51C876A0410AEFDB04DFE8C984CAEB7B9EF8C304B114558E606E7255CB31AE45CFA4

Function 6D5F89A0 Relevance: 6.2, APIs: 4, Instructions: 172memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 6D5F8A30
??3@YAXPAX@Z.MSVCRT ref: 6D5F8B7C
GetProcessHeap.KERNEL32(00000000,6D5F9BB7,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D5F8BC9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D5F8BD0

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ??3@Heap$FreeProcess
String ID:
API String ID: 834397476-0
Opcode ID: 1ae488f856851d8a161341c5deaebe9cac7888f6e029eef701a3ebd419981f4a
Instruction ID: dc6788e4a911b8fbacac579532151c9017a257a57412783e0f97af38c6b89c36
Opcode Fuzzy Hash: 1ae488f856851d8a161341c5deaebe9cac7888f6e029eef701a3ebd419981f4a
Instruction Fuzzy Hash: DA61A33130030B8FCB18CF6EC6D6B65B7B9FB8A304B018529D5159B6A5EB70B985CF90

Function 6D63186B Relevance: 6.1, APIs: 4, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

__flush.LIBCMT ref: 6D63192F
__fileno.LIBCMT ref: 6D63194F
__locking.LIBCMT ref: 6D631956
__flsbuf.LIBCMT ref: 6D631981

Part of subcall function 6D62E99E: __getptd_noexit.LIBCMT ref: 6D62E99E

Part of subcall function 6D6334CC: __decode_pointer.LIBCMT ref: 6D6334D7

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 82e00def477d3eff829d4c1c94377a47231ceae118c6330db0b98d7e767540c1
Instruction ID: e9b46d17c746f27afcdfcdada74b039e7295aafecdc262b33df9d8260f286822
Opcode Fuzzy Hash: 82e00def477d3eff829d4c1c94377a47231ceae118c6330db0b98d7e767540c1
Instruction Fuzzy Hash: 3641D331E04A25DBDB05CFA988805AEB7B5FF98360F23E229D469971C0D778DA41CB54

Function 6D60F1DF Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99410675564fd362292f905f580dd60da46244048487a725a3f7f74012c4c2a3
Instruction ID: 662c9ead9f3f192d78d6785beafa71255fba3672e8c60b88331253ea4a3468f8
Opcode Fuzzy Hash: 99410675564fd362292f905f580dd60da46244048487a725a3f7f74012c4c2a3
Instruction Fuzzy Hash: 2D517F75A14216EFDB08DFE4C680AAEBBB8FF0C350F1180AAE915D7251D770E940CB94

Function 6D5F50A0 Relevance: 6.1, APIs: 4, Instructions: 132windowCOMMON

Download Yara Rule

APIs

LoadBitmapA.USER32(?,000000A9), ref: 6D5F50EE
GetObjectA.GDI32(?,00000018,?), ref: 6D5F510A
CreateCompatibleDC.GDI32(?), ref: 6D5F512E
StretchBlt.GDI32(?,00000000,00000000,00000018,?,?,00000000,00000000,?,?,00CC0020), ref: 6D5F5170

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: BitmapCompatibleCreateLoadObjectStretch
String ID:
API String ID: 1313918214-0
Opcode ID: f027dd15851e7f72a55e958ad70af8d8783762d28733f168171d29578c7f2b9d
Instruction ID: 1e9c29c4c695e9021b01ac2fe3ae3bb7fe74742516a13e668307b53f959c277e
Opcode Fuzzy Hash: f027dd15851e7f72a55e958ad70af8d8783762d28733f168171d29578c7f2b9d
Instruction Fuzzy Hash: 3E4129B52083019FC304DFA9C880E6BB7F9FB99714F118A1CF69587291DB35E905CBA6

Function 6D627918 Relevance: 6.1, APIs: 4, Instructions: 131timeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D62792F

Part of subcall function 6D60711B: __cftof.LIBCMT ref: 6D60712C

GetFileTime.KERNEL32(?,?,?,?), ref: 6D627966
GetFileSizeEx.KERNEL32(?,?), ref: 6D62797E

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: File$SizeTime__cftof_memset
String ID:
API String ID: 2749391713-0
Opcode ID: bde6d0201875f6de4ad8cb1679dc57ff3df844aa2a1ff1eb787044f53a27b997
Instruction ID: aeea116480d2c59a54e0baac5c446ab7669e2a1685efe9168a9d41140a6e701a
Opcode Fuzzy Hash: bde6d0201875f6de4ad8cb1679dc57ff3df844aa2a1ff1eb787044f53a27b997
Instruction Fuzzy Hash: ED512C719147069FCB20CF69C840EAAB7F8BF1D320B018A2DE5AAD7690E730E544CF64

Function 6D613FDB Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D613FE2
PathFindExtensionA.SHLWAPI(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000008,6D6144C8,?), ref: 6D614047
GetParent.USER32(?), ref: 6D6140BD
SendMessageA.USER32(?,00000464,00000104,?), ref: 6D6140D5

Part of subcall function 6D613EE8: __EH_prolog3.LIBCMT ref: 6D613EEF
Part of subcall function 6D613EE8: CoTaskMemFree.OLE32(?,?), ref: 6D613F33

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3$ExtensionFindFreeMessageParentPathSendTask
String ID:
API String ID: 3379981378-0
Opcode ID: 17f2383b80c184bb517159c6199b25e0d8637a811b5afc0f9c42d8239fef91f4
Instruction ID: 0772bd06c3dcbbe6e7b5f69623d9ea5e4605f4fc792393948a666702644ec576
Opcode Fuzzy Hash: 17f2383b80c184bb517159c6199b25e0d8637a811b5afc0f9c42d8239fef91f4
Instruction Fuzzy Hash: F841DE709082469BCB18DFA8CC80AFEB7B4BF5D35CF11851DE2166B180CBB0A945CB55

Function 6D60DEF3 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D60DF29
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D60DF8E
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D60DFD3
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D60DFFC

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: edabed075d857c18d94d52e680f7000b606210d5f73de0e54c4577dd44576228
Instruction ID: 9e6242605eb86a26f52f27556c0bb8378efa385091e2ce781de4016d8e5b6f9c
Opcode Fuzzy Hash: edabed075d857c18d94d52e680f7000b606210d5f73de0e54c4577dd44576228
Instruction Fuzzy Hash: C1319C7054421AEFCB19DF55C980EAE7BA9EF8D394F10C166F6099B610EB70D980CF90

Function 6D63E798 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6D63E7CC
__isleadbyte_l.LIBCMT ref: 6D63E800
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,?,00000000,00000000,?,?,?,?,00000000,00000000,00000020), ref: 6D63E831
MultiByteToWideChar.KERNEL32(00000080,00000009,00000000,00000001,00000000,00000000,?,?,?,?,00000000,00000000,00000020), ref: 6D63E89F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 94096f5e1d1d61d0ae8d32c4de63e28a2b5c4eae773dfbf1594a4bee2a5f4c74
Instruction ID: abe19d9793d8bb961e5182cfe670297d0349ed04160bad679a4a8acb074c0ee5
Opcode Fuzzy Hash: 94096f5e1d1d61d0ae8d32c4de63e28a2b5c4eae773dfbf1594a4bee2a5f4c74
Instruction Fuzzy Hash: 69319F31E142A6EFDB11DF64C880ABE7BB9BF09310F129A69E465CB192D331DD41CB60

Function 6D620870 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

__msize.LIBCMT ref: 6D620903
__msize.LIBCMT ref: 6D620926
_malloc.LIBCMT ref: 6D62093E
_malloc.LIBCMT ref: 6D620953

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: 9480e294dee3f9ab85159278eb2f9ac36a8c5d899c636c3fc29106832ffb5ced
Instruction ID: 100eb46c5630fcdb61bb2b431424f9c8ca4ed84b10897208327ffa67cdf84f95
Opcode Fuzzy Hash: 9480e294dee3f9ab85159278eb2f9ac36a8c5d899c636c3fc29106832ffb5ced
Instruction Fuzzy Hash: B221E4715086129FDB15DF36C8A0A6B7BA4AF4C724B128429D92ECB151DB34E890CFC4

Function 6D61B15C Relevance: 6.1, APIs: 4, Instructions: 89networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D61B166

Part of subcall function 6D61FA2F: __EH_prolog3_catch.LIBCMT ref: 6D61FA36

WSAStartup.WS2_32(00000101,?), ref: 6D61B1A6

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

WSACleanup.WS2_32 ref: 6D61B1F5
WSASetLastError.WS2_32(0000276C), ref: 6D61B200

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CleanupErrorException@8H_prolog3H_prolog3_H_prolog3_catchLastStartupThrow
String ID:
API String ID: 1416897528-0
Opcode ID: 83c2409c0c440c103697dca299c30895610c3dca88764f6ea8e42f45c39d2df0
Instruction ID: 16e087e2a8dde0bb9eeb5e316abfcca738ee07f67af819b4c702ef9f088619dc
Opcode Fuzzy Hash: 83c2409c0c440c103697dca299c30895610c3dca88764f6ea8e42f45c39d2df0
Instruction Fuzzy Hash: 7031D171B5C302ABDF14EFBC8D862AD76B16F0F314F12853DD26AD6680D7B095848B16

Function 6D62A224 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 6D62A2BF

Part of subcall function 6D60DCF3: GetWindow.USER32(?,?), ref: 6D60DCFF

GetParent.USER32(?), ref: 6D62A247
GetWindowLongA.USER32(?,000000EC), ref: 6D62A281
IsWindowVisible.USER32(?), ref: 6D62A29A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$LongParentVisible
String ID:
API String ID: 506644340-0
Opcode ID: f864d70dde5d68c410925a5a1f6eaf190a0426f53dedcc45d5338dc0aff40ab6
Instruction ID: 2f2cfbd039248980e3b03dcac9e77238684264ba9c44eb5e2715249b6b221a87
Opcode Fuzzy Hash: f864d70dde5d68c410925a5a1f6eaf190a0426f53dedcc45d5338dc0aff40ab6
Instruction Fuzzy Hash: 69112732686A116BDB129A658C04FBE367CBF4DB90F0A4214FD05A7190DBE2DC008ED4

Function 6D615DBE Relevance: 6.1, APIs: 4, Instructions: 76synchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D615DC5

Part of subcall function 6D615C8E: GetCurrentThreadId.KERNEL32 ref: 6D615CA1
Part of subcall function 6D615C8E: SetWindowsHookExA.USER32(000000FF,Function_00025AF6,00000000,00000000), ref: 6D615CB1

SetEvent.KERNEL32(?,00000060), ref: 6D615E76
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6D615E7F
CloseHandle.KERNEL32(?), ref: 6D615E86

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CloseCurrentEventH_prolog3_catchHandleHookObjectSingleThreadWaitWindows
String ID:
API String ID: 1532457625-0
Opcode ID: 2a78054430a6951198080f0c3ec78f1b964953b20169d7ca5c9a98e5f6bcbeba
Instruction ID: ea3ca8668a23e2e6e0ff2af8ff04073d63026d1fce22fa49fd9b2e15526d8b61
Opcode Fuzzy Hash: 2a78054430a6951198080f0c3ec78f1b964953b20169d7ca5c9a98e5f6bcbeba
Instruction Fuzzy Hash: 20315E70909305DFCB15EFB8CA849ADBBB0BF0C314B01855DE15A976A1DB30EA41CF95

Function 6D613EE8 Relevance: 6.1, APIs: 4, Instructions: 75windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D613EEF
CoTaskMemFree.OLE32(?,?), ref: 6D613F33
GetParent.USER32(?), ref: 6D613F8B
SendMessageA.USER32(?,00000464,00000104,00000000), ref: 6D613FA1

Part of subcall function 6D60731B: __EH_prolog3.LIBCMT ref: 6D607322

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3$FreeMessageParentSendTask
String ID:
API String ID: 2222212998-0
Opcode ID: f701974e2f9f3d88a0eba5730025f1ee1298f4df37acc8879ea4e6e0990fa5b5
Instruction ID: 9d15e7776c7b305d06a3a0c9d20f6fefe2ee136a6e1b2ff1cbd634c03c95bc16
Opcode Fuzzy Hash: f701974e2f9f3d88a0eba5730025f1ee1298f4df37acc8879ea4e6e0990fa5b5
Instruction Fuzzy Hash: 8F218F7190460A9FCF18DFA4CD44EAEB7B4FF48318B11461DE2666B1A0DB30A941CF51

Function 6D60E546 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

CharNextA.USER32(?), ref: 6D60E59F

Part of subcall function 6D62DFE0: __ismbcspace_l.LIBCMT ref: 6D62DFEA

CharNextA.USER32(00000000), ref: 6D60E5BC
__wcstoi64.LIBCMT ref: 6D60E5E7
__wcstoui64.LIBCMT ref: 6D60E5EE

Part of subcall function 6D630791: strtoxl.LIBCMT ref: 6D6307B3

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CharNext$__ismbcspace_l__wcstoi64__wcstoui64strtoxl
String ID:
API String ID: 1826523842-0
Opcode ID: 63edfe6bcc769178fd677ecc3eda4b6ab60ca665ded11718c4118192cd275639
Instruction ID: 8a55fb2e41d86acefaa3b32b92ddc7ca440e64f53c700ca68a60cc22fbab659b
Opcode Fuzzy Hash: 63edfe6bcc769178fd677ecc3eda4b6ab60ca665ded11718c4118192cd275639
Instruction Fuzzy Hash: E5216A715082269BCB169F798E40BEA77F8AF4D340F120865E594D7141FB71C980CFA4

Function 6D624BCC Relevance: 6.1, APIs: 4, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32 ref: 6D624BF0
CoTaskMemFree.OLE32(?), ref: 6D624C74

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: 30b61d5dddc23ec4814e99886ef430d1acc50581528c7b36faef192b6ed0df10
Instruction ID: a7c947a2ffc5beb8294384c2b1504414b4806233452f44755720f10aa4d04fd7
Opcode Fuzzy Hash: 30b61d5dddc23ec4814e99886ef430d1acc50581528c7b36faef192b6ed0df10
Instruction Fuzzy Hash: AD112C303007069BEB159F6EC988BB977A8FF2E795B108418E979EB150CBB5F840CE50

Function 6D61E644 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000005), ref: 6D61E664
LoadResource.KERNEL32(?,00000000), ref: 6D61E679
LockResource.KERNEL32(00000000), ref: 6D61E68B
GlobalFree.KERNEL32(?), ref: 6D61E6C5

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeGlobalLoadLock
String ID:
API String ID: 3898064442-0
Opcode ID: f3cd273a05c812d237e378f23cd13d8820e2fe011ce8f7b7502ce9e6d4b38201
Instruction ID: 66c52bb98f51e47fe61f0b16e067ab9c4cf81d32429b0a7236b4efb6d85aa131
Opcode Fuzzy Hash: f3cd273a05c812d237e378f23cd13d8820e2fe011ce8f7b7502ce9e6d4b38201
Instruction Fuzzy Hash: B611D035148701AFCB029FAECC44B6A7BF9EF89365F428029E919C7A12DB74D4018F90

Function 6D6120AA Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 6D6120D2
LoadResource.KERNEL32(?,00000000), ref: 6D6120DA
LockResource.KERNEL32(00000000), ref: 6D6120EC
FreeResource.KERNEL32(00000000), ref: 6D61213A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 01cab11b79d42b552175a4778659404f3cb8536fe0f40b55753e4c378dfbfa0d
Instruction ID: b312f3c82aff423a0e53d8e27d361c1ef7332a6d11efb7ae0c307ebe7f80c4db
Opcode Fuzzy Hash: 01cab11b79d42b552175a4778659404f3cb8536fe0f40b55753e4c378dfbfa0d
Instruction Fuzzy Hash: 58118B35104756EBDB21DFAACC46ABAB7B4FF0E325F108029EA5253540E774E984DBA0

Function 6D607195 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D60719C

Part of subcall function 6D606101: _malloc.LIBCMT ref: 6D60611F

__CxxThrowException@8.LIBCMT ref: 6D6071D2
FormatMessageA.KERNEL32(00001100,00000000,?,00000800,73341224,00000000,00000000,00000000,?,?,6D6556A0,00000004,6D5F1016,?,6D5F16EB,80070057), ref: 6D6071FD

Part of subcall function 6D60711B: __cftof.LIBCMT ref: 6D60712C

LocalFree.KERNEL32(73341224,73341224), ref: 6D607226

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow__cftof_malloc
String ID:
API String ID: 1808948168-0
Opcode ID: a8637397a068fc2cca779243698bd1c9e3492ec91b71e1ea87228cf58c057c08
Instruction ID: 6c31ff0aab5f7c73016f057c583b7dd53a4a76018406a8d913e4239c05b7d991
Opcode Fuzzy Hash: a8637397a068fc2cca779243698bd1c9e3492ec91b71e1ea87228cf58c057c08
Instruction Fuzzy Hash: 5C115E71A1824ABFDB05DFA4CC80AAA3BA8FB0C354F158569F628CA290D7319950CB64

Function 6D617C86 Relevance: 6.1, APIs: 4, Instructions: 57threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D617C8D

Part of subcall function 6D615A25: __EH_prolog3.LIBCMT ref: 6D615A2C

__strdup.LIBCMT ref: 6D617CAF
GetCurrentThread.KERNEL32 ref: 6D617CDC
GetCurrentThreadId.KERNEL32 ref: 6D617CE5

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: da38ba62e5af6287eeadd748142c44418c5d8d784721eb83b1f7b4bcfbce0d84
Instruction ID: ad68b975861dae2edc7fe7688ab518759510ac4bd10c250e5af80a2fc81c0336
Opcode Fuzzy Hash: da38ba62e5af6287eeadd748142c44418c5d8d784721eb83b1f7b4bcfbce0d84
Instruction Fuzzy Hash: DA217BB0804B40DFC7219F7AC54529AFAF8BFA8704F11891FD1AAC7721DBB0A1408F59

Function 6D62837E Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 6D6283B9
RegCloseKey.ADVAPI32(00000000), ref: 6D6283C2
swprintf.LIBCMT ref: 6D6283DF
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 6D6283F0

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: 902ea93915c79e84c60d82ee5d58c0c93f7859f728445eaa70c10a29e35ea9a5
Instruction ID: 9e81727b94e7c0a494c1dad5252c44e482c1f801d038d961b310714131678068
Opcode Fuzzy Hash: 902ea93915c79e84c60d82ee5d58c0c93f7859f728445eaa70c10a29e35ea9a5
Instruction Fuzzy Hash: 5401A172500209ABCB109EA98C40FAF7BBCEF49754F014419FA01A7251DB70EA058BE4

Function 6D60BEA3 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 6D60BECF
SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 6D60BEFA
GetCapture.USER32 ref: 6D60BF0C
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 6D60BF1B

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 5d3393e8df4cbdd3c717338f7d6e7658217bd9fcf8c08e1243ad6e531df68ff3
Instruction ID: f99d69f28fcf879081932bda6428ee19673da1fb012b5ac53ec55e5d1ebc844a
Opcode Fuzzy Hash: 5d3393e8df4cbdd3c717338f7d6e7658217bd9fcf8c08e1243ad6e531df68ff3
Instruction Fuzzy Hash: 9B0171313502457BDF251B668C8DFAB3E3ADBCEB50F114478F7049A1D6CAA18840DA60

Function 6D61B95E Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 6D61B984
LoadResource.KERNEL32(?,00000000), ref: 6D61B990
LockResource.KERNEL32(00000000), ref: 6D61B99E
FreeResource.KERNEL32(00000000), ref: 6D61B9CC

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: ec3caedc69bb32fbc0378ca2ba2d3e8df81327a4b18b1a9b3549dd08f17aec9d
Instruction ID: 316c626cb7bbb5ac5030e8c6e42cfba83f5f6dae8a2a6d782ed95b2364ea33bf
Opcode Fuzzy Hash: ec3caedc69bb32fbc0378ca2ba2d3e8df81327a4b18b1a9b3549dd08f17aec9d
Instruction Fuzzy Hash: 24118871600206EFDB019FAAC888BAE7BB8FF4A361F00C069F91597250CB70D900CFA0

Function 6D6114E9 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 6D606101: _malloc.LIBCMT ref: 6D60611F

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 6D61151D
GetCurrentProcess.KERNEL32(?,00000000), ref: 6D611523
DuplicateHandle.KERNEL32(00000000), ref: 6D611526
GetLastError.KERNEL32(?), ref: 6D611541

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast_malloc
String ID:
API String ID: 3704204646-0
Opcode ID: 2cbcb60036bd6ce452d8597b997219a66d52ec208f6f59296241dac1c0611415
Instruction ID: 25773651a000e0f9e8ae3d518a56efaffa5dd51446c82d09627e0e85243a57e1
Opcode Fuzzy Hash: 2cbcb60036bd6ce452d8597b997219a66d52ec208f6f59296241dac1c0611415
Instruction Fuzzy Hash: 3D018471704201BBDB109BAACC49F9A7BA9DB88754F108461F609CB240EB79DC41CBA0

Function 6D62B97D Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

WindowFromPoint.USER32(?,?), ref: 6D62B996
GetParent.USER32(00000000), ref: 6D62B9A4
ScreenToClient.USER32(00000000,?), ref: 6D62B9C5
IsWindowEnabled.USER32(00000000), ref: 6D62B9DE

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$ClientEnabledFromParentPointScreen
String ID:
API String ID: 1871804413-0
Opcode ID: 2a65b59f87f91df5cece75da956eec04361c3fc85d6983049c1fe5d7946cc6d1
Instruction ID: e6d0296093e8f99ae82d9f5403f059662662096c4a1c156b7285974dfc3dcbbf
Opcode Fuzzy Hash: 2a65b59f87f91df5cece75da956eec04361c3fc85d6983049c1fe5d7946cc6d1
Instruction Fuzzy Hash: E4018436A00905BBCB065B9DCC09EAE7A7DFF8E610B118059F915D7308DB71C900CB94

Function 6D60AA45 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(00000000), ref: 6D60AA55
GetTopWindow.USER32(00000000), ref: 6D60AA94
GetWindow.USER32(00000000,00000002), ref: 6D60AAB2

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: e989de6a576eb3f80216aac6999cd073fd5e58970456df0502f2ab99a800fa7c
Instruction ID: 5897aa1850ccc2cb803c928fc6de0da197a0e2068db614413b8d87426d3fcd9c
Opcode Fuzzy Hash: e989de6a576eb3f80216aac6999cd073fd5e58970456df0502f2ab99a800fa7c
Instruction Fuzzy Hash: 8A01E53200021ABFCF0AAFA58E04EEF3B6AAF4D394F018110FA15550A0C776C961EBA5

Function 6D61ED99 Relevance: 6.0, APIs: 4, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(00000000), ref: 6D61EDB1
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,6D61F0A4,?,00000018,6D61F3E2,?,?,?), ref: 6D61EDCA
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 6D61EDD1
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6D61F0A4,?,00000018,6D61F3E2,?,?,?), ref: 6D61EDF0

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Byte$CharMultiStringWide$Alloc
String ID:
API String ID: 3384502665-0
Opcode ID: 5d77a6ca54a0d9a031ea3c9a0b76d61f8aba0aa6aba1262a0687b56ff9793c71
Instruction ID: 238d54372e3cf4d341e3d2e678e61fc95422630a4243a5ba4136d0cf8cca1463
Opcode Fuzzy Hash: 5d77a6ca54a0d9a031ea3c9a0b76d61f8aba0aa6aba1262a0687b56ff9793c71
Instruction Fuzzy Hash: F6F0E175906128BF9B226BA68C48CDFBE7DEF8B7E47108115F90892110D6718A55D6F0

Function 6D61484B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

_ftell.LIBCMT ref: 6D614855
_fseek.LIBCMT ref: 6D61487B
_ftell.LIBCMT ref: 6D614899
_fseek.LIBCMT ref: 6D6148AC

Part of subcall function 6D62E9B1: __getptd_noexit.LIBCMT ref: 6D62E9B1

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: _fseek_ftell$__getptd_noexit
String ID:
API String ID: 447802652-0
Opcode ID: 7525f966b1003aafb69fa3024d5d807435651de4017d63297074a7f94b64618d
Instruction ID: 3d85d266e72239ccb95d609fc8ecd2639649c30acebe9bcbfd1ba353f570e194
Opcode Fuzzy Hash: 7525f966b1003aafb69fa3024d5d807435651de4017d63297074a7f94b64618d
Instruction Fuzzy Hash: 0C01F432A1C7602FD66016399C41F0737A59F8D338F120A39FB28A70E0EB92EC10CA50

Function 6D60A3C1 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 6D60A3CE
GetTopWindow.USER32(00000000), ref: 6D60A3E1

Part of subcall function 6D60A3C1: GetWindow.USER32(00000000,00000002), ref: 6D60A428

GetTopWindow.USER32(?), ref: 6D60A411

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 3fc3a517996aef2cc97809e1ba749ddaafb5514d1d4fcb7c9ee63280c56b60d5
Instruction ID: 6b736d345f924751d689eb6368a77ed2d6c80d87547f21c24d06745cef58dcfa
Opcode Fuzzy Hash: 3fc3a517996aef2cc97809e1ba749ddaafb5514d1d4fcb7c9ee63280c56b60d5
Instruction Fuzzy Hash: FD01A23A04562BBBCF1A2F628E08FDE3A39AF4D3D8F01C120FD1491100D735C51196D5

Function 6D6042B0 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D6042CA
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D60431F
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D604331
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D604343

Part of subcall function 6D60DAC2: EnableWindow.USER32(?,6D646930), ref: 6D60DAD3

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$EnableWindow
String ID:
API String ID: 1554173715-0
Opcode ID: c770ab0377c46d3a02e64e59b8c5075fe0aa22618eb1edc189dd59e30023574d
Instruction ID: ed99277ba6094083089c93fb2876bac4fb43becb5b19100d25775d9249981b9c
Opcode Fuzzy Hash: c770ab0377c46d3a02e64e59b8c5075fe0aa22618eb1edc189dd59e30023574d
Instruction Fuzzy Hash: C0014F313C4701BAF638E6B5DD52FD672946F98B10F118919F359AB4C0DEE07840CA68

Function 6D639113 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6D639139

Part of subcall function 6D638F5E: __fltout2.LIBCMT ref: 6D638F8A

__cftog_l.LIBCMT ref: 6D63915F
__cftoe_l.LIBCMT ref: 6D639191

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: fd7aa4a06d26ea6fd6220fe82c30e26d84f7db864dad3f80f3d3e3bb9ba13c23
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: C8117E3241419ABBCF125E84CC058EE3F36BB1D298B469516FA2868130CB32C6B1EF91

Function 6D60D10A Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 6D60D130
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,6D612063,?,?,6D5FD30A,73341224), ref: 6D60D13C
LockResource.KERNEL32(00000000,?,?,?,?,?,6D612063,?,?,6D5FD30A,73341224), ref: 6D60D149
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,?,6D612063,?,?,6D5FD30A,73341224), ref: 6D60D165

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 384caab441ad804a35d03611432899f935ab8d802eedf6f0ff39f8dc3cf03ab1
Instruction ID: f48b0ecd6a09b82ef50fb97789f5abf0bfcd85ba7c704825ab4398fdfb29935a
Opcode Fuzzy Hash: 384caab441ad804a35d03611432899f935ab8d802eedf6f0ff39f8dc3cf03ab1
Instruction Fuzzy Hash: 2EF0A432300312BBDB05ABE68984EAF7BBC9BCD6617018178FA15D3201DF74C8408AE4

Function 6D6086EA Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(00000000,0000000C,?), ref: 6D60872A
SetBkColor.GDI32(00000000,00000000), ref: 6D608736
GetSysColor.USER32(00000008), ref: 6D608746
SetTextColor.GDI32(00000000,?), ref: 6D608750

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Color$ObjectText
String ID:
API String ID: 829078354-0
Opcode ID: d9b998594e905aae0e426d66a7bc481c833eded635050418c8eb4cdd4930623f
Instruction ID: d0e48186986a372f5fb11d8cd0cfd242c8e702a0fafcfedcf5cbde832b6426f4
Opcode Fuzzy Hash: d9b998594e905aae0e426d66a7bc481c833eded635050418c8eb4cdd4930623f
Instruction Fuzzy Hash: 86014F30100206ABDF15BF61CE85FBE3B75EB0A361F508920F926D50F4D770D894EAA1

Function 6D6040D0 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

~_Task_impl.LIBCPMT ref: 6D60410C

Part of subcall function 6D612AD7: __EH_prolog3.LIBCMT ref: 6D612ADE

~_Task_impl.LIBCPMT ref: 6D60411C
~_Task_impl.LIBCPMT ref: 6D60412C
~_Task_impl.LIBCPMT ref: 6D60413C

Part of subcall function 6D61E4F6: __EH_prolog3.LIBCMT ref: 6D61E4FD
Part of subcall function 6D61E4F6: GlobalFree.KERNEL32(?), ref: 6D61E52C

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Task_impl$H_prolog3$FreeGlobal
String ID:
API String ID: 36242457-0
Opcode ID: 82e71ac160392e5202beb40d865634a824437830c103fa25d1149c0b01d2856d
Instruction ID: 75397a734e933772236d60f810e6cc938b22bcab7f0d7c5f04c383072439c677
Opcode Fuzzy Hash: 82e71ac160392e5202beb40d865634a824437830c103fa25d1149c0b01d2856d
Instruction Fuzzy Hash: C701217100C7919FD329CF2CD951B9ABBE4EB5D714F408A0EE9AA43281DB746548C7A3

Function 6D5FA8B0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

~_Task_impl.LIBCPMT ref: 6D5FA8E6

Part of subcall function 6D612AD7: __EH_prolog3.LIBCMT ref: 6D612ADE

~_Task_impl.LIBCPMT ref: 6D5FA8F6
~_Task_impl.LIBCPMT ref: 6D5FA906

Part of subcall function 6D612B2B: __EH_prolog3.LIBCMT ref: 6D612B32

~_Task_impl.LIBCPMT ref: 6D5FA913

Part of subcall function 6D612A82: __EH_prolog3.LIBCMT ref: 6D612A89

Part of subcall function 6D611C14: __EH_prolog3.LIBCMT ref: 6D611C1B

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3Task_impl
String ID:
API String ID: 2182512335-0
Opcode ID: 7860b93ca7f95176d262012f28b5dba2e273f800855aed3bf78561a7eb47d6aa
Instruction ID: 9e87b8b67ea85a02170f63b56cbf7ff7d82d7a3bf72bb6cab4b897241fb795be
Opcode Fuzzy Hash: 7860b93ca7f95176d262012f28b5dba2e273f800855aed3bf78561a7eb47d6aa
Instruction Fuzzy Hash: 1501627100C791DFD329DF28D941B9ABBE4EB5D724F414A0DE9AA433C0DB746508C6A3

Function 6D6124AE Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnableWindow.USER32(?,00000001), ref: 6D6124CE
GetActiveWindow.USER32 ref: 6D6124D9
SetActiveWindow.USER32(?), ref: 6D6124E7
FreeResource.KERNEL32(?), ref: 6D612503

Part of subcall function 6D60DAC2: EnableWindow.USER32(?,6D646930), ref: 6D60DAD3

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 50396971b107be348d91ea7adfa36ab927344df160c807fcd9a04acac5d1c56c
Instruction ID: 6aaf5324cd059c1cb3c0977a79425f116e42f27f22cc0a4cf797c1c255bf97ac
Opcode Fuzzy Hash: 50396971b107be348d91ea7adfa36ab927344df160c807fcd9a04acac5d1c56c
Instruction Fuzzy Hash: 72F0AF34A04A15CFCF21EBA9CD45AEDB7B1FF4EB05B214014E51273591C7369880CF65

Function 6D636717 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6D636723

Part of subcall function 6D6344AF: __getptd_noexit.LIBCMT ref: 6D6344B2
Part of subcall function 6D6344AF: __amsg_exit.LIBCMT ref: 6D6344BF

__getptd.LIBCMT ref: 6D63673A
__amsg_exit.LIBCMT ref: 6D636748
__lock.LIBCMT ref: 6D636758

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: a27ab54767c2db1ef9a052a97c16b5ebbd6f5a65f05c0336ab9668da91e3f646
Instruction ID: 3a1133b7c6cecfd81f27239371e4a667ed49af9a5c099cc0401151826255a9e6
Opcode Fuzzy Hash: a27ab54767c2db1ef9a052a97c16b5ebbd6f5a65f05c0336ab9668da91e3f646
Instruction Fuzzy Hash: D0F024319083358BD720EBF4800175C73B0AF4C328F436569C2189B2D1CB74A840CF8A

Function 6D62B6A2 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6D62B6C7
GetTickCount.KERNEL32 ref: 6D62B6D4
CoFreeUnusedLibraries.OLE32 ref: 6D62B6E3
GetTickCount.KERNEL32 ref: 6D62B6E9

Part of subcall function 6D62B646: CoFreeUnusedLibraries.OLE32 ref: 6D62B68E
Part of subcall function 6D62B646: OleUninitialize.OLE32 ref: 6D62B694

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: 8705a6f89ed55fd54c6c7cf200d411326160454055895baad3f5f3ef4c9faffc
Instruction ID: 74c48acd82245a76c0f4e869a3eb5218c5d6ab75cb0b815ee9fe909bea64c3d8
Opcode Fuzzy Hash: 8705a6f89ed55fd54c6c7cf200d411326160454055895baad3f5f3ef4c9faffc
Instruction Fuzzy Hash: BEE06D3185411D8BCF10EFAAE8847A63BB4FB9B320F218023E84A92044CB7058D4CF92

Function 6D6321A6 Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMON

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 6D6321B9

Part of subcall function 6D639460: __FindPESection.LIBCMT ref: 6D6394BB

__getptd_noexit.LIBCMT ref: 6D6321C9
__freeptd.LIBCMT ref: 6D6321D3
ExitThread.KERNEL32 ref: 6D6321DC

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: da336bf556c32188f9f63d1cac20dd90cb734d8b9f04370fa0a3817c078706ac
Instruction ID: 32fda870908f74210b31d320d663f8f29bd65c7d47e636f3f55db08d6d8f3b7d
Opcode Fuzzy Hash: da336bf556c32188f9f63d1cac20dd90cb734d8b9f04370fa0a3817c078706ac
Instruction Fuzzy Hash: D2D0C264000226D7DB247762C9087793A68AB0C518F039820E718C1053FF61D4C0C4A4

Function 6D624D66 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 6D624DA1

Strings

(, xrefs: 6D624EB1

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClearVariant
String ID: (
API String ID: 1473721057-3887548279
Opcode ID: bde25b553ff03b9a5f28bc787d5ea842cd222a15e91dfec9c575ed447b75768a
Instruction ID: c4c84ab3aad215ae04acdd8f343f4eccab7553b779dfd73cdb28a7be4320f19e
Opcode Fuzzy Hash: bde25b553ff03b9a5f28bc787d5ea842cd222a15e91dfec9c575ed447b75768a
Instruction Fuzzy Hash: 30512371A00B119FDB68CF68CA8196AB7F5BF4C314B504A6DE69787A91C7B0F881CF44

Function 6D622DD5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D622DDC

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

VariantClear.OLEAUT32(?), ref: 6D622F7D

Strings

@, xrefs: 6D622E3F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3$ClearException@8ThrowVariant
String ID: @
API String ID: 476054370-2766056989
Opcode ID: a7a56818c99fd848754eb5968c250647ba86b361987f219d823084fbefce2be4
Instruction ID: 9c279b9142a614daaabae62bca4b834be58fa6a7c1ac96f97f3082ed25de8a7a
Opcode Fuzzy Hash: a7a56818c99fd848754eb5968c250647ba86b361987f219d823084fbefce2be4
Instruction Fuzzy Hash: 0A51D570A0020A9FDB14CFA8C894AEEB7F9BF4D304F10856EE516EB251E774A945CF50

Function 6D61455E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

__fdopen.LIBCMT ref: 6D614608

Strings

t, xrefs: 6D6145E8
+, xrefs: 6D6145B6

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __fdopen
String ID: +$t
API String ID: 194168367-1842947216
Opcode ID: ad6d77378f0873873231bb880d4c54965913f163554d22f98441a52706e28443
Instruction ID: 0530a1a11631534c8e2230f36a0fc503404e84223eca2c5cdf03dc93fede8687
Opcode Fuzzy Hash: ad6d77378f0873873231bb880d4c54965913f163554d22f98441a52706e28443
Instruction Fuzzy Hash: 1221263155C7419EE7018A3CDC447A577D8AF1D3ACF248529EA69C71D1DBF8E480C6A4

Function 6D60CB6E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6D62030A: LeaveCriticalSection.KERNEL32(?,?,6D61FA64,00000010,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D620325

__CxxThrowException@8.LIBCMT ref: 6D60CB79

Part of subcall function 6D62E66E: RaiseException.KERNEL32(6D6154FB,6D607483,73341224,?,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D62E6B0

__snwprintf_s.LIBCMT ref: 6D60CBCC

Part of subcall function 6D62ED78: __vsnprintf_s_l.LIBCMT ref: 6D62ED8F

__snwprintf_s.LIBCMT ref: 6D60CBFE

Part of subcall function 6D62E99E: __getptd_noexit.LIBCMT ref: 6D62E99E

Strings

Afx:%p:%x, xrefs: 6D60CBC2

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __snwprintf_s$CriticalExceptionException@8LeaveRaiseSectionThrow__getptd_noexit__vsnprintf_s_l
String ID: Afx:%p:%x
API String ID: 3325254759-3201128726
Opcode ID: 6c77f7ccf5e5530cc53678b7dea2a3966f46ac2e1c607f407eef1bd7f4a1d7bd
Instruction ID: 2efaaa7b0616f6f93fc53724b94079970fcc8106064c5d23087f8f31620ae463
Opcode Fuzzy Hash: 6c77f7ccf5e5530cc53678b7dea2a3966f46ac2e1c607f407eef1bd7f4a1d7bd
Instruction Fuzzy Hash: 3F217670D442099FCB11DFA9C940A9E7BF8EF4D354F124026E909E7211E7708940CF79

Function 6D62BEA7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D62BEE8
SendMessageA.USER32(00000000,00000405,00000000,?), ref: 6D62BF15

Part of subcall function 6D608DD5: SendMessageA.USER32(?,00000401,00000000,00000000), ref: 6D608DFA
Part of subcall function 6D608DD5: GetKeyState.USER32(00000001), ref: 6D608E0F

Strings

,, xrefs: 6D62BF07

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MessageSend$State_memset
String ID: ,
API String ID: 930327405-3772416878
Opcode ID: 8b39f78ce537c2106d91bba66abaf321866b4348c08cbf6804b0d372c43d85ef
Instruction ID: 2e598418cd1bfb0c65434f2ad5fd2f6f8376d54a7e5daf269f30401c249add05
Opcode Fuzzy Hash: 8b39f78ce537c2106d91bba66abaf321866b4348c08cbf6804b0d372c43d85ef
Instruction Fuzzy Hash: 3B11C671514304EFD710DFAAD8C5BEAB7B4FF48324F11951AEA8566584D3B0E404CFA5

Function 6D617C12 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 6D617C3A
PathFindExtensionA.SHLWAPI(?), ref: 6D617C50

Part of subcall function 6D6179A3: __EH_prolog3_GS.LIBCMT ref: 6D6179AD
Part of subcall function 6D6179A3: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6D617C74,?,?), ref: 6D6179DD
Part of subcall function 6D6179A3: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6D6179F1
Part of subcall function 6D6179A3: ConvertDefaultLocale.KERNEL32(?), ref: 6D617A2D
Part of subcall function 6D6179A3: ConvertDefaultLocale.KERNEL32(?), ref: 6D617A3B
Part of subcall function 6D6179A3: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6D617A58
Part of subcall function 6D6179A3: ConvertDefaultLocale.KERNEL32(?), ref: 6D617A83
Part of subcall function 6D6179A3: ConvertDefaultLocale.KERNEL32(000003FF), ref: 6D617A8C
Part of subcall function 6D6179A3: GetModuleFileNameA.KERNEL32(6D5F0000,?,00000105), ref: 6D617B41

Strings

%s%s.dll, xrefs: 6D617C59

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: 63539d98090ad5d0b499fa7257908683f39046fba162516a3144ae58fa393ae9
Instruction ID: 3726cc974a98b30026c6b0dd463cc349c9ef2b4f8107e306b99f136a57b1ec0c
Opcode Fuzzy Hash: 63539d98090ad5d0b499fa7257908683f39046fba162516a3144ae58fa393ae9
Instruction Fuzzy Hash: B501D17190401CEFCB00DB68CC41BEF7BF8AB4A700F0145A5E502E7100DB70DA48CBA1

Function 6D619F34 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6D5FBFB0: GetModuleHandleA.KERNEL32(?,?,6D6187BA,ImageList_Create,?,?,6D618814,6D5FD355,?,00000020,6D656AF0,00000018,6D618985,?,?,?), ref: 6D5FBFBD
Part of subcall function 6D5FBFB0: LoadLibraryA.KERNEL32(?,?,6D6187BA,ImageList_Create,?,?,6D618814,6D5FD355,?,00000020,6D656AF0,00000018,6D618985,?,?,?), ref: 6D5FBFCE

GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 6D619F5D
_memset.LIBCMT ref: 6D619F76

Strings

DllGetVersion, xrefs: 6D619F57

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc_memset
String ID: DllGetVersion
API String ID: 3385804498-2861820592
Opcode ID: 989d2a82740d5b44e015cbd7dae00ca710e3a26effb8fafcb0c78079f2c4286e
Instruction ID: 3e28acd712f647646689df328ab43fb38e22d28e591a189c32fed55b15ecc0ee
Opcode Fuzzy Hash: 989d2a82740d5b44e015cbd7dae00ca710e3a26effb8fafcb0c78079f2c4286e
Instruction Fuzzy Hash: 46F08671E042155FEB00DBEDCC40BAA73F89B48718F110121FA14F3191E770AD0487B5

Function 6D614C8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetMenuStringA.USER32(?,6D646930,00000000,00000000,00000000), ref: 6D614CAC
GetMenuStringA.USER32(?,6D646930,00000000,00000001,00000000), ref: 6D614CCD

Strings

0idm, xrefs: 6D614C94, 6D614CB8

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: MenuString
String ID: 0idm
API String ID: 3453713332-2767938644
Opcode ID: a0a5e8b6102cb3929ac82b7dbeb6e4aa757c20a95cf968403d6183781117be5c
Instruction ID: 3fda4435fc6efa0326b84149e5709a630bd307f94c5a677fbbff546fb81b5e4c
Opcode Fuzzy Hash: a0a5e8b6102cb3929ac82b7dbeb6e4aa757c20a95cf968403d6183781117be5c
Instruction Fuzzy Hash: 7CF0C276104209BFCB059F89CD41EDE7B6EEB8C364F148112FA2457150CB71E920DBA0

Function 6D620ECE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D620ED5
InterlockedIncrement.KERNEL32(?), ref: 6D620F1F

Strings

Lw, xrefs: 6D620F1F

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: H_prolog3_catchIncrementInterlocked
String ID: Lw
API String ID: 1794289173-4278538321
Opcode ID: 057695b333ed587818e9fda57e1829efea74c1733d03156d46226e4136de861f
Instruction ID: d17c5d19bf392c51a908bef5a2a680592c8387fa104529c4f799c22ec632cae9
Opcode Fuzzy Hash: 057695b333ed587818e9fda57e1829efea74c1733d03156d46226e4136de861f
Instruction Fuzzy Hash: CE018C71904205EFDB10DF68C884BADBBB0BF08319F108624E9189B2C1C774DA44CB84

Function 6D620158 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(00000000,000000F0), ref: 6D620179
GetClassNameA.USER32(00000000,?,0000000A), ref: 6D62018E

Strings

combobox, xrefs: 6D620197

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: ClassLongNameWindow
String ID: combobox
API String ID: 1147815241-2240613097
Opcode ID: 08aafd0b11a93547baf74f3d660f5fbe0e57d699e0c03c10c73c3400ec8e901c
Instruction ID: 3b667d41b3ddf91d5f4c54ed34b31d8219b09b5c795552fceec3f69bbf0c1e61
Opcode Fuzzy Hash: 08aafd0b11a93547baf74f3d660f5fbe0e57d699e0c03c10c73c3400ec8e901c
Instruction Fuzzy Hash: 22F0F631514119AF8B01EBA5CC05EEF77B8EB4A3507518515E812D7080CB30E9058AD5

Function 6D633978 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D62CCAA: __getptd.LIBCMT ref: 6D62CCB0
Part of subcall function 6D62CCAA: __getptd.LIBCMT ref: 6D62CCC0

__getptd.LIBCMT ref: 6D633987

Part of subcall function 6D6344AF: __getptd_noexit.LIBCMT ref: 6D6344B2
Part of subcall function 6D6344AF: __amsg_exit.LIBCMT ref: 6D6344BF

__getptd.LIBCMT ref: 6D633995

Strings

csm, xrefs: 6D6339A3

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 3b0af8a0cb7c02acf4d82619c1639880f1940bc09f14c23bb0a3c3f369444f14
Instruction ID: 4b3f306d043237e332be6cf6ff53bd1edda8e48056a0dd3303d42f96b07cedc7
Opcode Fuzzy Hash: 3b0af8a0cb7c02acf4d82619c1639880f1940bc09f14c23bb0a3c3f369444f14
Instruction Fuzzy Hash: FD014635804326CFCB248F21C440BADB3B9BF68215F23792ED059966D0EB329990CF45

Function 6D62BF5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D62BF63
GetProcAddress.KERNEL32(00000000,?), ref: 6D62BF9C

Strings

UxTheme.dll, xrefs: 6D62BF7C

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: AddressH_prolog3Proc
String ID: UxTheme.dll
API String ID: 3325816569-352951104
Opcode ID: 22b0c7ec21bde7380edee76ce4ff6014613615221690ba813254283d75127c9e
Instruction ID: 2ca7a3db1e3630b2c88f2e656d847a164cb9cbe4bbe4c1e51bc5b14c64942bed
Opcode Fuzzy Hash: 22b0c7ec21bde7380edee76ce4ff6014613615221690ba813254283d75127c9e
Instruction Fuzzy Hash: BCE06D34608291ABDF19DB7B8504B6937B4BB1E654F018024E908E7285C77599408F9A

Function 6D61FE60 Relevance: 5.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D65FDD4,00000000,6D65FDB8,6D65FDD4,6D65FDB8,?,6D61FF3F,02FAEA38,00000000,00000000,?,?,6D615636,00000000,00000000,000000FF), ref: 6D61FEBF
LeaveCriticalSection.KERNEL32(6D65FDD4,00000000,?,6D61FF3F,02FAEA38,00000000,00000000,?,?,6D615636,00000000,00000000,000000FF,00000010,6D6159B8,00000000), ref: 6D61FECF
LocalFree.KERNEL32(?,?,6D61FF3F,02FAEA38,00000000,00000000,?,?,6D615636,00000000,00000000,000000FF,00000010,6D6159B8,00000000), ref: 6D61FED8
TlsSetValue.KERNEL32(6D65FDB8,00000000,?,6D61FF3F,02FAEA38,00000000,00000000,?,?,6D615636,00000000,00000000,000000FF,00000010,6D6159B8,00000000), ref: 6D61FEEA

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveLocalValue
String ID:
API String ID: 2949335588-0
Opcode ID: 2f5ff0bbfba9b1f989e7595b73159db3316b519c2963937ca845fd83618a1dc3
Instruction ID: 8fcf9e89a4cb3d0917fc8979415fded01ac884cc0c61437d98eae09dde026d49
Opcode Fuzzy Hash: 2f5ff0bbfba9b1f989e7595b73159db3316b519c2963937ca845fd83618a1dc3
Instruction Fuzzy Hash: 35118B32604706FFD714DF59C884FAAB7B5FF4A315F108429E1568B5A2CB71E981CB60

Function 6D620298 Relevance: 5.0, APIs: 4, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D65FF88,?,?,00000000,?,6D61FA4A,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D6202D2
InitializeCriticalSection.KERNEL32(?,?,?,00000000,?,6D61FA4A,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D6202E4
LeaveCriticalSection.KERNEL32(6D65FF88,?,?,00000000,?,6D61FA4A,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D6202F1
EnterCriticalSection.KERNEL32(?,?,?,00000000,?,6D61FA4A,00000010,00000008,6D61551A,6D6154BD,6D607483,6D5FC090,?,73341224), ref: 6D620301

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: 1017768b9eb07a6945621cd7ad7124c911180eef9834bcfea1dc808973f2edff
Instruction ID: fef25f9e9b9956f0efe1876224f13dced5b8d2b78d845426c39f6feb07bf0bd6
Opcode Fuzzy Hash: 1017768b9eb07a6945621cd7ad7124c911180eef9834bcfea1dc808973f2edff
Instruction Fuzzy Hash: C9F090735052069BCB00EBEBDC58B6AB77EEBCB356F211127E14447142DB3095C1CEAA

Function 6D61F9C3 Relevance: 5.0, APIs: 4, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D65FDD4,?,?,00000000,?,6D61FFBA,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61F9D1
TlsGetValue.KERNEL32(6D65FDB8,?,?,00000000,?,6D61FFBA,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61F9E5
LeaveCriticalSection.KERNEL32(6D65FDD4,?,?,00000000,?,6D61FFBA,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61F9FB
LeaveCriticalSection.KERNEL32(6D65FDD4,?,?,00000000,?,6D61FFBA,?,00000004,6D6154FB,6D607483,6D5FC090,?,73341224), ref: 6D61FA06

Memory Dump Source

Source File: 00000004.00000002.1349255711.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000004.00000002.1349221094.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349619101.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349645277.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1349673238.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6d5f0000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: abe3cf2e848f07feb14181a61beac912a6d058fd795f47281a84fecd4bab7f4d
Instruction ID: 4538bfb3498591a18d406da09e9cb0c4dc3224b59dac3f4b5b7941d67c6fb987
Opcode Fuzzy Hash: abe3cf2e848f07feb14181a61beac912a6d058fd795f47281a84fecd4bab7f4d
Instruction Fuzzy Hash: D0F0B473208146DFD7109F5DDC88D47B7BEEAC93603068425E546C3102D774F8458A90

Analysis Process: rundll32.exePID: 8088, Parent PID: 8064COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	37.7%
Signature Coverage:	0%
Total number of Nodes:	644
Total number of Limit Nodes:	24

Executed Functions

Function 6D5F9E50 Relevance: 38.9, APIs: 19, Strings: 3, Instructions: 385
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(000003DB,6D647884,6D64789C,00000038,00000156,000022B7,0000007B,00000379,00000000,00000000,00000000,00000000), ref: 6D5F9EA5
GetLastError.KERNEL32(?,?,?,?), ref: 6D5F9EAB
ShowWindow.USER32(00000000,00000000,?,?,?,?), ref: 6D5F9EB9
CreateWindowExA.USER32(00000298,??????????,????????9,00000060,000001BB,00001A11,00000001,00000379,00000000,00000000,00000000,00000000), ref: 6D5F9EE7
ShowWindow.USER32(00000000,00000000,?,?,?,?), ref: 6D5F9EEF
CreateWindowExW.USER32(000003DB,6D647884,6D64789C,00000038,00000156,000022B7,0000007B,00000379,00000000,00000000,00000000,00000000), ref: 6D5FA083
GetLastError.KERNEL32(?,?,?,?), ref: 6D5FA089
ShowWindow.USER32(00000000,00000000,?,?,?,?), ref: 6D5FA091
CreateWindowExA.USER32(00000298,??????????,????????9,00000060,000001BB,00001A11,00000001,00000379,00000000,00000000,00000000,00000000), ref: 6D5FA0B9
ShowWindow.USER32(00000000,00000000,?,?,?,?), ref: 6D5FA0C1
FindResourceW.KERNEL32(?,00000145,6D647BA8), ref: 6D5FA272
LoadResource.KERNEL32(?,00000000), ref: 6D5FA278
SizeofResource.KERNEL32(?,00000000), ref: 6D5FA284
VirtualAllocExNuma.KERNEL32(000000FF,00000000,00000000,00003000,00000040,00000000), ref: 6D5FA309
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 6D5FA31A
memcpy.MSVCRT ref: 6D5FA329
malloc.MSVCRT ref: 6D5FA334
??3@YAXPAX@Z.MSVCRT ref: 6D5FA352
_printf.LIBCMT ref: 6D5FA394

Strings

????????9, xrefs: 6D5F9ED8, 6D5FA0AA
r_xav$na2L)FOeT1#qD3SWR#DOQBz@h?&+hyJ%CbY*j1z%k(kSwUX$ELDIxwfuhbyDIe, xrefs: 6D5FA33E
??????????, xrefs: 6D5F9EDD, 6D5FA0AF

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Window$CreateShow$Resource$AllocErrorLastVirtual$??3@FindLoadNumaSizeof_printfmallocmemcpy
String ID: ????????9$??????????$r_xav$na2L)FOeT1#qD3SWR#DOQBz@h?&+hyJ%CbY*j1z%k(kSwUX$ELDIxwfuhbyDIe
API String ID: 174387922-3902351054
Opcode ID: 1bbe36c25a5355dfe9ac0e5744b0b0b2cd56a67a7057fff66db542b6f708e372
Instruction ID: 43223f5e514267f23d21e801e338434acdd2e4152d8a15516941f9d8a5060ad5
Opcode Fuzzy Hash: 1bbe36c25a5355dfe9ac0e5744b0b0b2cd56a67a7057fff66db542b6f708e372
Instruction Fuzzy Hash: 5FD1D6B0508300ABDB14DF76CC44F2BBABDEF99744F40842DF205DB695E7B498418B69

Function 6D61FB51 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(6D65FDD4,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,730ECC53), ref: 6D61FB64
GlobalAlloc.KERNEL32(00000002,00000000,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,730ECC53), ref: 6D61FBBA
GlobalHandle.KERNEL32(030B07B8), ref: 6D61FBC3
GlobalUnlock.KERNEL32(00000000,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,730ECC53), ref: 6D61FBCD
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 6D61FBE6
GlobalHandle.KERNEL32(030B07B8), ref: 6D61FBF8
GlobalLock.KERNEL32(00000000,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,730ECC53), ref: 6D61FBFF
LeaveCriticalSection.KERNEL32(?,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,730ECC53), ref: 6D61FC08
GlobalLock.KERNEL32(00000000,?,?,00000000,6D65FDB8,6D65FDB8,?,6D61FFA7,00000004,6D6154FB,6D607483,6D5FC090,?,730ECC53), ref: 6D61FC14
_memset.LIBCMT ref: 6D61FC2E
LeaveCriticalSection.KERNEL32(?), ref: 6D61FC5C

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 8682525342c11a247afe3911f6a1778c1f2b84c0db25c711e07f0017621161e6
Instruction ID: d63488a39a3086ec2bd4dbf5c3f6528bd06f4b62652ab8d8e86b5e4026a03420
Opcode Fuzzy Hash: 8682525342c11a247afe3911f6a1778c1f2b84c0db25c711e07f0017621161e6
Instruction Fuzzy Hash: 3C31E3B2608705AFDB20DFA9CC88B5B77F9EF88304B018829EA56C3500DB71F8408B90

Function 6D5F8C30 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(000003DB,6D647884,6D64789C,00000038,00000156,000022B7,0000007B,00000379,00000000,00000000,00000000,00000000), ref: 6D5F8C5A
GetLastError.KERNEL32 ref: 6D5F8C64
ShowWindow.USER32(00000000,00000000), ref: 6D5F8C75
CreateWindowExA.USER32(00000298,??????????,????????9,00000060,000001BB,00001A11,00000001,00000379,00000000,00000000,00000000,00000000), ref: 6D5F8CA1
ShowWindow.USER32(00000000,00000000), ref: 6D5F8CAF
ExitProcess.KERNEL32 ref: 6D5F8CBC

Strings

DllRegisterServer, xrefs: 6D5F8CC2
????????9, xrefs: 6D5F8C92
??????????, xrefs: 6D5F8C97

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Window$CreateShow$ErrorExitLastProcess
String ID: ????????9$??????????$DllRegisterServer
API String ID: 356722023-1345309269
Opcode ID: 934d745af515516939e95c65ff34fe3229594a013830ffd063716609eb7437bf
Instruction ID: 8f6571f801edb580da0d28cfe3887a0fc5bc2758a9756b0119484c00ec35b7a7
Opcode Fuzzy Hash: 934d745af515516939e95c65ff34fe3229594a013830ffd063716609eb7437bf
Instruction Fuzzy Hash: F6013CB1BC5300BBFB6426B24C4BF962A684719F06F10C422F705FE0C1DBD0B04489EA

Function 6D62CED5 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 6D62CEF3

Part of subcall function 6D634C64: __mtinitlocknum.LIBCMT ref: 6D634C7A
Part of subcall function 6D634C64: __amsg_exit.LIBCMT ref: 6D634C86
Part of subcall function 6D634C64: EnterCriticalSection.KERNEL32(00000000,00000000,?,6D63455A,0000000D,6D6587F0,00000008,6D634651,00000000,?,6D62E427,00000000,?,?,?,6D62E48A), ref: 6D634C8E

___sbh_find_block.LIBCMT ref: 6D62CEFE
___sbh_free_block.LIBCMT ref: 6D62CF0D
RtlFreeHeap.NTDLL(00000000,00000000,6D658320,0000000C,6D6344A0,00000000,?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C), ref: 6D62CF3D
GetLastError.KERNEL32(?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C,6D634C7F,00000000,00000000,?,6D63455A,0000000D), ref: 6D62CF4E

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 2111cf9e40d04d4b29527aba75d1f041534ca62306af0ea28c5c302044d413e7
Instruction ID: 2c08e76dbb5d77202d496b7172859a26619f56ce6a5f18471633cba59af72b01
Opcode Fuzzy Hash: 2111cf9e40d04d4b29527aba75d1f041534ca62306af0ea28c5c302044d413e7
Instruction Fuzzy Hash: 4D01D631C0E312ABDF105BB59944BAD3FB4AF0D768F138019E619A60C1CB38D580DED9

Function 10006E01 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 10006EAD

Strings

K(}, xrefs: 10006E7B
ja, xrefs: 10006E68
gaF, xrefs: 10006E36

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: K(}$gaF$ja
API String ID: 1889721586-538739611
Opcode ID: 2bfe91f83e54762a76626f5005161e2236a064a7b9ce61c9eebc5f4be2cd1f3e
Instruction ID: ae5e20adda95371a6ffbc60222c05419d1fa10ae125f737c12cd54d8d8f4e7c9
Opcode Fuzzy Hash: 2bfe91f83e54762a76626f5005161e2236a064a7b9ce61c9eebc5f4be2cd1f3e
Instruction Fuzzy Hash: D31155B2D01218BBDB04DFA5C8498DEBFB6EF45314F10C189FA18A7241D7B55B259F90

Function 6D5F8F00 Relevance: 7.0, APIs: 4, Instructions: 1014
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,6D5F9E4A), ref: 6D5F9372
GetProcessHeap.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D5F96C3
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D5F96CA
memcpy.MSVCRT ref: 6D5F98FD

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Heap$AllocInfoNativeProcessSystemmemcpy
String ID:
API String ID: 1755227880-0
Opcode ID: ec2c6059ed377d33e8d6246b51807059d0709185b064fd069032004878b02b99
Instruction ID: 12bf44e2ac87075645a2be686fe6bebea7c57dd29ef81d586f769568da5bb17b
Opcode Fuzzy Hash: ec2c6059ed377d33e8d6246b51807059d0709185b064fd069032004878b02b99
Instruction Fuzzy Hash: D29252326042068FCB0CCF2DCA96B69B7F6FBD9304B05862ED455CB669EB34E549CB50

Function 10007BC6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(1A48E6F8), ref: 10007C74

Strings

Z8, xrefs: 10007C2A

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: Z8
API String ID: 4033686569-4113373922
Opcode ID: 308f64f918a83fe14fd2a0715591c9d5f769be9384a043c1aa0fb948248b5d4f
Instruction ID: bc5ccce564b508e3e5ee151c4ba85837a9aaa66788098328f8ba81862f6ef7fc
Opcode Fuzzy Hash: 308f64f918a83fe14fd2a0715591c9d5f769be9384a043c1aa0fb948248b5d4f
Instruction Fuzzy Hash: B0115BB5D0024CBFDB08CFE5D94AA9EBBB1EB40304F208199E41477290D7B65B548F50

Function 10004A9D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 10004B39

Strings

fW6%, xrefs: 10004AF4

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: fW6%
API String ID: 1029625771-2497841860
Opcode ID: 394d79df2e022e3103ed5dfbf4f970570035fa9306bbb3e241013eecdf3199c8
Instruction ID: 1654fd7a89adbc247ea4b2cc44e2289807b97534170b36b5b589edf922bd2dd5
Opcode Fuzzy Hash: 394d79df2e022e3103ed5dfbf4f970570035fa9306bbb3e241013eecdf3199c8
Instruction Fuzzy Hash: 5E114871C11208FFDB08DFA4DA4A9DEBBB4FB00311F20C189E419B6251D3705B149F90

Function 10017B25 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000), ref: 10017B98

Strings

p4, xrefs: 10017B34

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: p4
API String ID: 621844428-1539767998
Opcode ID: 94c440c38613cd405a4d170ca76893493cc6bc59e85da6168acdace7e4be3644
Instruction ID: 6f878ff555c26b60996825b1d2b2a2cf69cce43ce534236754b61de2d7acab95
Opcode Fuzzy Hash: 94c440c38613cd405a4d170ca76893493cc6bc59e85da6168acdace7e4be3644
Instruction Fuzzy Hash: 37F08C71E0030CFBDB44CBE5D94AA9EBBF0EB50304F20C098D915A7241D7B56B088F41

Function 6D5F6210 Relevance: 3.3, APIs: 2, Instructions: 259COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 6D5F624B
??3@YAXPAX@Z.MSVCRT ref: 6D5F6572

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: ??3@malloc
String ID:
API String ID: 3530088491-0
Opcode ID: 9d3ad2bbf81a1a7d979f94b41ec38ca716ea5a077f5309c1095b91244107991e
Instruction ID: 4f9115585e275d2c8afc9b60d7733503829254ee42cdfa9b12f430f1e6a2c9a4
Opcode Fuzzy Hash: 9d3ad2bbf81a1a7d979f94b41ec38ca716ea5a077f5309c1095b91244107991e
Instruction Fuzzy Hash: DDB1A63260430B8FCB08CF6DCAC2755BBB5FBDA304B05856AD5509B366E770AA49CBD0

Function 6D5F6F80 Relevance: 1.7, APIs: 1, Instructions: 205COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d93115bac5305ab9e97806824b1968b2f6fda0bf62c9c5dde1cfd4c2c67a19
Instruction ID: 61f07d11eff202b9dc0fc69dd0e5048281a047c7d3a05626a5a6bd85c621a553
Opcode Fuzzy Hash: 02d93115bac5305ab9e97806824b1968b2f6fda0bf62c9c5dde1cfd4c2c67a19
Instruction Fuzzy Hash: EF71923264430B8FC708CF6DD9C2B95B7B9FBC9304F04862AD955CF259E770E6498A90

Function 1001A50A Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,00000000,D727192A,00D964FD,00000000), ref: 1001A5E4

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 437ca9c9c9e6bbc918406cc15dcd8751e725cea46ce31b3af92ae7b3c8ede5d5
Instruction ID: 412e7376bc276dfc8db94309ca56039382e89c6bc0d174e2226dd53fc2e61811
Opcode Fuzzy Hash: 437ca9c9c9e6bbc918406cc15dcd8751e725cea46ce31b3af92ae7b3c8ede5d5
Instruction Fuzzy Hash: 1A21E576901108FBDF05CFE5C94A8DEBFB6EF48354F108149F91866220D3729A60DF91

Function 1000816B Relevance: 1.6, APIs: 1, Instructions: 68processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,?,00000000,00000000,?,00000000,00000000,00000000,00000044,?), ref: 10008236

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7e58e5a2dccc3d8a10dddd634ea05ac90ad53dce594303d851aa7f7164f25884
Instruction ID: 4756357617f2f41eb2c5ad579b1c22c1a7c6fbcc1fc992a0f802409951220c4e
Opcode Fuzzy Hash: 7e58e5a2dccc3d8a10dddd634ea05ac90ad53dce594303d851aa7f7164f25884
Instruction Fuzzy Hash: 5A21C07280124CBBCF159F95CD0ACCEBFBAEB89714F108098FA1562121D3729A65EB60

Function 100102D8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 10010384

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e059c3c066ff345504bba9c85b1d4992eba54445fe3d98b1d9d536134e0d9d68
Instruction ID: 272cec0317e95e5db047d74803fc0b1aa602f5f7f96704868454fe35651c1806
Opcode Fuzzy Hash: e059c3c066ff345504bba9c85b1d4992eba54445fe3d98b1d9d536134e0d9d68
Instruction Fuzzy Hash: AC114F75E01208FFEB08CFA5D80A9EEBBB5EB85310F50C09AE504A7284E7B16F119F40

Function 1001EAB3 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetFileInformationByHandle.KERNEL32(000B5C15,00000000,?,00000028,?,?,?,?,?,?,?,?,?,?,?,00000023), ref: 1001EB5A

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: FileHandleInformation
String ID:
API String ID: 3935143524-0
Opcode ID: 62f4fd11f1bee2b778a12be1f39848d568871edb8fd1f68545c84305743f77cd
Instruction ID: bc2cc70ea04da8babfea4a62d00ea87df5d4c15a16c29e4234749fe79d85a26d
Opcode Fuzzy Hash: 62f4fd11f1bee2b778a12be1f39848d568871edb8fd1f68545c84305743f77cd
Instruction Fuzzy Hash: 3F110276C0121DBBDF14CFA4990A9EEBFB4EB44314F108089EA14A6294D3B55A64AFA1

Function 10006F64 Relevance: 1.5, APIs: 1, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 1000700D

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d2b2d806af4081c28d9bf618fcc7f3d8c5861587ca6d38c8b8dda44ce86b1e35
Instruction ID: a7ad58f8940df9107c0d3f5e6dd1a53ed4d9c66f2cc3fb22c733b5e38c758e29
Opcode Fuzzy Hash: d2b2d806af4081c28d9bf618fcc7f3d8c5861587ca6d38c8b8dda44ce86b1e35
Instruction Fuzzy Hash: 941149B5D0020CFBDF44DFA4DD0AA9EBBB0FF04304F108188E91466291D3B25B649F51

Function 10003506 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(9FA0E66D,?,00083F87), ref: 100035AB

Memory Dump Source

Source File: 00000005.00000002.1357239934.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.1357205426.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000005.00000002.1357304206.0000000010024000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f96f459a1562cf0811398c59acc1a6a1e894971d13c8e85bf07d59f40b728169
Instruction ID: b672eea8bbd5a35847388148feefcd37532f61b34cd955ab03d9af958fa8414f
Opcode Fuzzy Hash: f96f459a1562cf0811398c59acc1a6a1e894971d13c8e85bf07d59f40b728169
Instruction Fuzzy Hash: 2A1125B5D00208BFDF04DFA4D84A89EBFB5EB44740F208098F9146A221D3769B24EF90

Function 6D61FF53 Relevance: 1.5, APIs: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D61FF5A

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 103e4d85f0991829a5be3c889e53d77a263ce8a8b8d30d2c5b4547b125a77538
Instruction ID: 8ca6b8dcd244de4bb9dc726a30481f824984f0f1095633b71f5322539e109b7d
Opcode Fuzzy Hash: 103e4d85f0991829a5be3c889e53d77a263ce8a8b8d30d2c5b4547b125a77538
Instruction Fuzzy Hash: FB017C3660C203CFDB14DF39C8107BE36B2AB8E329B11492CE5998B290DF70C980CB15

Function 6D5F8BE0 Relevance: 1.5, APIs: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6D5F8BE6

Part of subcall function 6D62CE0B: __FF_MSGBANNER.LIBCMT ref: 6D62CE2E
Part of subcall function 6D62CE0B: __NMSG_WRITE.LIBCMT ref: 6D62CE35
Part of subcall function 6D62CE0B: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,6D6385C3,00000000,00000001,00000000,?,6D634BEE,00000018,6D658878,0000000C,6D634C7F), ref: 6D62CE82

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 5f1ee0aeb075a1f768145108833e98dae58e51e82a419426d32d25a4a73c97bc
Instruction ID: def6b5fbd842c1cca3ab37a0163055e74e034b7e98e5c06fecb9f38960da5d0e
Opcode Fuzzy Hash: 5f1ee0aeb075a1f768145108833e98dae58e51e82a419426d32d25a4a73c97bc
Instruction Fuzzy Hash: F7E026F661511A0BDF04DAFE8CE0AA337DD6B1A0243460535E482DF502E700E8848EA2

Function 6D63575B Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6D62E311,00000001,?,?,?,6D62E48A,?,?,?,6D6583E0,0000000C,6D62E545), ref: 6D635770

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a1d4ce72eafaa11ceb60ca06ded487be16775dde50173e11a7a911dd8848bf41
Instruction ID: a4cb56999233d7eeb9191f50bf0b36ffa56365de5bbe3df64d1f0b5a0a9063e5
Opcode Fuzzy Hash: a1d4ce72eafaa11ceb60ca06ded487be16775dde50173e11a7a911dd8848bf41
Instruction Fuzzy Hash: BCD05E729543859FDB005EB65849B763BFC9389395F10843AF81CC6240F774D5819A41

Function 6D5F82A0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 6D5F82B4

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1e2c8865c5dd3405fb362278e442da11aea99caaf1eae9dd27b16f9a7f9a461b
Instruction ID: defae9fe6431e499b0d20a52a5266863f353e06682300a2418938c142f823ba4
Opcode Fuzzy Hash: 1e2c8865c5dd3405fb362278e442da11aea99caaf1eae9dd27b16f9a7f9a461b
Instruction Fuzzy Hash: 2AC0EAB9608201AF9A08CB94C889D6BB7A9EBC9240F008908B59983210C630E8418B22

Function 6D5F82C0 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 6D5F82CF

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 61e8130aa66ef2709514687d7dc795322dc21e071dca9f86f3a680e031e07f94
Instruction ID: 4a6e8a738fefb08d0b70b148c9809be90adc7d9ded9092f6b53dfa677e90a366
Opcode Fuzzy Hash: 61e8130aa66ef2709514687d7dc795322dc21e071dca9f86f3a680e031e07f94
Instruction Fuzzy Hash: 8FC048B8608200BF9E08CB60C989C2BB7B9EBC8610F10CD0CB89983200C630EC40DA22

Non-executed Functions

Function 6D62CD5C Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6D634997
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D6349AC
UnhandledExceptionFilter.KERNEL32(6D64E6B4), ref: 6D6349B7
GetCurrentProcess.KERNEL32(C0000409), ref: 6D6349D3
TerminateProcess.KERNEL32(00000000), ref: 6D6349DA

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c3b5bca125879fb242c10ce2405aa785ada2991ed7d7b55791116bb53dbb5a4e
Instruction ID: 450315f63b425deb9a07a826f15c635a915ceb25577c4207b54a129150995fa3
Opcode Fuzzy Hash: c3b5bca125879fb242c10ce2405aa785ada2991ed7d7b55791116bb53dbb5a4e
Instruction Fuzzy Hash: 7A2125B4804395DFCF40DFABC084B68BBB8BB4A305F11856AE51A87354E7B05985CF86

Function 6D604F40 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 184windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 6D604F97
LoadBitmapA.USER32(?), ref: 6D604FCE
SelectObject.GDI32(?,?), ref: 6D604FEC
GetObjectA.GDI32(?,00000018,?), ref: 6D604FFE
GetSystemMetrics.USER32(00000000), ref: 6D60500B
GetSystemMetrics.USER32(00000001), ref: 6D605015
BitBlt.GDI32(?,0000003C,00000014,?,?,?,?,?,00CC0020), ref: 6D6050AB

Strings

gfff, xrefs: 6D605035
gfff, xrefs: 6D605019

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: MetricsObjectSystem$BitmapCompatibleCreateLoadSelect
String ID: gfff$gfff
API String ID: 2961984297-3084402119
Opcode ID: fa259526341a3f8cb92eed00863e6a4874bc4b25f2b40c60e30376186cf4b39e
Instruction ID: be7c55b28ea0f0c5c9a3b679657e7324b4dac9ebd5d653d83f8061c4a4efa9d5
Opcode Fuzzy Hash: fa259526341a3f8cb92eed00863e6a4874bc4b25f2b40c60e30376186cf4b39e
Instruction Fuzzy Hash: 5C6137B52087459FC324DF5ACA84A2BB7F8FB99704F008A1DF58687650D770F944CBA2

Function 6D618D96 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 6D618DB1
GetSystemMetrics.USER32(00000048), ref: 6D618DD5
CreateFontA.GDI32(00000000), ref: 6D618DDC
SelectObject.GDI32(?,00000000), ref: 6D618DF2
GetCharWidthA.GDI32(?,00000036,00000036,6D65C47C), ref: 6D618E03
SelectObject.GDI32(?,?), ref: 6D618E13
DeleteObject.GDI32(00000000), ref: 6D618E16
ReleaseDC.USER32(00000000,?), ref: 6D618E20

Strings

Marlett, xrefs: 6D618DB7

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Object$Select$CharCreateDeleteFontMetricsReleaseSystemWidth
String ID: Marlett
API String ID: 1397664628-3688754224
Opcode ID: 00c47c794d883f899e0e51f820aacdd50941354f378a0b698f3452b8f9fac451
Instruction ID: 6154bfa6ec2b0cb00e7894de55248f15e6c2ee73ff58f35d55827e10f7a5c3b2
Opcode Fuzzy Hash: 00c47c794d883f899e0e51f820aacdd50941354f378a0b698f3452b8f9fac451
Instruction Fuzzy Hash: F4113C31901224BBCB21ABA78D4DEEF7F7DEF4B7A0F108000F209A2151C7714A81DAE0

Function 6D628E0A Relevance: 15.1, APIs: 10, Instructions: 97COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,00000000,?,?,?), ref: 6D628E21
GetWindowRect.USER32(?,?), ref: 6D628E39
SetRect.USER32(?,?,00000000,?,?), ref: 6D628E79
InvalidateRect.USER32(?,?,00000001), ref: 6D628E88
SetRect.USER32(?,?,00000000,?,?), ref: 6D628E9F
InvalidateRect.USER32(?,?,00000001), ref: 6D628EAE
SetRect.USER32(?,00000000,?,?,?), ref: 6D628EDF
InvalidateRect.USER32(?,?,00000001), ref: 6D628EEA
SetRect.USER32(?,00000000,?,?,?), ref: 6D628F01
InvalidateRect.USER32(?,?,00000001), ref: 6D628F0C

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Rect$Invalidate$Window$Proc
String ID:
API String ID: 570070710-0
Opcode ID: 8e3a3df2baeba3b08be3dc548cf27609ead4ac02382528adcc2e58ae35b868c4
Instruction ID: f807f1f614fda8fd4151281f0afd6d705369855c146019a81395e35b972b8933
Opcode Fuzzy Hash: 8e3a3df2baeba3b08be3dc548cf27609ead4ac02382528adcc2e58ae35b868c4
Instruction Fuzzy Hash: DC31D5B290021ABFDF04DFA5CD88FEABB79FB09300F104115FA45A75A4D771AA54CBA1

Function 6D5F2D90 Relevance: 13.9, APIs: 9, Instructions: 393windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D6099BD: __EH_prolog3_catch.LIBCMT ref: 6D6099C4

Part of subcall function 6D6110EB: __EH_prolog3.LIBCMT ref: 6D6110F2
Part of subcall function 6D6110EB: __CxxThrowException@8.LIBCMT ref: 6D611128

SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F3027
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F3051

Part of subcall function 6D60D8C8: GetDlgItem.USER32(?,?), ref: 6D60D8D9

SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F306E
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F3129
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F317A
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 6D5F31B9

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: MessageSend$Exception@8H_prolog3H_prolog3_catchItemThrow
String ID:
API String ID: 2494371950-0
Opcode ID: 4675ee65bbc28b115a48f10cde804c223e68fcb7638b72fd1f0f2aa997d6d2aa
Instruction ID: e7a36ce24c95891c12a9755422cf15fd18c0aeefef4796fd290a490a718bb8a1
Opcode Fuzzy Hash: 4675ee65bbc28b115a48f10cde804c223e68fcb7638b72fd1f0f2aa997d6d2aa
Instruction Fuzzy Hash: 1AD1A470784B02ABE638CB55CD91F7A73A5AB8D714F104A1CE34A9FAD0CB74F8428B55

Function 6D5FCEF0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

Part of subcall function 6D606101: _malloc.LIBCMT ref: 6D60611F

_memset.LIBCMT ref: 6D5FCF78
EnumProcesses.PSAPI(?,00001000,?,?,00000000,00000103), ref: 6D5FCF8F
OpenProcess.KERNEL32(00000410,00000000,?,?,00001000,?,?,00000000,00000103), ref: 6D5FCFB9
EnumProcessModules.PSAPI(00000000,?,00000004,?), ref: 6D5FCFD6
GetModuleFileNameExA.PSAPI(00000000,?,?,00000104,00000000,?,00000004,?), ref: 6D5FCFEE
GetShortPathNameA.KERNEL32(?,?,00000100), ref: 6D5FD003
__itow.LIBCMT ref: 6D5FD014
CloseHandle.KERNEL32(?,?,00001000,?,?,00000000,00000103), ref: 6D5FD0BE
CloseHandle.KERNEL32(?), ref: 6D5FD0C5

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: CloseEnumHandleNameProcess$FileModuleModulesOpenPathProcessesShort__itow_malloc_memset
String ID:
API String ID: 2756701432-0
Opcode ID: 3d71553006c3ed1866c4b19820433560c2d74cea9a477e532cc38441b95f2334
Instruction ID: 8af19129795c4279f4ef58e76c4f8858d1db13b69b8736feb5a05d2f7112d1f9
Opcode Fuzzy Hash: 3d71553006c3ed1866c4b19820433560c2d74cea9a477e532cc38441b95f2334
Instruction Fuzzy Hash: 57518371608341AFD314DF68C841BEFB7E8EFC9314F018A1DE259CB290EB74A9558B96

Function 6D628C54 Relevance: 13.6, APIs: 9, Instructions: 131timekeyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 6D628C61
GetCursorPos.USER32(?), ref: 6D628C80
ScreenToClient.USER32(?,?), ref: 6D628C8D
GetCapture.USER32 ref: 6D628CE3

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

ClientToScreen.USER32(?,?), ref: 6D628D2A
WindowFromPoint.USER32(?,?), ref: 6D628D36
IsChild.USER32(?,00000000), ref: 6D628D4B
KillTimer.USER32(?,0000E001), ref: 6D628D88
KillTimer.USER32(?,0000E000), ref: 6D628DA4

Part of subcall function 6D60C635: GetForegroundWindow.USER32 ref: 6D60C649
Part of subcall function 6D60C635: GetLastActivePopup.USER32(?), ref: 6D60C65A

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: ClientKillScreenTimerWindow$ActiveCaptureChildCursorException@8ForegroundFromH_prolog3LastPointPopupStateThrow
String ID:
API String ID: 1544770960-0
Opcode ID: c039a0f45b7af21efa1c289d411007933c8c094c4034e3ca10ab858c1b258865
Instruction ID: 2a9d5e65d71ee05be9629ff0477b2553d6cbbffc8219940d0b388501790854cc
Opcode Fuzzy Hash: c039a0f45b7af21efa1c289d411007933c8c094c4034e3ca10ab858c1b258865
Instruction Fuzzy Hash: 5F41A231600606EFDF109B69CD48AAE7BB5BF58324F108B69E565D76B0EB31D948CF40

Function 6D622F8C Relevance: 12.3, APIs: 8, Instructions: 297memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D622F93

Part of subcall function 6D6213DB: SysStringLen.OLEAUT32(?), ref: 6D6213E5
Part of subcall function 6D6213DB: CoGetClassObject.OLE32(?,?,00000000,6D64FFFC,?), ref: 6D621403

CreateILockBytesOnHGlobal.OLE32(00000000,00000001,?), ref: 6D62311D
StgCreateDocfileOnILockBytes.OLE32(?,00001012,00000000,?), ref: 6D62313E
GlobalAlloc.KERNEL32(00000000,00000000), ref: 6D62318B
GlobalLock.KERNEL32(00000000), ref: 6D623199
GlobalUnlock.KERNEL32(?), ref: 6D6231B1
CreateILockBytesOnHGlobal.OLE32(8007000E,00000001,?), ref: 6D6231D4
StgOpenStorageOnILockBytes.OLE32(?,00000000,00000012,00000000,00000000,?), ref: 6D6231F0

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: GlobalLock$Bytes$Create$AllocClassDocfileH_prolog3ObjectOpenStorageStringUnlock
String ID:
API String ID: 317715441-0
Opcode ID: 238cfd2cfaa91b1c06dccb681fc23a2d639c2ada295869ebd182f46ec042cf32
Instruction ID: 6ea06a90d091173cf56608bc7e4dddb2db6243f86aeaf3c1b69db7d1d7a52215
Opcode Fuzzy Hash: 238cfd2cfaa91b1c06dccb681fc23a2d639c2ada295869ebd182f46ec042cf32
Instruction Fuzzy Hash: 87C1E6B090024AAFDB04DFA4C8889AEBBB9FF49344B10496DF915AB251C775D951CFA0

Function 6D626FDC Relevance: 10.6, APIs: 7, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D626FE3
_memset.LIBCMT ref: 6D62704F

Part of subcall function 6D61C792: _memset.LIBCMT ref: 6D61C79E

VariantClear.OLEAUT32(?), ref: 6D62708F
SysFreeString.OLEAUT32(00000000), ref: 6D627110
SysFreeString.OLEAUT32(00000000), ref: 6D62711F
SysFreeString.OLEAUT32(00000000), ref: 6D62712E
VariantClear.OLEAUT32(00000000), ref: 6D627143

Part of subcall function 6D626A9D: __EH_prolog3_GS.LIBCMT ref: 6D626AA7
Part of subcall function 6D626A9D: VariantClear.OLEAUT32(?), ref: 6D626B0C

Part of subcall function 6D61C76E: VariantCopy.OLEAUT32(?,?), ref: 6D61C77F

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Variant$ClearFreeString$_memset$CopyH_prolog3H_prolog3_
String ID:
API String ID: 3746181197-0
Opcode ID: e5e993e83032849ca1e49de57d1c81479a40116b1331fbbb693e6196d3202646
Instruction ID: 7ecc8dc407a35ae9a9a2410add45a20439dfeeb0f1e61d2c648706c3ea2d45c5
Opcode Fuzzy Hash: e5e993e83032849ca1e49de57d1c81479a40116b1331fbbb693e6196d3202646
Instruction Fuzzy Hash: 855116B1D0020ADFDB10DFA4C889BEEBBB4BF08305F148529E119E7291D775A945CF60

Function 6D61A938 Relevance: 10.6, APIs: 7, Instructions: 56networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D61A93F
WSASetLastError.WS2_32(00002726,00000018,6D602A90,127.0.0.1,000015B3), ref: 6D61A95A
_memset.LIBCMT ref: 6D61A979
inet_addr.WS2_32(?), ref: 6D61A989
gethostbyname.WS2_32(?), ref: 6D61A998
htons.WS2_32(?), ref: 6D61A9AF
WSASetLastError.WS2_32(00002726), ref: 6D61A9CF

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: ErrorLast$H_prolog3__memsetgethostbynamehtonsinet_addr
String ID:
API String ID: 3855310499-0
Opcode ID: 8bac161f347eb40ead490def0ae50c8116cb603f6f23099c10299ac959245b1b
Instruction ID: ded88c020b8918c961e67dd48808a4d902eca537d9a675ca2dfb09aa01cfc3a7
Opcode Fuzzy Hash: 8bac161f347eb40ead490def0ae50c8116cb603f6f23099c10299ac959245b1b
Instruction Fuzzy Hash: 09119A74A542089FCF00EFB9CC48AEDB7B4BF1D320F118955E509EB290D7709A89CB65

Function 6D60CDF3 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 244COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6D60CE23

Strings

@, xrefs: 6D60CF2F
AfxMDIFrame90s, xrefs: 6D60CEC4
@, xrefs: 6D60CFC8
AfxFrameOrView90s, xrefs: 6D60CEE9

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView90s$AfxMDIFrame90s
API String ID: 2102423945-455206835
Opcode ID: 24ec512162346842b59c9261fd3261c8e632179dfa950c5d2906b130989dce7e
Instruction ID: f590831dcb6c5436a3e72d7c7a3ea7a9bf06977c09565296faa03e3a7d9ffc81
Opcode Fuzzy Hash: 24ec512162346842b59c9261fd3261c8e632179dfa950c5d2906b130989dce7e
Instruction Fuzzy Hash: D4915171C44209BEEB44CFE4C684BEEBFF8AF4C384F118165EA19E6180E7748645CBA4

Function 6D5F4F00 Relevance: 7.6, APIs: 5, Instructions: 125windowCOMMON

Download Yara Rule

APIs

Rectangle.GDI32(?,?,?,?,?), ref: 6D5F4F6B
LoadBitmapA.USER32(?,000000A8), ref: 6D5F4F97
GetObjectA.GDI32(00000000,00000018,?), ref: 6D5F4FB3
CreateCompatibleDC.GDI32(?), ref: 6D5F4FCB

Part of subcall function 6D616BF1: SelectObject.GDI32(?,?), ref: 6D616BFC

StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00CC0020), ref: 6D5F5026

Part of subcall function 6D61690F: DeleteDC.GDI32(00000000), ref: 6D616921

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Object$BitmapCompatibleCreateDeleteLoadRectangleSelectStretch
String ID:
API String ID: 2912706736-0
Opcode ID: c71ea091c9a614ea80467b62d7b4d444729a8629f522993552ccc9054915e5ce
Instruction ID: b8f84a4cdfa25c17b1c0b9e197622187fa6b79abb4c6b1e090f6aff199cedc9e
Opcode Fuzzy Hash: c71ea091c9a614ea80467b62d7b4d444729a8629f522993552ccc9054915e5ce
Instruction Fuzzy Hash: 694125762083419FC314DFA9C945B6BBBE8EBC9714F00891CF69583290DB71E909CBA2

Function 6D612928 Relevance: 7.6, APIs: 5, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D60D8F2: GetDlgItem.USER32(?,?), ref: 6D60D903

SendMessageA.USER32(?,00000087,00000000,00000000), ref: 6D61296B
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 6D61297F
SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 6D6129A5
GetWindow.USER32(?,00000002), ref: 6D6129AF
GetWindowLongA.USER32(00000000,000000F0), ref: 6D6129BF

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: MessageSend$Window$ItemLong
String ID:
API String ID: 1613074769-0
Opcode ID: 6c52803e81dd9eff4746e85798d51f41bbbdd714bf4d1e223e1894390ab74cea
Instruction ID: 3d2ed4279f3d25135f9d85c6d217db42e84c844f8ff8171f487792baab6916ae
Opcode Fuzzy Hash: 6c52803e81dd9eff4746e85798d51f41bbbdd714bf4d1e223e1894390ab74cea
Instruction Fuzzy Hash: 6F115C7120424ABFDF149F69CC81FBA7B69EF4A3A4F108525FD295A2A0C7309951CB90

Function 6D616F19 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?), ref: 6D616F2B
GetDeviceCaps.GDI32(?,00000058), ref: 6D616F65
GetDeviceCaps.GDI32(?,0000005A), ref: 6D616F6E

Part of subcall function 6D6166BC: MulDiv.KERNEL32(?,00000000,00000000), ref: 6D6166FE
Part of subcall function 6D6166BC: MulDiv.KERNEL32(?,00000000,00000000), ref: 6D61671B

MulDiv.KERNEL32(?,00000060,000009EC), ref: 6D616F92
MulDiv.KERNEL32(?,?,000009EC), ref: 6D616F9D

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: b43d15228c8c03ce85cdb805212e706c2918992faa50f99c776ed5660b6ce0d7
Instruction ID: 4c154d4fed17c1b3261addab31ca1c954fa8c6e0bbe78616ceb482cb86a32af7
Opcode Fuzzy Hash: b43d15228c8c03ce85cdb805212e706c2918992faa50f99c776ed5660b6ce0d7
Instruction Fuzzy Hash: AC11C23A604604EFDB11AFAACC44E1EBBBAEF89750B118419F98557360C771EC418BD0

Function 6D616E89 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetMapMode.GDI32(?), ref: 6D616E9B
GetDeviceCaps.GDI32(?,00000058), ref: 6D616ED5
GetDeviceCaps.GDI32(?,0000005A), ref: 6D616EDE

Part of subcall function 6D616727: MulDiv.KERNEL32(?,00000000,00000000), ref: 6D616769
Part of subcall function 6D616727: MulDiv.KERNEL32(?,00000000,00000000), ref: 6D616786

MulDiv.KERNEL32(?,000009EC,00000060), ref: 6D616F02
MulDiv.KERNEL32(?,000009EC,?), ref: 6D616F0D

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 574521c7be55fd0c6864c1685e2627bdb715d614fc2268c6c49dd8c9e9d4e7e6
Instruction ID: ec833b1409b45d959ad80c1f58a8a4ecc084eb6f3469aac5ec7e8d3d3806c143
Opcode Fuzzy Hash: 574521c7be55fd0c6864c1685e2627bdb715d614fc2268c6c49dd8c9e9d4e7e6
Instruction Fuzzy Hash: 3B110276204604EFCB11AFAACC44E1EBBB9FF89750B118519F98697360C771EC418F80

Function 6D5F89A0 Relevance: 6.2, APIs: 4, Instructions: 172memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 6D5F8A30
??3@YAXPAX@Z.MSVCRT ref: 6D5F8B7C
GetProcessHeap.KERNEL32(00000000,6D5F9BB7,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D5F8BC9
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6D5F8BD0

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: ??3@Heap$FreeProcess
String ID:
API String ID: 834397476-0
Opcode ID: 1ae488f856851d8a161341c5deaebe9cac7888f6e029eef701a3ebd419981f4a
Instruction ID: dc6788e4a911b8fbacac579532151c9017a257a57412783e0f97af38c6b89c36
Opcode Fuzzy Hash: 1ae488f856851d8a161341c5deaebe9cac7888f6e029eef701a3ebd419981f4a
Instruction Fuzzy Hash: DA61A33130030B8FCB18CF6EC6D6B65B7B9FB8A304B018529D5159B6A5EB70B985CF90

Function 6D620870 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

__msize.LIBCMT ref: 6D620903
__msize.LIBCMT ref: 6D620926
_malloc.LIBCMT ref: 6D62093E
_malloc.LIBCMT ref: 6D620953

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: 9480e294dee3f9ab85159278eb2f9ac36a8c5d899c636c3fc29106832ffb5ced
Instruction ID: 100eb46c5630fcdb61bb2b431424f9c8ca4ed84b10897208327ffa67cdf84f95
Opcode Fuzzy Hash: 9480e294dee3f9ab85159278eb2f9ac36a8c5d899c636c3fc29106832ffb5ced
Instruction Fuzzy Hash: B221E4715086129FDB15DF36C8A0A6B7BA4AF4C724B128429D92ECB151DB34E890CFC4

Function 6D61ED99 Relevance: 6.0, APIs: 4, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32(00000000), ref: 6D61EDB1
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,6D61F0A4,?,00000018,6D61F3E2,?,?,?), ref: 6D61EDCA
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 6D61EDD1
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6D61F0A4,?,00000018,6D61F3E2,?,?,?), ref: 6D61EDF0

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: Byte$CharMultiStringWide$Alloc
String ID:
API String ID: 3384502665-0
Opcode ID: 5d77a6ca54a0d9a031ea3c9a0b76d61f8aba0aa6aba1262a0687b56ff9793c71
Instruction ID: 238d54372e3cf4d341e3d2e678e61fc95422630a4243a5ba4136d0cf8cca1463
Opcode Fuzzy Hash: 5d77a6ca54a0d9a031ea3c9a0b76d61f8aba0aa6aba1262a0687b56ff9793c71
Instruction Fuzzy Hash: F6F0E175906128BF9B226BA68C48CDFBE7DEF8B7E47108115F90892110D6718A55D6F0

Function 6D61484B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

_ftell.LIBCMT ref: 6D614855
_fseek.LIBCMT ref: 6D61487B
_ftell.LIBCMT ref: 6D614899
_fseek.LIBCMT ref: 6D6148AC

Part of subcall function 6D62E9B1: __getptd_noexit.LIBCMT ref: 6D62E9B1

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: _fseek_ftell$__getptd_noexit
String ID:
API String ID: 447802652-0
Opcode ID: 7525f966b1003aafb69fa3024d5d807435651de4017d63297074a7f94b64618d
Instruction ID: 3d85d266e72239ccb95d609fc8ecd2639649c30acebe9bcbfd1ba353f570e194
Opcode Fuzzy Hash: 7525f966b1003aafb69fa3024d5d807435651de4017d63297074a7f94b64618d
Instruction Fuzzy Hash: 0C01F432A1C7602FD66016399C41F0737A59F8D338F120A39FB28A70E0EB92EC10CA50

Function 6D624D66 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 6D624DA1

Strings

(, xrefs: 6D624EB1

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: ClearVariant
String ID: (
API String ID: 1473721057-3887548279
Opcode ID: bde25b553ff03b9a5f28bc787d5ea842cd222a15e91dfec9c575ed447b75768a
Instruction ID: c4c84ab3aad215ae04acdd8f343f4eccab7553b779dfd73cdb28a7be4320f19e
Opcode Fuzzy Hash: bde25b553ff03b9a5f28bc787d5ea842cd222a15e91dfec9c575ed447b75768a
Instruction Fuzzy Hash: 30512371A00B119FDB68CF68CA8196AB7F5BF4C314B504A6DE69787A91C7B0F881CF44

Function 6D622DD5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D622DDC

Part of subcall function 6D607467: __CxxThrowException@8.LIBCMT ref: 6D60747D
Part of subcall function 6D607467: __EH_prolog3.LIBCMT ref: 6D60748A

VariantClear.OLEAUT32(?), ref: 6D622F7D

Strings

@, xrefs: 6D622E3F

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: H_prolog3$ClearException@8ThrowVariant
String ID: @
API String ID: 476054370-2766056989
Opcode ID: a7a56818c99fd848754eb5968c250647ba86b361987f219d823084fbefce2be4
Instruction ID: 9c279b9142a614daaabae62bca4b834be58fa6a7c1ac96f97f3082ed25de8a7a
Opcode Fuzzy Hash: a7a56818c99fd848754eb5968c250647ba86b361987f219d823084fbefce2be4
Instruction Fuzzy Hash: 0A51D570A0020A9FDB14CFA8C894AEEB7F9BF4D304F10856EE516EB251E774A945CF50

Function 6D614C8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetMenuStringA.USER32(?,6D646930,00000000,00000000,00000000), ref: 6D614CAC
GetMenuStringA.USER32(?,6D646930,00000000,00000001,00000000), ref: 6D614CCD

Strings

0idm, xrefs: 6D614C94, 6D614CB8

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: MenuString
String ID: 0idm
API String ID: 3453713332-2767938644
Opcode ID: a0a5e8b6102cb3929ac82b7dbeb6e4aa757c20a95cf968403d6183781117be5c
Instruction ID: 3fda4435fc6efa0326b84149e5709a630bd307f94c5a677fbbff546fb81b5e4c
Opcode Fuzzy Hash: a0a5e8b6102cb3929ac82b7dbeb6e4aa757c20a95cf968403d6183781117be5c
Instruction Fuzzy Hash: 7CF0C276104209BFCB059F89CD41EDE7B6EEB8C364F148112FA2457150CB71E920DBA0

Function 6D620ECE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D620ED5
InterlockedIncrement.KERNEL32(?), ref: 6D620F1F

Strings

Lw, xrefs: 6D620F1F

Memory Dump Source

Source File: 00000005.00000002.1357374614.000000006D5F1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6D5F0000, based on PE: true

Associated: 00000005.00000002.1357322840.000000006D5F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357429829.000000006D646000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357447687.000000006D65B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.1357509137.000000006D662000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6d5f0000_rundll32.jbxd

Similarity

API ID: H_prolog3_catchIncrementInterlocked
String ID: Lw
API String ID: 1794289173-4278538321
Opcode ID: 057695b333ed587818e9fda57e1829efea74c1733d03156d46226e4136de861f
Instruction ID: d17c5d19bf392c51a908bef5a2a680592c8387fa104529c4f799c22ec632cae9
Opcode Fuzzy Hash: 057695b333ed587818e9fda57e1829efea74c1733d03156d46226e4136de861f
Instruction Fuzzy Hash: CE018C71904205EFDB10DF68C884BADBBB0BF08319F108624E9189B2C1C774DA44CB84

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LisectAVT_2403002B_136.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Windows Analysis Report
LisectAVT_2403002B_136.dll

Function 100050CF Relevance: 41.1, Strings: 32, Instructions: 1098
COMMON

Function 6D5F9E50 Relevance: 38.9, APIs: 19, Strings: 3, Instructions: 385
memoryCOMMONLIBRARYCODE

Function 10008844 Relevance: 9.0, Strings: 7, Instructions: 256
COMMON

Function 10020E7A Relevance: 9.0, Strings: 7, Instructions: 248
COMMON

Function 10018131 Relevance: 7.8, Strings: 6, Instructions: 273
COMMON

Function 6D5F8F00 Relevance: 7.0, APIs: 4, Instructions: 1014
memoryCOMMONLIBRARYCODE

Function 1001416E Relevance: 5.3, Strings: 4, Instructions: 331
COMMON

Function 1000A9CF Relevance: 5.2, Strings: 4, Instructions: 221
COMMON

Function 1001D15E Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Function 100082D2 Relevance: 3.9, Strings: 3, Instructions: 184
COMMON

Function 10008FE9 Relevance: 3.9, Strings: 3, Instructions: 130
COMMON

Function 6D61FB51 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre