42232

Creates DOM elementMSVC /clr DllMain diagnostic
SHA-2560f82fa26cab82e203bcd99a39e0d306b9fa42e68f5793b946e45a75fc4cbbfe4

Evidence

x86 indirect call through a global pointer 0xe19–0xed9
⋯3 more rows
0xe4985c075035b5dc30fb7086685c9742756..u.[]....f..t'V
0xe598b3568e1001057668b7d0c663bcf7412.5h...Wf.}.f;.t.
0xe6950ffd60fb7086685c975f05f5e8bc35bP.....f..u._^..[
⋯7 more rows
COM unload export present 0x1e10–0x1ed0
⋯3 more rows
0x1e40bd54feffff89bd58feffff89bd5cfeff.T.....X.....\..
0x1e50ff89bd60feffff89bd64feffffe84eec...`.....d....N.
0x1e60ffff8b1d00e0001085c075458b8d58fe..........uE..X.
⋯7 more rows
COM registration export 0x45f0–0x46d0
⋯3 more rows
0x462089480c89481089481489481889481c88.H..H..H..H..H..
0x46304820c70050ec00108bf0eb0233f6c745H ..P.......3..E
0x4640fcffffffff3bf374648b450833ff578d.....;.td.E.3.W.
0x46505e0853894624ff1548e0001085c0751a^.S.F$..H.....u.
0x4660ff1564e0001085c07e0a25ffff00000d..d.....~.%.....
⋯7 more rows
Inline MZ header validation constant 0xae78–0xaf48
⋯3 more rows
0xaea8cccccccccccccccc8bff558bec8b4d08..........U...M.
0xaeb8b84d5a0000663901740433c05dc38b41.MZ..f9.t.3.]..A
0xaec83c03c181385045000075ef33d2b90b01<...8PE..u.3....
0xaed80000663948180f94c28bc25dc3cccccc..f9H......]....
⋯7 more rows
Binary imports ADVAPI32.dll 0xca74–0xcd64
⋯3 more rows
0xcaa4440065006c0065007400650000000000D.e.l.e.t.e.....
0xcab44e006f00520065006d006f0076006500N.o.R.e.m.o.v.e.
0xcac40000000046006f007200630065005200....F.o.r.c.e.R.
0xcad465006d006f0076006500000056006100e.m.o.v.e...V.a.
⋯10 more rows
0xcb84350031006500390031006500000000005.1.e.9.1.e.....
0xcb945265674f70656e4b65795472616e7361RegOpenKeyTransa
0xcba463746564570000004100640076006100ctedW...A.d.v.a.
0xcbb470006900330032002e0064006c006c00p.i.3.2...d.l.l.
0xcbc4000000005265674372656174654b6579....RegCreateKey
0xcbd45472616e736163746564570052656744TransactedW.RegD
0xcbe4656c6574654b65795472616e73616374eleteKeyTransact
0xcbf46564570052656744656c6574654b6579edW.RegDeleteKey
0xcc044578570078e400100000008084e40010ExW.x...........
⋯6 more rows
0xcc740500008048004b004300520000000000....H.K.C.R.....
0xcc8448004b00430055000000000048004b00H.K.C.U.....H.K.
0xcc944c004d000000000048004b0055000000L.M.....H.K.U...
⋯3 more rows
0xccd44c00410053005300450053005f005200L.A.S.S.E.S._.R.
0xcce44f004f005400000048004b0045005900O.O.T...H.K.E.Y.
0xccf45f00430055005200520045004e005400_.C.U.R.R.E.N.T.
0xcd045f005500530045005200000048004b00_.U.S.E.R...H.K.
⋯6 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.