Edit tour

Windows Analysis Report
TiNgny4xSB.dll

Overview

General Information

Sample name:	TiNgny4xSB.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original sample name:	1552c43ecf6eeb5e2fe13cc1c25e6bdacf227222afaa9a523d996b6331945505.exe
Analysis ID:	1576561
MD5:	e5ec8b7cf88c66f78d607f76a2095fda
SHA1:	fda7752c604ff7673ae31dc45a8f0a9dd0a3a6ac
SHA256:	1552c43ecf6eeb5e2fe13cc1c25e6bdacf227222afaa9a523d996b6331945505
Tags:	94-232-40-41exeuser-JAMESWT_MHT
Infos:

Detection

BruteRatel

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Yara detected BruteRatel

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Creates a thread in another existing process (thread injection)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Modifies the context of a thread in another process (thread injection)

Sets debug register (to hijack the execution of another thread)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 2124 cmdline: loaddll64.exe "C:\Users\user\Desktop\TiNgny4xSB.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 5252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1284 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 4940 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4248 cmdline: rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMAddNewDesktop MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 4228 cmdline: C:\Windows\system32\WerFault.exe -u -p 4248 -s 496 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 2492 cmdline: rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMEnumDesktopInfos MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 4092 cmdline: C:\Windows\system32\WerFault.exe -u -p 2492 -s 492 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7208 cmdline: rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMEnumDesktops MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7248 cmdline: C:\Windows\system32\WerFault.exe -u -p 7208 -s 488 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7336 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMAddNewDesktop MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7344 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMEnumDesktopInfos MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7360 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMEnumDesktops MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7380 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nviewExecute MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7388 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewUnload MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7396 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewUninstallNotify MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7404 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewLoadHook MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7412 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewCmd MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7420 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",WMSetSettingHWND MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7428 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",WMParseSetting MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7436 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMUpdate MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7444 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMSetStartupProfile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7452 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMSave MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7460 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLock MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7468 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoadEx MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7476 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoadApp MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7488 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoad MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7500 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMImport MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7556 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetStartupProfile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7564 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileInfoEx MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7572 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileInfo MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7580 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileDirectory MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7588 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetCurrentProfile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7596 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMFindProfile MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7604 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMEnum MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7612 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMDelete MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7620 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",NViewUserInterfaceSetting MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7628 cmdline: rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",NViewGlobalSetting MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Brute Ratel C4, BruteRatel	Brute Ratel C4 (BRC4) is a commercial framework for red-teaming and adversarial attack simulation, which made its first appearance in December 2020. It was specifically designed to evade detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. BRC4 allows operators to deploy a backdoor agent known as Badger (aka BOLDBADGER) within a target environment.This agent enables arbitrary command execution, facilitating lateral movement, privilege escalation, and the establishment of additional persistence avenues. The Badger backdoor agent can communicate with a remote server via DNS over HTTPS, HTTP, HTTPS, SMB, and TCP, using custom encrypted channels. It supports a variety of backdoor commands including shell command execution, file transfers, file execution, and credential harvesting. Additionally, the Badger agent can perform tasks such as port scanning, screenshot capturing, and keystroke logging. Notably, in September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.	No Attribution	https://0xdarkvortex.dev/hiding-in-plainsight/ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities https://blog.krakz.fr/articles/latrodectus/ https://blog.reveng.ai/latrodectus-distribution-via-brc4/	https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000015.00000002.3015117531.0000021809ECC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000015.00000002.3020109408.000002180A014000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000015.00000002.3015117531.0000021809F74000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 7412	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: TiNgny4xSB.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: iew\v200\_out\x64-Release\nView64.pdb source: loaddll64.exe, 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.2017241775.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.2063446205.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.2038080623.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.1894351341.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.1892964336.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1904111570.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1892195591.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1910034546.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.1909695071.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.3021072359.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.1892719132.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1903209631.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.1909851161.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1905333875.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1889094484.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1893034192.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1883015462.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1905882228.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1910838284.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1908677619.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1909988393.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1910203790.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1907659400.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000024.00000002.1892965927.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.1886313131.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000027.00000002.1910555538.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, TiNgny4xSB.dll
Source:	Binary string: D:\workspace\workspace\nViewBranchBcDQ%ag&CC(NuA9u@W@o$iew\v200\_out\x64-Release\nView64.pdbU source: loaddll64.exe, 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.2017241775.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.2063446205.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.2038080623.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.1894351341.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.1892964336.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1904111570.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1892195591.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1910034546.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.1909695071.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.3021072359.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.1892719132.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1903209631.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.1909851161.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1905333875.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1889094484.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1893034192.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1883015462.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1905882228.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1910838284.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1908677619.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1909988393.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1910203790.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1907659400.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000024.00000002.1892965927.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.1886313131.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000027.00000002.1910555538.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, TiNgny4xSB.dll

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB50BD20 RegOpenKeyExW,RegQueryValueExW,RegCloseKey,MessageBoxW,ShellExecuteW,GetSystemDirectoryW,wsprintfW,FindFirstFileW,MessageBoxW,ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FFDFB50BD20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB510B20 FindFirstFileW,lstrcmpW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,	0_2_00007FFDFB510B20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB510EC0 FindFirstFileW,FindClose,	0_2_00007FFDFB510EC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5044E5 GetCommandLineW,CommandLineToArgvW,lstrcmpW,lstrcmpW,GetCurrentProcess,IsWow64Process,MessageBoxW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrlenW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,FindFirstFileW,FindClose,GetTempFileNameW,CopyFileW,lstrcmpW,lstrcmpW,FindWindowW,SendMessageW,IsWindow,PostMessageW,SHDeleteKeyW,lstrcmpW,lstrlenW,lstrcmpW,lstrcmpW,LocalFree,	0_2_00007FFDFB5044E5

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_04504176a318ef6a4711c8eb84999e6f6eb1_8f532422_fab5e15b-9538-4913-9e97-d15e50033763\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_916a7d8f75978f3384e540b6f642fd74f32736_8f532422_007882f3-b647-418e-b212-463ae2cad8a6\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.46.11 8817
Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.40.41 8817

Source: global traffic	TCP traffic: 192.168.2.4:49741 -> 94.232.40.41:8817
Source: global traffic	TCP traffic: 192.168.2.4:49752 -> 94.232.46.11:8817

Source: Joe Sandbox View	ASN Name: WELLWEBNL WELLWEBNL
Source: Joe Sandbox View	ASN Name: WELLWEBNL WELLWEBNL

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: cronoze.com
Source: global traffic	DNS traffic detected: DNS query: muuxxu.com

Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com/
Source: rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/pentium.php
Source: rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/pentium.php#
Source: rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cronoze.com:8817/pentium.php-%
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com/
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com/=k
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com/s
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com:8817/pentium.php
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com:8817/pentium.php2k
Source: rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://muuxxu.com:8817/pentium.php6h

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB506A10 GetSystemMetrics,GetAsyncKeyState,

0_2_00007FFDFB506A10

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB50D460 CreateMutexW,GetLastError,WaitForSingleObject,CreateProcessAsUserW,CloseHandle,CloseHandle,ReleaseMutex,CloseHandle,_invalid_parameter_noinfo_noreturn,RegSetValueExW,RegCloseKey,SendMessageW,RegQueryValueExW,RegCloseKey,

0_2_00007FFDFB50D460

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB547CA4	0_2_00007FFDFB547CA4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F3AC0	0_2_00007FFDFB4F3AC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB541AE4	0_2_00007FFDFB541AE4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5E59E0	0_2_00007FFDFB5E59E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB533888	0_2_00007FFDFB533888
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5CB880	0_2_00007FFDFB5CB880
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4FF920	0_2_00007FFDFB4FF920
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5038F0	0_2_00007FFDFB5038F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB503F90	0_2_00007FFDFB503F90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB545EC0	0_2_00007FFDFB545EC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB501F50	0_2_00007FFDFB501F50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB561D98	0_2_00007FFDFB561D98
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB50BD20	0_2_00007FFDFB50BD20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB547248	0_2_00007FFDFB547248
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5CD1E0	0_2_00007FFDFB5CD1E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB511150	0_2_00007FFDFB511150
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB507150	0_2_00007FFDFB507150
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB50F7B0	0_2_00007FFDFB50F7B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB549790	0_2_00007FFDFB549790
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB547720	0_2_00007FFDFB547720
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB50B5B0	0_2_00007FFDFB50B5B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB547560	0_2_00007FFDFB547560
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB50F5E0	0_2_00007FFDFB50F5E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB50D460	0_2_00007FFDFB50D460
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB532BA0	0_2_00007FFDFB532BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB55EB98	0_2_00007FFDFB55EB98
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB570C00	0_2_00007FFDFB570C00
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5D4AD0	0_2_00007FFDFB5D4AD0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB546B40	0_2_00007FFDFB546B40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB546994	0_2_00007FFDFB546994
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F0A40	0_2_00007FFDFB4F0A40
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5469F4	0_2_00007FFDFB5469F4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB504ED0	0_2_00007FFDFB504ED0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB502E60	0_2_00007FFDFB502E60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4FEE50	0_2_00007FFDFB4FEE50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F4D30	0_2_00007FFDFB4F4D30
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5CECE0	0_2_00007FFDFB5CECE0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5AA3B0	0_2_00007FFDFB5AA3B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5C4380	0_2_00007FFDFB5C4380
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5CE430	0_2_00007FFDFB5CE430
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5021B0	0_2_00007FFDFB5021B0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5D81E0	0_2_00007FFDFB5D81E0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4EE110	0_2_00007FFDFB4EE110
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB54679C	0_2_00007FFDFB54679C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB516800	0_2_00007FFDFB516800
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB51E67C	0_2_00007FFDFB51E67C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB50E750	0_2_00007FFDFB50E750
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB560498	0_2_00007FFDFB560498
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB516460	0_2_00007FFDFB516460
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB500490	0_2_00007FFDFB500490
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB590500	0_2_00007FFDFB590500
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5044E5	0_2_00007FFDFB5044E5
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB4F8510	0_2_00007FFDFB4F8510
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004437C	0_2_000000018004437C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180037788	0_2_0000000180037788
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002600C	0_2_000000018002600C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002A01C	0_2_000000018002A01C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800462C4	0_2_00000001800462C4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000A314	0_2_000000018000A314
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800423EC	0_2_00000001800423EC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001A47C	0_2_000000018001A47C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180012550	0_2_0000000180012550
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003A554	0_2_000000018003A554
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003E704	0_2_000000018003E704
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180016744	0_2_0000000180016744
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800147EC	0_2_00000001800147EC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180026890	0_2_0000000180026890
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003A904	0_2_000000018003A904
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800329B4	0_2_00000001800329B4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180042A10	0_2_0000000180042A10
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180008D6C	0_2_0000000180008D6C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180032E14	0_2_0000000180032E14
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180048E5A	0_2_0000000180048E5A
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180036E70	0_2_0000000180036E70
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180024F60	0_2_0000000180024F60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018000AF74	0_2_000000018000AF74
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180019020	0_2_0000000180019020
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180013078	0_2_0000000180013078
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003D08C	0_2_000000018003D08C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800330A8	0_2_00000001800330A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B138	0_2_000000018001B138
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003713C	0_2_000000018003713C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180033278	0_2_0000000180033278
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001F28C	0_2_000000018001F28C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003B294	0_2_000000018003B294
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800193F0	0_2_00000001800193F0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003B508	0_2_000000018003B508
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018004363C	0_2_000000018004363C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800176E4	0_2_00000001800176E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800097A8	0_2_00000001800097A8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800197C0	0_2_00000001800197C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180047834	0_2_0000000180047834
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800158A0	0_2_00000001800158A0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018003D91C	0_2_000000018003D91C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001B924	0_2_000000018001B924
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00000001800279B8	0_2_00000001800279B8
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180045A60	0_2_0000000180045A60
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018001FA9C	0_2_000000018001FA9C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180013BA0	0_2_0000000180013BA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180029D90	0_2_0000000180029D90
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180015EA0	0_2_0000000180015EA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002FF50	0_2_000000018002FF50
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB911B450	0_2_000001ABB911B450
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB913C4DC	0_2_000001ABB913C4DC
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB9113524	0_2_000001ABB9113524
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB910A77C	0_2_000001ABB910A77C
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB911A794	0_2_000001ABB911A794
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB91157C0	0_2_000001ABB91157C0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB91439E4	0_2_000001ABB91439E4
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB9116874	0_2_000001ABB9116874
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000001ABB9114B74	0_2_000001ABB9114B74
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018004437C	3_2_000000018004437C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180037788	3_2_0000000180037788
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800147EC	3_2_00000001800147EC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002600C	3_2_000000018002600C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002A01C	3_2_000000018002A01C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180019020	3_2_0000000180019020
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180047834	3_2_0000000180047834
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180013078	3_2_0000000180013078
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018003D08C	3_2_000000018003D08C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180026890	3_2_0000000180026890
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800158A0	3_2_00000001800158A0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800330A8	3_2_00000001800330A8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018003A904	3_2_000000018003A904
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018003D91C	3_2_000000018003D91C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018001B924	3_2_000000018001B924
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018001B138	3_2_000000018001B138
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018003713C	3_2_000000018003713C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800329B4	3_2_00000001800329B4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800279B8	3_2_00000001800279B8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180042A10	3_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180045A60	3_2_0000000180045A60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180033278	3_2_0000000180033278
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018001F28C	3_2_000000018001F28C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018003B294	3_2_000000018003B294
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018001FA9C	3_2_000000018001FA9C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800462C4	3_2_00000001800462C4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018000A314	3_2_000000018000A314
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180013BA0	3_2_0000000180013BA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800193F0	3_2_00000001800193F0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800423EC	3_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018001A47C	3_2_000000018001A47C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018003B508	3_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180012550	3_2_0000000180012550
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018003A554	3_2_000000018003A554
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180008D6C	3_2_0000000180008D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180029D90	3_2_0000000180029D90
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180032E14	3_2_0000000180032E14
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018004363C	3_2_000000018004363C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180048E5A	3_2_0000000180048E5A
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180036E70	3_2_0000000180036E70
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180015EA0	3_2_0000000180015EA0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800176E4	3_2_00000001800176E4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018003E704	3_2_000000018003E704
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180016744	3_2_0000000180016744
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002FF50	3_2_000000018002FF50
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180024F60	3_2_0000000180024F60
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018000AF74	3_2_000000018000AF74
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800097A8	3_2_00000001800097A8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_00000001800197C0	3_2_00000001800197C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D4B450	3_2_0000023728D4B450
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D44B74	3_2_0000023728D44B74
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D43524	3_2_0000023728D43524
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D39D40	3_2_0000023728D39D40
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D6C4DC	3_2_0000023728D6C4DC
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D67E44	3_2_0000023728D67E44
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D5AD64	3_2_0000023728D5AD64
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D3BF48	3_2_0000023728D3BF48
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D46E74	3_2_0000023728D46E74
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D4404C	3_2_0000023728D4404C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D5AFF0	3_2_0000023728D5AFF0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D56FE0	3_2_0000023728D56FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D457C0	3_2_0000023728D457C0
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D4A794	3_2_0000023728D4A794
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D3A77C	3_2_0000023728D3A77C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D46874	3_2_0000023728D46874
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D6E060	3_2_0000023728D6E060
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D6407C	3_2_0000023728D6407C
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D739E4	3_2_0000023728D739E4
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D3B2E8	3_2_0000023728D3B2E8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D6C268	3_2_0000023728D6C268
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018004437C	4_2_000000018004437C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180037788	4_2_0000000180037788
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800147EC	4_2_00000001800147EC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002600C	4_2_000000018002600C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002A01C	4_2_000000018002A01C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180019020	4_2_0000000180019020
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180047834	4_2_0000000180047834
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180013078	4_2_0000000180013078
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003D08C	4_2_000000018003D08C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180026890	4_2_0000000180026890
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800158A0	4_2_00000001800158A0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800330A8	4_2_00000001800330A8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003A904	4_2_000000018003A904
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003D91C	4_2_000000018003D91C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001B924	4_2_000000018001B924
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001B138	4_2_000000018001B138
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003713C	4_2_000000018003713C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800329B4	4_2_00000001800329B4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800279B8	4_2_00000001800279B8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180042A10	4_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180045A60	4_2_0000000180045A60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180033278	4_2_0000000180033278
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001F28C	4_2_000000018001F28C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003B294	4_2_000000018003B294
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001FA9C	4_2_000000018001FA9C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800462C4	4_2_00000001800462C4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000A314	4_2_000000018000A314
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180013BA0	4_2_0000000180013BA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800193F0	4_2_00000001800193F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800423EC	4_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018001A47C	4_2_000000018001A47C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003B508	4_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180012550	4_2_0000000180012550
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003A554	4_2_000000018003A554
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008D6C	4_2_0000000180008D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180029D90	4_2_0000000180029D90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180032E14	4_2_0000000180032E14
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018004363C	4_2_000000018004363C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180048E5A	4_2_0000000180048E5A
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180036E70	4_2_0000000180036E70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180015EA0	4_2_0000000180015EA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800176E4	4_2_00000001800176E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018003E704	4_2_000000018003E704
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180016744	4_2_0000000180016744
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002FF50	4_2_000000018002FF50
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180024F60	4_2_0000000180024F60
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000AF74	4_2_000000018000AF74
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800097A8	4_2_00000001800097A8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800197C0	4_2_00000001800197C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F78C268	4_2_000002BD9F78C268
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F75B2E8	4_2_000002BD9F75B2E8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F7939E4	4_2_000002BD9F7939E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F766874	4_2_000002BD9F766874
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F78407C	4_2_000002BD9F78407C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F78E060	4_2_000002BD9F78E060
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F76404C	4_2_000002BD9F76404C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F76A794	4_2_000002BD9F76A794
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F75A77C	4_2_000002BD9F75A77C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F75BF48	4_2_000002BD9F75BF48
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F77AFF0	4_2_000002BD9F77AFF0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F776FE0	4_2_000002BD9F776FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F7657C0	4_2_000002BD9F7657C0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F766E74	4_2_000002BD9F766E74
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F787E44	4_2_000002BD9F787E44
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F77AD64	4_2_000002BD9F77AD64
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F759D40	4_2_000002BD9F759D40
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F763524	4_2_000002BD9F763524
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F76B450	4_2_000002BD9F76B450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F78C4DC	4_2_000002BD9F78C4DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F764B74	4_2_000002BD9F764B74
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018004437C	8_2_000000018004437C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180037788	8_2_0000000180037788
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800147EC	8_2_00000001800147EC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018002600C	8_2_000000018002600C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018002A01C	8_2_000000018002A01C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180019020	8_2_0000000180019020
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180047834	8_2_0000000180047834
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180013078	8_2_0000000180013078
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018003D08C	8_2_000000018003D08C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180026890	8_2_0000000180026890
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800158A0	8_2_00000001800158A0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800330A8	8_2_00000001800330A8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018003A904	8_2_000000018003A904
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018003D91C	8_2_000000018003D91C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018001B924	8_2_000000018001B924
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018001B138	8_2_000000018001B138
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018003713C	8_2_000000018003713C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800329B4	8_2_00000001800329B4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800279B8	8_2_00000001800279B8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180042A10	8_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180045A60	8_2_0000000180045A60
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180033278	8_2_0000000180033278
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018001F28C	8_2_000000018001F28C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018003B294	8_2_000000018003B294
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018001FA9C	8_2_000000018001FA9C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800462C4	8_2_00000001800462C4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018000A314	8_2_000000018000A314
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180013BA0	8_2_0000000180013BA0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800193F0	8_2_00000001800193F0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800423EC	8_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018001A47C	8_2_000000018001A47C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018003B508	8_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180012550	8_2_0000000180012550
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018003A554	8_2_000000018003A554
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180008D6C	8_2_0000000180008D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180029D90	8_2_0000000180029D90
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180032E14	8_2_0000000180032E14
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018004363C	8_2_000000018004363C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180048E5A	8_2_0000000180048E5A
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180036E70	8_2_0000000180036E70
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180015EA0	8_2_0000000180015EA0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800176E4	8_2_00000001800176E4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018003E704	8_2_000000018003E704
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180016744	8_2_0000000180016744
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018002FF50	8_2_000000018002FF50
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180024F60	8_2_0000000180024F60
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018000AF74	8_2_000000018000AF74
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800097A8	8_2_00000001800097A8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_00000001800197C0	8_2_00000001800197C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD76874	8_2_000002754DD76874
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD9E060	8_2_000002754DD9E060
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD9407C	8_2_000002754DD9407C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD7404C	8_2_000002754DD7404C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD8AFF0	8_2_000002754DD8AFF0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD86FE0	8_2_000002754DD86FE0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD74B74	8_2_000002754DD74B74
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD6B2E8	8_2_000002754DD6B2E8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD9C268	8_2_000002754DD9C268
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DDA39E4	8_2_000002754DDA39E4
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD8AD64	8_2_000002754DD8AD64
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD73524	8_2_000002754DD73524
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD69D40	8_2_000002754DD69D40
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD9C4DC	8_2_000002754DD9C4DC
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD7B450	8_2_000002754DD7B450
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD757C0	8_2_000002754DD757C0
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD7A794	8_2_000002754DD7A794
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD6A77C	8_2_000002754DD6A77C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD6BF48	8_2_000002754DD6BF48
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD76E74	8_2_000002754DD76E74
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD97E44	8_2_000002754DD97E44

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180007B54 appears 51 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 0000000180007B1C appears 114 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000000018002CC54 appears 117 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00000001800389F4 appears 48 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00000001800020F0 appears 42 times
Source: C:\Windows\System32\loaddll64.exe	Code function: String function: 000000018002CC54 appears 39 times
Source: C:\Windows\System32\loaddll64.exe	Code function: String function: 0000000180007B1C appears 38 times
Source: C:\Windows\System32\loaddll64.exe	Code function: String function: 00007FFDFB507E10 appears 61 times

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4248 -s 496

Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSES.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSAR.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSZHT.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSCS.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSDE.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSEL.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenamenView.dllf# vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSFI.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSFR.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSHE.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSHU.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSIT.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSJA.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSKO.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSNL.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSNO.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSPL.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSPTB.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSRU.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSSK.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSSV.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSTH.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSTR.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSUK.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSSL.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSZHC.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSDA.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSESM.dllV vs TiNgny4xSB.dll
Source: TiNgny4xSB.dll	Binary or memory string: OriginalFilenameNVWRSPT.dllV vs TiNgny4xSB.dll

Source: classification engine

Classification label: mal88.troj.evad.winDLL@122/14@3/2

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB507720 GetLastError,FormatMessageW,LocalFree,

0_2_00007FFDFB507720

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB5D3010 CoInitialize,CoCreateInstance,

0_2_00007FFDFB5D3010

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\user\NTUSER.DAT.Not

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2492
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5252:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4248
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7208

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\c7bee0ff-5da8-48a8-9d52-cd3a1b231709

Jump to behavior

Source: TiNgny4xSB.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMAddNewDesktop

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\TiNgny4xSB.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMAddNewDesktop
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4248 -s 496
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMEnumDesktopInfos
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2492 -s 492
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMEnumDesktops
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7208 -s 488
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMAddNewDesktop
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMEnumDesktopInfos
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMEnumDesktops
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nviewExecute
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewUnload
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewUninstallNotify
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewLoadHook
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewCmd
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",WMSetSettingHWND
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",WMParseSetting
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMUpdate
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMSetStartupProfile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMSave
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLock
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoadEx
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoadApp
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoad
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMImport
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetStartupProfile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileInfoEx
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileInfo
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileDirectory
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetCurrentProfile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMFindProfile
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMEnum
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMDelete
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",NViewUserInterfaceSetting
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",NViewGlobalSetting
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMAddNewDesktop	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMEnumDesktopInfos	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMEnumDesktops	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMAddNewDesktop	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMEnumDesktopInfos	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMEnumDesktops	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nviewExecute	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewUnload	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewUninstallNotify	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewLoadHook	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewCmd	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",WMSetSettingHWND	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",WMParseSetting	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMUpdate	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMSetStartupProfile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMSave	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLock	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoadEx	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoadApp	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoad	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMImport	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetStartupProfile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileInfoEx	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileInfo	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileDirectory	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetCurrentProfile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMFindProfile	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMEnum	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMDelete	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",NViewUserInterfaceSetting	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",NViewGlobalSetting	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: TiNgny4xSB.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: TiNgny4xSB.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: TiNgny4xSB.dll

Static file information: File size 3112960 > 1048576

Source: TiNgny4xSB.dll	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x16ea00
Source: TiNgny4xSB.dll	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x111800

Source: TiNgny4xSB.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: TiNgny4xSB.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: TiNgny4xSB.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: TiNgny4xSB.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TiNgny4xSB.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: TiNgny4xSB.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: TiNgny4xSB.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: TiNgny4xSB.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: iew\v200\_out\x64-Release\nView64.pdb source: loaddll64.exe, 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.2017241775.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.2063446205.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.2038080623.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.1894351341.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.1892964336.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1904111570.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1892195591.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1910034546.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.1909695071.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.3021072359.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.1892719132.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1903209631.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.1909851161.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1905333875.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1889094484.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1893034192.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1883015462.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1905882228.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1910838284.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1908677619.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1909988393.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1910203790.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1907659400.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000024.00000002.1892965927.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.1886313131.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000027.00000002.1910555538.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, TiNgny4xSB.dll
Source:	Binary string: D:\workspace\workspace\nViewBranchBcDQ%ag&CC(NuA9u@W@o$iew\v200\_out\x64-Release\nView64.pdbU source: loaddll64.exe, 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000003.00000002.2017241775.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000008.00000002.2063446205.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000B.00000002.2038080623.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.1894351341.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.1892964336.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.1904111570.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.1892195591.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.1910034546.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000014.00000002.1909695071.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.3021072359.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000016.00000002.1892719132.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.1903209631.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000018.00000002.1909851161.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000019.00000002.1905333875.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001A.00000002.1889094484.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001B.00000002.1893034192.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001C.00000002.1883015462.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001D.00000002.1905882228.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001E.00000002.1910838284.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000001F.00000002.1908677619.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000021.00000002.1909988393.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000022.00000002.1910203790.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000023.00000002.1907659400.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000024.00000002.1892965927.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000025.00000002.1886313131.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000027.00000002.1910555538.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmp, TiNgny4xSB.dll

Source: TiNgny4xSB.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: TiNgny4xSB.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: TiNgny4xSB.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: TiNgny4xSB.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: TiNgny4xSB.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB5EAC30 LoadLibraryW,GetProcAddress,MonitorFromPoint,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,GetDC,GetDeviceCaps,ReleaseDC,GetDC,GetDeviceCaps,ReleaseDC,

0_2_00007FFDFB5EAC30

Source: TiNgny4xSB.dll

Static PE information: real checksum: 0x259992 should be: 0x2f8529

Source: TiNgny4xSB.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_000000018002CF10 push rsp; iretd	0_2_000000018002CF11
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_000000018002CF10 push rsp; iretd	3_2_000000018002CF11
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000023728D48D98 push ebp; iretd	3_2_0000023728D48D9C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018002CF10 push rsp; iretd	4_2_000000018002CF11
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000002BD9F768D98 push ebp; iretd	4_2_000002BD9F768D9C
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000000018002CF10 push rsp; iretd	8_2_000000018002CF11
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_000002754DD78D98 push ebp; iretd	8_2_000002754DD78D9C

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB50E750 MessageBoxW,lstrlenW,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetForegroundWindow,PostMessageW,MessageBoxW,ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendMessageW,

0_2_00007FFDFB50E750

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00000001800329B4 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00000001800329B4

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\loaddll64.exe

Code function: GetCurrentProcessId,GetCommandLineW,GetModuleFileNameW,CharLowerW,GetCommandLineW,CommandLineToArgvW,LocalFree,StrStrIW,GetFileVersionInfoSizeW,GetFileVersionInfoW,VerQueryValueW,_invalid_parameter_noinfo_noreturn,StrStrIW,

0_2_00007FFDFB504ED0

Source: C:\Windows\System32\loaddll64.exe	API coverage: 1.5 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 6.5 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 7.6 %
Source: C:\Windows\System32\rundll32.exe	API coverage: 6.5 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB50BD20 RegOpenKeyExW,RegQueryValueExW,RegCloseKey,MessageBoxW,ShellExecuteW,GetSystemDirectoryW,wsprintfW,FindFirstFileW,MessageBoxW,ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FFDFB50BD20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB510B20 FindFirstFileW,lstrcmpW,FindNextFileW,FindClose,_invalid_parameter_noinfo_noreturn,	0_2_00007FFDFB510B20
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB510EC0 FindFirstFileW,FindClose,	0_2_00007FFDFB510EC0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB5044E5 GetCommandLineW,CommandLineToArgvW,lstrcmpW,lstrcmpW,GetCurrentProcess,IsWow64Process,MessageBoxW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,lstrlenW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,FindFirstFileW,FindClose,GetTempFileNameW,CopyFileW,lstrcmpW,lstrcmpW,FindWindowW,SendMessageW,IsWindow,PostMessageW,SHDeleteKeyW,lstrcmpW,lstrlenW,lstrcmpW,lstrcmpW,LocalFree,	0_2_00007FFDFB5044E5

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB4EDE40 GetSystemInfo,MapViewOfFileEx,RegisterWindowMessageW,CloseHandle,CloseHandle,

0_2_00007FFDFB4EDE40

Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_04504176a318ef6a4711c8eb84999e6f6eb1_8f532422_fab5e15b-9538-4913-9e97-d15e50033763\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_916a7d8f75978f3384e540b6f642fd74f32736_8f532422_007882f3-b647-418e-b212-463ae2cad8a6\	Jump to behavior

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.0000021806448000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node	graph_0-94119
Source: C:\Windows\System32\loaddll64.exe	API call chain: ExitProcess graph end node	graph_0-94272
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB58BAA0 RtlCaptureContext,VirtualAlloc,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FFDFB58BAA0

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000018003EEEC EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_000000018003EEEC

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB5EAC30 LoadLibraryW,GetProcAddress,MonitorFromPoint,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,GetDC,GetDeviceCaps,ReleaseDC,GetDC,GetDeviceCaps,ReleaseDC,

0_2_00007FFDFB5EAC30

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180036780 GetProcessHeap,

0_2_0000000180036780

Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_00007FFDFB58BAA0 RtlCaptureContext,VirtualAlloc,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FFDFB58BAA0
Source: C:\Windows\System32\loaddll64.exe	Code function: 0_2_0000000180032DD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000000180032DD8
Source: C:\Windows\System32\rundll32.exe	Code function: 3_2_0000000180032DD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0000000180032DD8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180032DD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0000000180032DD8
Source: C:\Windows\System32\rundll32.exe	Code function: 8_2_0000000180032DD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0000000180032DD8

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.46.11 8817
Source: C:\Windows\System32\rundll32.exe	Network Connect: 94.232.40.41 8817

Allocates memory in foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory allocated: C:\Windows\explorer.exe base: 13B0000 protect: page execute and read and write

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\rundll32.exe

Thread created: unknown EIP: 13B0000

Injects a PE file into a foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\explorer.exe base: 13B0000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\rundll32.exe

Memory written: PID: 2580 base: 13B0000 value: 4D

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7208
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7208
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7208
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7208
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 7208

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\rundll32.exe

Thread register set: 7208 1

Writes to foreign memory regions

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\explorer.exe base: 13B0000

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB4F04D0 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,LocalFree,CreateFileMappingW,GetLastError,FreeSid,LocalFree,LocalFree,

0_2_00007FFDFB4F04D0

Source: C:\Windows\System32\loaddll64.exe

0_2_00007FFDFB4F04D0

Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoEx,	0_2_00007FFDFB545624
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	0_2_00000001800354AC
Source: C:\Windows\System32\loaddll64.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	0_2_00000001800400E0
Source: C:\Windows\System32\loaddll64.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	0_2_000000018002E394
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	0_2_00000001800423EC
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	0_2_00000001800384A0
Source: C:\Windows\System32\loaddll64.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	0_2_000000018004064C
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	0_2_0000000180042858
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,	0_2_000000018004290C
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	0_2_0000000180042A10
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_0000000180042D88
Source: C:\Windows\System32\loaddll64.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	0_2_0000000180040DB0
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_0000000180042E3C
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	0_2_0000000180042ED0
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	0_2_0000000180043100
Source: C:\Windows\System32\loaddll64.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_000000018004324C
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,GetLocaleInfoW,	0_2_00000001800432FC
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	0_2_00000001800433A4
Source: C:\Windows\System32\loaddll64.exe	Code function: EnumSystemLocalesW,	0_2_00000001800353EC
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	0_2_000000018003B508
Source: C:\Windows\System32\loaddll64.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	0_2_00000001800298D8
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	0_2_00000001800419E8
Source: C:\Windows\System32\loaddll64.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_0000000180041B54
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	0_2_000001ABB913C4DC
Source: C:\Windows\System32\loaddll64.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	0_2_000001ABB914382C
Source: C:\Windows\System32\loaddll64.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	0_2_000001ABB91439E4
Source: C:\Windows\System32\loaddll64.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	0_2_000001ABB912A8AC
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	3_2_00000001800354AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	3_2_0000000180042858
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	3_2_00000001800298D8
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	3_2_00000001800400E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	3_2_0000000180043100
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	3_2_000000018004290C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	3_2_00000001800419E8
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	3_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_000000018004324C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	3_2_00000001800432FC
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_0000000180041B54
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	3_2_000000018002E394
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	3_2_00000001800433A4
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_00000001800353EC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	3_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	3_2_00000001800384A0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	3_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	3_2_0000000180042D88
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	3_2_0000000180040DB0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	3_2_0000000180042E3C
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	3_2_000000018004064C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	3_2_0000000180042ED0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	3_2_0000023728D6C4DC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	3_2_0000023728D7382C
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	3_2_0000023728D5A8AC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	3_2_0000023728D739E4
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	4_2_00000001800354AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	4_2_0000000180042858
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	4_2_00000001800298D8
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	4_2_00000001800400E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	4_2_0000000180043100
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	4_2_000000018004290C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	4_2_00000001800419E8
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	4_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_000000018004324C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	4_2_00000001800432FC
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_0000000180041B54
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	4_2_000000018002E394
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	4_2_00000001800433A4
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_00000001800353EC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	4_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	4_2_00000001800384A0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	4_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	4_2_0000000180042D88
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	4_2_0000000180040DB0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	4_2_0000000180042E3C
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	4_2_000000018004064C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	4_2_0000000180042ED0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	4_2_000002BD9F7939E4
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	4_2_000002BD9F79382C
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	4_2_000002BD9F77A8AC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	4_2_000002BD9F78C4DC
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,__crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	8_2_00000001800354AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	8_2_0000000180042858
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	8_2_00000001800298D8
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,free,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_mon,free,free,free,free,	8_2_00000001800400E0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	8_2_0000000180043100
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	8_2_000000018004290C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	8_2_00000001800419E8
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	8_2_0000000180042A10
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_000000018004324C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	8_2_00000001800432FC
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	8_2_0000000180041B54
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,_malloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,_calloc_crt,GetCPInfo,__crtLCMapStringA,__crtLCMapStringA,__crtGetStringTypeA,free,free,free,free,free,free,free,free,free,	8_2_000000018002E394
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	8_2_00000001800433A4
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	8_2_00000001800353EC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	8_2_00000001800423EC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	8_2_00000001800384A0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	8_2_000000018003B508
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	8_2_0000000180042D88
Source: C:\Windows\System32\rundll32.exe	Code function: __getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,	8_2_0000000180040DB0
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	8_2_0000000180042E3C
Source: C:\Windows\System32\rundll32.exe	Code function: _calloc_crt,_malloc_crt,free,_malloc_crt,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__getlocaleinfo,__free_lconv_num,free,free,free,	8_2_000000018004064C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	8_2_0000000180042ED0
Source: C:\Windows\System32\rundll32.exe	Code function: ___lc_locale_name_func,__crtGetLocaleInfoEx,	8_2_000002754DD8A8AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,	8_2_000002754DDA382C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_getptd,_getptd,LcidFromHexString,	8_2_000002754DDA39E4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,	8_2_000002754DD9C4DC

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_0000000180039844 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0000000180039844

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_000000018003E704 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,_malloc_crt,_invoke_watson,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,

0_2_000000018003E704

Source: C:\Windows\System32\loaddll64.exe

Code function: 0_2_00007FFDFB506A40 GetModuleHandleA,GetProcAddress,GetVersionExW,

0_2_00007FFDFB506A40

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected BruteRatel

Source: Yara match	File source: 00000015.00000002.3015117531.0000021809ECC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3020109408.000002180A014000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3015117531.0000021809F74000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7412, type: MEMORYSTR

Remote Access Functionality

Yara detected BruteRatel

Source: Yara match	File source: 00000015.00000002.3015117531.0000021809ECC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3020109408.000002180A014000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3015117531.0000021809F74000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7412, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Masquerading	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Valid Accounts	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	811 Process Injection	1 Access Token Manipulation	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	811 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TiNgny4xSB.dll	3%	Virustotal		Browse
TiNgny4xSB.dll	5%	ReversingLabs	Win64.Trojan.Seheq

Source	Detection	Scanner	Label	Link
muuxxu.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://cronoze.com/	0%	Avira URL Cloud	safe
https://muuxxu.com:8817/pentium.php6h	0%	Avira URL Cloud	safe
https://muuxxu.com/	0%	Avira URL Cloud	safe
https://muuxxu.com:8817/pentium.php	0%	Avira URL Cloud	safe
http://r11.o.lencr.org0#	0%	Avira URL Cloud	safe
https://muuxxu.com/	1%	Virustotal		Browse
https://cronoze.com:8817/pentium.php-%	0%	Avira URL Cloud	safe
https://muuxxu.com/=k	0%	Avira URL Cloud	safe
https://muuxxu.com/s	0%	Avira URL Cloud	safe
https://cronoze.com:8817/pentium.php	0%	Avira URL Cloud	safe
https://cronoze.com:8817/pentium.php#	0%	Avira URL Cloud	safe
https://muuxxu.com:8817/pentium.php2k	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cronoze.com	94.232.40.41	true	true		unknown
muuxxu.com	94.232.46.11	true	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://muuxxu.com:8817/pentium.php6h	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://muuxxu.com/	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r11.o.lencr.org0#	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cronoze.com/	rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://muuxxu.com:8817/pentium.php	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cronoze.com:8817/pentium.php-%	rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://muuxxu.com/=k	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.7.dr	false		high
https://cronoze.com:8817/pentium.php	rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://muuxxu.com/s	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cronoze.com:8817/pentium.php#	rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://muuxxu.com:8817/pentium.php2k	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://r11.i.lencr.org/0	rundll32.exe, 00000015.00000003.2784582353.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806423000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.0000021806457000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000003.2784582353.000002180642B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000015.00000002.3010242416.00000218063C8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.232.46.11	muuxxu.com	Russian Federation		44477	WELLWEBNL	true
94.232.40.41	cronoze.com	Russian Federation		44477	WELLWEBNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576561
Start date and time:	2024-12-17 09:18:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TiNgny4xSB.dll (renamed file extension from exe to dll, renamed because original name is a hash value)
Original Sample Name:	1552c43ecf6eeb5e2fe13cc1c25e6bdacf227222afaa9a523d996b6331945505.exe
Detection:	MAL
Classification:	mal88.troj.evad.winDLL@122/14@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 117

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 20.190.177.20, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:19:31	API Interceptor	3x Sleep call for process: WerFault.exe modified
03:21:09	API Interceptor	1x Sleep call for process: loaddll64.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WELLWEBNL	avutil.dll.dll	Get hash	malicious	BruteRatel	Browse	94.232.43.224
	fes.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	merd.msi	Get hash	malicious	Unknown	Browse	94.232.40.38
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	mesh.exe	Get hash	malicious	MeshAgent	Browse	94.232.43.185
	mesh.exe	Get hash	malicious	MeshAgent	Browse	94.232.43.185
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	94.232.43.213
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.232.45.36
WELLWEBNL	avutil.dll.dll	Get hash	malicious	BruteRatel	Browse	94.232.43.224
	fes.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	wait.dll.dll	Get hash	malicious	BruteRatel, Latrodectus	Browse	94.232.43.224
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	merd.msi	Get hash	malicious	Unknown	Browse	94.232.40.38
	sqx.dll.dll	Get hash	malicious	Unknown	Browse	94.232.40.38
	mesh.exe	Get hash	malicious	MeshAgent	Browse	94.232.43.185
	mesh.exe	Get hash	malicious	MeshAgent	Browse	94.232.43.185
	Document-19-06-38.js	Get hash	malicious	BruteRatel	Browse	94.232.43.213
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	94.232.45.36

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_04504176a318ef6a4711c8eb84999e6f6eb1_8f532422_fab5e15b-9538-4913-9e97-d15e50033763\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8199633474791661
Encrypted:	false
SSDEEP:	96:WW1wFIB/iFyKy6Zsj+4Rvd+qzfxbQXIDcQ/c65kcEqcw3kXaXz+HbHgSQgJjZEwd:eSZiFy6Z220R9kweju/zuiFKZ24lO8F
MD5:	B998EEE39E3243D31ED51347412D5EE8
SHA1:	4FE7B60036F9155C89D6E9F17C8E3AB58FDAF08C
SHA-256:	E53A342A97CB1339505A92FDB1816F14091FA24A63574F7BD616E7742A650463
SHA-512:	6C9C62CDE175CD356A994AC7852FF74EBEA2A94932B12AFA4237310CBB25FF7E41ECC9B77DF0586F3919E4CED02701CD2D19CBB62CF585FDAEA30D11B3701977
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.8.9.7.1.4.7.1.2.9.8.8.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.8.9.7.1.4.7.4.4.2.3.8.6.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.b.5.e.1.5.b.-.9.5.3.8.-.4.9.1.3.-.9.e.9.7.-.d.1.5.e.5.0.0.3.3.7.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.2.8.1.3.f.c.c.-.e.c.d.c.-.4.2.5.1.-.9.2.7.4.-.9.5.d.6.c.7.1.c.c.d.2.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.T.i.N.g.n.y.4.x.S.B...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.2.8.-.0.0.0.1.-.0.0.1.4.-.2.3.6.a.-.2.d.5.7.5.c.5.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_63179dbefcf24b1f63fa956696d2b85246a0d5db_8f532422_730590ba-86b0-4eb5-be05-e341ed564ef1\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8198373733028722
Encrypted:	false
SSDEEP:	96:WB1aMF/H/imyKyjsj+4Rvd+qzfzQXIDcQCc6qPcEDcw3W2RXaXz+HbHgSQgJjZE6:09fimyj2408wJi2Zju/zuiFKZ24lO8F
MD5:	BD51C2A5E1C70C8E7D84FF402DEDC962
SHA1:	9089F9250FE97965FFCE396BC94C4070555A6422
SHA-256:	0AEFD1F268AC601D51CD582A9F6FB0EAAB32ABFCADBD93CD93A58291BC13DBAB
SHA-512:	BBD6EFA62AEF17EBC7AB8324EAC3D82B71E9DEBD74470F86F0E4B9DEEC6C70165913BE2E1CB7028C593307FD5E0F200CAF09BB0896F6B4C7A34F071D7BF7ADD9
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.8.9.7.1.4.4.1.5.8.4.4.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.8.9.7.1.4.4.4.7.0.9.4.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.0.5.9.0.b.a.-.8.6.b.0.-.4.e.b.5.-.b.e.0.5.-.e.3.4.1.e.d.5.6.4.e.f.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.e.5.5.6.e.6.d.-.4.d.e.1.-.4.f.8.9.-.b.1.2.2.-.0.4.2.a.7.9.f.b.6.2.6.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.T.i.N.g.n.y.4.x.S.B...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.b.c.-.0.0.0.1.-.0.0.1.4.-.b.a.4.9.-.6.1.5.5.5.c.5.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_916a7d8f75978f3384e540b6f642fd74f32736_8f532422_007882f3-b647-418e-b212-463ae2cad8a6\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8199016948784835
Encrypted:	false
SSDEEP:	96:W21MSFiW/ilyKyFsj+4Rvd+qzfWQXIDcQ/c65kcE/cw3zXaXz+HbHgSQgJjZEwIS:PoeilyF210R9k1/j2/zuiFKZ24lO8F
MD5:	C2AA9D5043983CCBCBA9BF8B6AFD1DB2
SHA1:	F55387EE402B635467602F7B72309A8739DEE4DF
SHA-256:	39CB3626E219683EFD48872652A1F9EDE029CA9EE44AEDD4C5F5CE15976869A2
SHA-512:	A9BE40373721F3B9247835A1600D428EFA859C978F3B3805406DC5480016F633AA51D47436A50CF69895FBC34B1193F7DDF1A19F454D9CE52B3810CBB04733F5
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.8.9.7.1.4.1.5.5.8.3.7.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.8.9.7.1.4.1.9.9.5.8.7.0.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.0.7.8.8.2.f.3.-.b.6.4.7.-.4.1.8.e.-.b.2.1.2.-.4.6.3.a.e.2.c.a.d.8.a.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.e.4.7.4.1.d.3.-.3.2.6.6.-.4.a.1.b.-.9.a.2.d.-.8.e.4.6.3.3.b.5.7.5.b.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.T.i.N.g.n.y.4.x.S.B...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.9.8.-.0.0.0.1.-.0.0.1.4.-.d.e.1.a.-.9.4.5.3.5.c.5.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.8.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16EA.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 17 08:19:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	70140
Entropy (8bit):	1.5505234966254222
Encrypted:	false
SSDEEP:	192:HZUdngtJX/cQ5e2OMQpbRQcNw9b0Y2QguP/ByIn3vanl:5qgtxZ5eBZpbyc0bJ2QgAyI3Sl
MD5:	6C12DDE9A1AADE462645B8D81B6E3307
SHA1:	E503F8EA06962C27A8404A7EE19941840EAA6B2E
SHA-256:	EB806686649C21C7D618E15F907DB0D4F56F463A9E634D70F47EC2BD6C80801C
SHA-512:	B6C5DBEA6CAF90EF97B896F048FE9D92D3E7AE25A47F867A1C136F70E3560FCB325A03BDF135CEA9789A3495D9F04DEE19AFD836C5F762F143D863EF80AC1EFE
Malicious:	false
Preview:	MDMP..a..... ........3ag....................................$...f2..........T.......8...........T...............d...........x...........d...............................................................................eJ..............Lw......................T............3ag.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1768.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8540
Entropy (8bit):	3.699969234720502
Encrypted:	false
SSDEEP:	192:R6l7wVeJQMpUH6YElLjIgmfGYd2YdWprv89b3cpfHdm:R6lXJ7pO6YqMgmfGYd203Kfg
MD5:	0606A38D38AEEB0B03DBA6AB8421004D
SHA1:	335496349DAD613F24470DBBCB0C6651B5A089A9
SHA-256:	7FF574004EBF4B2DFFC56440782EAEF6F9F5C1A3413CC324ECD586108D156E4C
SHA-512:	9580A159673331C79191AB575319E37CA643F1D11F45B469C78CDD4B104DA4D13DBF1BC5A86256F748404F4950C0D7C2561B641D3345799A26ABE870CCB27721
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.4.9.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1798.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4765
Entropy (8bit):	4.50087969172379
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg771I97QWpW8VYiYm8M4JCWOCWcXQfFlaFWkyq85mWOKsfpzptSTX:uIjfdI7op7VWJKwpbpzpoOid
MD5:	D41CB9F91CA7CF8147D6E1D7DF83E368
SHA1:	D30FE1D70FB6E46274211BF49645A3B26284100D
SHA-256:	6298999FC81718028A201173B9FCBE4BBEDD2F20E687BE708267A92368F43D18
SHA-512:	1C3271556A38CFD5379EA6AC77AB67EB60836936589A8E99ACF60C4A5AF90B80B636BC48F1E53369D63B252E15B73970B6EC8D5D20431744ED9373254BBF461E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="635001" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2273.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 17 08:19:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	71052
Entropy (8bit):	1.5380467441173178
Encrypted:	false
SSDEEP:	96:5p8Iscd+YYUpyGHA5Ks5JX5Ofs2bX5NTUoi7MxCRW9ByEsnwCzICbqn8g0eIxahG:0angtJX/2OMX9knwaIP8+ITuhfQC
MD5:	3FE17FCF8AADC364685BE389099BEE6B
SHA1:	7D704919F85F399307A20C3AB2A4531E4D026D14
SHA-256:	30CF03B98D49D9B7B221C746D9B6EC7348601F51B9F1DFE349B6F89C60AED772
SHA-512:	DC172DC008E503755755CFECCC18864AC3F4BAF4AF06610AFA347F258246A380C67DB2C3BE378B7468D34140C54D58644EA1BF3D48E54C0A1C8E532FFC7965E2
Malicious:	false
Preview:	MDMP..a..... ........3ag....................................$...f2..........T.......8...........T...........................x...........d...............................................................................eJ..............Lw......................T.......(....3ag.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER22E2.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8540
Entropy (8bit):	3.7008360849875857
Encrypted:	false
SSDEEP:	192:R6l7wVeJA5p76YEUjIgmfGivMdWprv89bWb7pfeQjm:R6lXJOp76Y/MgmfGivYWb1f96
MD5:	1FA1482BC32D8BD8C3F655B9263896F5
SHA1:	EEC5A01C4A9F030A4FECC15E0183592F23EDDDDC
SHA-256:	29536D21B9ACBD134031161E065E5BF1965928CC1ED1BB916D0184A498B9F802
SHA-512:	4611C9C00188129C2AF3DC073A29A519CB8278000C556019C47688D5B14A812DA9EC63CB8199CADD5960E9ACF653C9A7405A819695C37FE14331D9030D140B05
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2312.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4765
Entropy (8bit):	4.4998530693465275
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg771I97QWpW8VYMYm8M4JCWOCWcXQNF4hyq85mWOKsvsptSTSBd:uIjfdI7op7VUJ9wpoOBd
MD5:	10E9508D549D58431AB282003C8A609A
SHA1:	06594766CDC3716733D7C16DE01EA4B2A2E89902
SHA-256:	979A987BA7106F30CB1F136DF585F872D5BEDE2C7C85822112D5B7E336151B95
SHA-512:	71DE9EDBE54218B9C56E6C5CF8FEF8A65037AB68B4483D55D2E885C386DAB4B144485A23C3A47EE2430563D7A867853D7CBCFEDCA08EFFC461FF3D954B3663B9
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="635001" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA9.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Dec 17 08:19:01 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57212
Entropy (8bit):	1.722216239103984
Encrypted:	false
SSDEEP:	192:W4YtVXvtcFiOMwJMEQwJPHvbviEhPfXznc:DoxWF9jP7Hvbv1hPfXzc
MD5:	6FBBF3242B08D6FA14DA725982CD8BC9
SHA1:	1FD0488DD9FA215E045F20B12995587086DB4FDF
SHA-256:	117A2EF4292B18BD6A1A2EEE84A33F09F9D5B6415E8B941749919A4FFA98C536
SHA-512:	DE469A30D3EF29A64128F0904DE235C66CAEBCF5DAB3E9429429147485E5D9ADB30C0BD570B388FF068920AFE47B23678168887CEFBEA0E765E3645B94BC51A4
Malicious:	false
Preview:	MDMP..a..... ........3ag........................................f-..........T.......8...........T...........................H...........4...............................................................................eJ..............Lw......................T............3ag.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD18.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8542
Entropy (8bit):	3.6975660852245094
Encrypted:	false
SSDEEP:	192:R6l7wVeJ3j4SUA6YEJjIgmfGPv6dWprT89bKlpf5Om:R6lXJzLj6YiMgmfGPvWK7f5
MD5:	7092857F38660899F4434D2117CDEABB
SHA1:	034BFC7F26CB7700A8ADDAE0309DFC7B9EC56798
SHA-256:	C205D258E41A64714B35BED96BC37C5D8F78BF93A78347065CA8709C995121DB
SHA-512:	8F34D7F374F65AB8C84CC529B2FDDEA7F7AEA0039670D83FC1929E72433FB39C63EC165336C9A9AB42F2B3CC6F79282CA5358B7A4CAF92F4D81F8584627A6B59
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.2.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD67.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4765
Entropy (8bit):	4.499172861037348
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg771I97QWpW8VY5Ym8M4JCWOCWcXQYFM0syq85mWOKsw2ptSTSgd:uIjfdI7op7VFJdsdpoOgd
MD5:	B2A08A486D113A936A5A20116D24E779
SHA1:	3B347CD355EDED8BF8F8347E5CD9036A37DA50AD
SHA-256:	64F9FBEEA0C38B2B5DCB22061C66A7D8D3A6A7A74430812554E674EA8DAE2FCE
SHA-512:	CA20D87CEC4826B230ECF1CBDDCAE2028E355332AE4982FFC277276FCBA870E11408AE025F02E7D103811BD8C554CF77DCF90FE0DDF5259B7AD6B31FA42AE5C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="635001" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\NTUSER.DAT.Not

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	5.081027121086312
Encrypted:	false
SSDEEP:	3:V+Q+50RFazdRVg3qRJmEXQ+50RHcypPV:hOU4Jg6RJmEAO8cQt
MD5:	6DD68261A78C264108E3252416D4DC81
SHA1:	9B975E9012962C1D2F17F0B08A4504074EBF8D40
SHA-256:	03CE7C591C8953B13FBCE8C1D3FF2F32557D1311A5D1CE2AF639A8FDB5E96E33
SHA-512:	11AA9A5266EC80B9F6E9EC41B783F52888876BBC0D3B1647E3813AB20FE04B870A159884AE77D12B578C5C2CD4BADE72D6AFBF2B0C7BC0CCC035758734105468
Malicious:	false
Preview:	{VGlOZ255NHhTQi5kbGw=, IkM6XFVzZXJzXGpvbmVzXERlc2t0b3BcVGlOZ255NHhTQi5kbGwi, MQ==, blZpZXdDbWQ=}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466353220432204
Encrypted:	false
SSDEEP:	6144:xIXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSb9:SXD94zWlLZMM6YFHa+9
MD5:	39705718317F23573C4A2D66CE03DCAE
SHA1:	99FD63C0590EE4D864C435C554187389F5FC1F88
SHA-256:	1A8B79102101187C1622D31BD45CE588E439527F31FBE373CE3FC9F8B9C40B12
SHA-512:	A2F04330B406DB226F38D4475F4391CB64A2B10BA40CC5A6D06B14961B2AFDA691A6949839776A537B592BFFB72C82E79C4C55C9A5103AB64E7BF21741639370
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...T\P...............................................................................................................................................................................................................................................................................................................................................{.`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.017969386306067
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	TiNgny4xSB.dll
File size:	3'112'960 bytes
MD5:	e5ec8b7cf88c66f78d607f76a2095fda
SHA1:	fda7752c604ff7673ae31dc45a8f0a9dd0a3a6ac
SHA256:	1552c43ecf6eeb5e2fe13cc1c25e6bdacf227222afaa9a523d996b6331945505
SHA512:	80ddbef4e3e8912b15b2a41a9416041159c305dd24d5e06c62008708e8cf4c307981ce0c96690b9b1fb7dc72634c3f172993ab73b82ac53cce9995b64addb1d3
SSDEEP:	49152:1x4R6f1w6HKPwqliTUERW+e46IwdKMmMxSp:1+R+wlPwHgEofIwRmyS
TLSH:	7AE56D827AD72200F1EBE138C9725709C1BA74550B31D5CF46740BBA3A8B7F59A7B392
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........xUis+Uis+Uis+..p_is+..v.is+3..+Tis+..wDis+..p_is+..v.is+..z]is+..w@is+\..+Wis+\..+Tis+..rBis+Uir+.hs+..v~is+..sTis

File Icon


Icon Hash:	d2aab9d2faeece37

Static PE Info

General

Entrypoint:	0x1800c6224
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66CD0BFB [Mon Aug 26 23:12:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3f2962bd80009d147ddac59f9c2b8d66

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push eax
push ebx
push ecx
push edx
push esi
push edi
inc ecx
push eax
inc ecx
push ecx
inc ecx
push edx
inc ecx
push ebx
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
inc ecx
push edi
inc ecx
neg eax
dec ecx
mov ecx, edi
dec eax
mov ecx, ebp
dec esp
or eax, eax
dec eax
mov ecx, edx
dec eax
xor ecx, eax
dec eax
inc eax
dec eax
inc eax
dec eax
inc eax
dec eax
inc eax
dec eax
inc eax
dec eax
add ecx, 31h
dec eax
and ecx, eax
dec eax
sub ecx, 00000100h
dec eax
mov ecx, ebp
dec eax
dec ecx
dec eax
sub ecx, edi
dec eax
xor edi, esi
dec eax
add eax, 18h
xorps xmm0, xmm3
inc ecx
shr eax, 1
dec ecx
shr edi, 1
inc ecx
shr eax, 1
dec ecx
and ecx, 01h
inc ecx
and eax, 01h
dec eax
arpl ax, dx
dec eax
arpl cx, ax
movaps xmm1, xmm6
movaps xmm6, xmm1
movaps xmm2, xmm6
dec ax
movd eax, mm2
dec eax
shr eax, 20h
inc esp
cmp ecx, ecx
inc esp
cmp ebx, ecx
dec ebp
mov ebx, esi
cmove edx, ecx
mov edx, FFFFFFFFh
inc ecx
neg eax
dec ecx
mov ecx, edi
dec eax
mov ecx, ebp
dec esp
or eax, eax
dec eax
mov ecx, edx
dec eax
xor ecx, eax
dec eax
inc eax
dec eax
inc eax
dec eax
inc eax
dec eax
inc eax
dec eax
inc eax
dec eax
add ecx, 31h
dec eax
and ecx, eax
dec eax
sub ecx, 00000100h
dec eax
mov ecx, ebp
dec eax
dec ecx

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1bfab0	0x14c8	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1c0f78	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1ef000	0x111630	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1ce000	0x1fa58	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x252c00	0x4ca0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x301000	0xfec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x18bf70	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x18c190	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x18bfd0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x170000	0xac0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16e81c	0x16ea00	48889f443bb180ec765257c6a2c2883f	False	0.3392624073048074	data	6.421120250593156	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x170000	0x533b6	0x53400	3a0c139778b110ba0a849c946e9f1c13	False	0.3114647850975976	data	5.393758497191826	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c4000	0x9ff0	0x3800	7b6aa8f538e1b1738a168895dc8be2ad	False	0.24142020089285715	data	3.9872470975737118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1ce000	0x1fa58	0x1fc00	ddecc75f6a8c9ebe806716df0d89dbac	False	0.45673136072834647	data	6.202982287474555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x1ee000	0xfc	0x200	ae28d2bdd6b6dc8316b51d53a0feacca	False	0.31640625	data	2.4452015569508707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1ef000	0x111630	0x111800	583ea7e3fb4407f6d2c5867487d76bcf	False	0.5867962322897623	data	7.48608281610237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x301000	0xfec	0x1000	e4b9dec003dda40214237d5924a5ee0f	False	0.4365234375	data	5.4013704366933375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x1f02a0	0x328	Device independent bitmap graphic, 16 x -16 x 24, image size 768, resolution 4724 x 4724 px/m	English	United States	0.6831683168316832
RT_BITMAP	0x1f05c8	0x4d8	Device independent bitmap graphic, 20 x -20 x 24, image size 1200, resolution 4724 x 4724 px/m	English	United States	0.6629032258064517
RT_BITMAP	0x1f0aa0	0x6e8	Device independent bitmap graphic, 24 x -24 x 24, image size 1728, resolution 4724 x 4724 px/m	English	United States	0.5961538461538461
RT_BITMAP	0x1f1188	0x958	Device independent bitmap graphic, 28 x -28 x 24, image size 2352, resolution 4724 x 4724 px/m	English	United States	0.5556020066889632
RT_BITMAP	0x1f1ae0	0xc28	Device independent bitmap graphic, 32 x -32 x 24, image size 3072, resolution 4724 x 4724 px/m	English	United States	0.41002570694087404
RT_BITMAP	0x1f2708	0x1928	Device independent bitmap graphic, 40 x -40 x 32, image size 6400, resolution 2835 x 2835 px/m	English	United States	0.34767080745341616
RT_BITMAP	0x1f4030	0x1b28	Device independent bitmap graphic, 48 x -48 x 24, image size 6912, resolution 4724 x 4724 px/m	English	United States	0.5100690448791715
RT_BITMAP	0x1f5b58	0x30028	Device independent bitmap graphic, 256 x 256 x 24, image size 196608, resolution 4724 x 4724 px/m	English	United States	0.1254830967007038
RT_ICON	0x225b80	0x43f2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9978728297113947
RT_ICON	0x229f74	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.12925884301431445
RT_ICON	0x23a79c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.23240434577231933
RT_ICON	0x23e9c4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.300103734439834
RT_ICON	0x240f6c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.4017354596622889
RT_ICON	0x242014	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.6196808510638298
RT_STRING	0x24247c	0x136	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0			0.5161290322580645
RT_STRING	0x2425b4	0x108	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Arabic	Saudi Arabia	0.5681818181818182
RT_STRING	0x2426bc	0x98	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Chinese	Taiwan	0.8092105263157895
RT_STRING	0x242754	0x124	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Czech	Czech Republic	0.5273972602739726
RT_STRING	0x242878	0xfc	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Danish	Denmark	0.5714285714285714
RT_STRING	0x242974	0x106	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	German	Germany	0.5076335877862596
RT_STRING	0x242a7c	0x15c	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Greek	Greece	0.5488505747126436
RT_STRING	0x242bd8	0xf0	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	English	United States	0.5541666666666667
RT_STRING	0x242cc8	0x126	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Finnish	Finland	0.5306122448979592
RT_STRING	0x242df0	0x140	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	French	France	0.51875
RT_STRING	0x242f30	0xf0	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Hebrew	Israel	0.6083333333333333
RT_STRING	0x243020	0x102	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Hungarian	Hungary	0.5891472868217055
RT_STRING	0x243124	0xfe	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Italian	Italy	0.5551181102362205
RT_STRING	0x243224	0xce	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Japanese	Japan	0.7427184466019418
RT_STRING	0x2432f4	0xa4	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Korean	North Korea	0.8109756097560976
RT_STRING	0x2432f4	0xa4	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Korean	South Korea	0.8109756097560976
RT_STRING	0x243398	0x134	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Dutch	Netherlands	0.5
RT_STRING	0x2434cc	0x11e	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Norwegian	Norway	0.5244755244755245
RT_STRING	0x2435ec	0x11c	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Polish	Poland	0.5422535211267606
RT_STRING	0x243708	0x14c	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Portuguese	Brazil	0.4939759036144578
RT_STRING	0x243854	0x138	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Russian	Russia	0.5384615384615384
RT_STRING	0x24398c	0x13e	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Slovak	Slovakia	0.5377358490566038
RT_STRING	0x243acc	0x128	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Swedish	Sweden	0.5236486486486487
RT_STRING	0x243bf4	0x102	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Thai	Thailand	0.624031007751938
RT_STRING	0x243cf8	0x178	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Turkish	Turkey	0.4787234042553192
RT_STRING	0x243e70	0x146	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Ukrainian	Ukrain	0.5521472392638037
RT_STRING	0x243fb8	0x124	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Slovenian	Slovenia	0.541095890410959
RT_STRING	0x2440dc	0x90	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Chinese	China	0.7708333333333334
RT_STRING	0x24416c	0xf0	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	English	Great Britain	0.5541666666666667
RT_STRING	0x24425c	0x136	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Spanish	Mexico	0.5129032258064516
RT_STRING	0x244394	0x160	Matlab v4 mat-file (little endian) N, numeric, rows 0, columns 0	Portuguese	Portugal	0.4744318181818182
RT_STRING	0x2444f4	0x48a	data			0.35628227194492257
RT_STRING	0x244980	0x396	data	Arabic	Saudi Arabia	0.3888888888888889
RT_STRING	0x244d18	0x21a	data	Chinese	Taiwan	0.5204460966542751
RT_STRING	0x244f34	0x3d4	data	Czech	Czech Republic	0.3989795918367347
RT_STRING	0x245308	0x3e0	data	Danish	Denmark	0.36189516129032256
RT_STRING	0x2456e8	0x468	data	German	Germany	0.37145390070921985
RT_STRING	0x245b50	0x47a	data	Greek	Greece	0.41273996509598604
RT_STRING	0x245fcc	0x38e	data	English	United States	0.3648351648351648
RT_STRING	0x24635c	0x3d8	data	Finnish	Finland	0.36585365853658536
RT_STRING	0x246734	0x420	data	French	France	0.375
RT_STRING	0x246b54	0x3ec	data	Hebrew	Israel	0.3754980079681275
RT_STRING	0x246f40	0x3ec	data	Hungarian	Hungary	0.3904382470119522
RT_STRING	0x24732c	0x468	data	Italian	Italy	0.3599290780141844
RT_STRING	0x247794	0x290	data	Japanese	Japan	0.5091463414634146
RT_STRING	0x247a24	0x26c	AmigaOS bitmap font "\254\307 ", fc_YSize 24832, 1238 elements, 2nd "a", 3rd " "	Korean	North Korea	0.5290322580645161
RT_STRING	0x247a24	0x26c	AmigaOS bitmap font "\254\307 ", fc_YSize 24832, 1238 elements, 2nd "a", 3rd " "	Korean	South Korea	0.5290322580645161
RT_STRING	0x247c90	0x410	data	Dutch	Netherlands	0.36153846153846153
RT_STRING	0x2480a0	0x406	data	Norwegian	Norway	0.3592233009708738
RT_STRING	0x2484a8	0x406	data	Polish	Poland	0.3941747572815534
RT_STRING	0x2488b0	0x466	data	Portuguese	Brazil	0.3614564831261101
RT_STRING	0x248d18	0x488	data	Russian	Russia	0.4025862068965517
RT_STRING	0x2491a0	0x39a	data	Slovak	Slovakia	0.4522776572668113
RT_STRING	0x24953c	0x3c6	data	Swedish	Sweden	0.37267080745341613
RT_STRING	0x249904	0x3c2	data	Thai	Thailand	0.40436590436590436
RT_STRING	0x249cc8	0x3b4	data	Turkish	Turkey	0.4040084388185654
RT_STRING	0x24a07c	0x55e	data	Ukrainian	Ukrain	0.3369723435225619
RT_STRING	0x24a5dc	0x3dc	data	Slovenian	Slovenia	0.39068825910931176
RT_STRING	0x24a9b8	0x210	data	Chinese	China	0.5170454545454546
RT_STRING	0x24abc8	0x38e	data	English	Great Britain	0.3648351648351648
RT_STRING	0x24af58	0x488	data	Spanish	Mexico	0.35
RT_STRING	0x24b3e0	0x4b2	data	Portuguese	Portugal	0.3319467554076539
RT_STRING	0x24b894	0x50a	data			0.3573643410852713
RT_STRING	0x24bda0	0x44a	AmigaOS bitmap font "D\0061\006,\006'\006!\006 ", fc_YSize 11776, 9990 elements, 2nd " ", 3rd "1\006J\006/\006 "	Arabic	Saudi Arabia	0.3879781420765027
RT_STRING	0x24c1ec	0x238	data	Chinese	Taiwan	0.5598591549295775
RT_STRING	0x24c424	0x43e	data	Czech	Czech Republic	0.40423572744014735
RT_STRING	0x24c864	0x434	data	Danish	Denmark	0.38104089219330856
RT_STRING	0x24cc98	0x4e4	data	German	Germany	0.3730031948881789
RT_STRING	0x24d17c	0x53c	data	Greek	Greece	0.4052238805970149
RT_STRING	0x24d6b8	0x416	data	English	United States	0.372848948374761
RT_STRING	0x24dad0	0x488	data	Finnish	Finland	0.36551724137931035
RT_STRING	0x24df58	0x554	data	French	France	0.37976539589442815
RT_STRING	0x24e4ac	0x3e8	data	Hebrew	Israel	0.419
RT_STRING	0x24e894	0x4da	data	Hungarian	Hungary	0.39855072463768115
RT_STRING	0x24ed70	0x4c4	data	Italian	Italy	0.36311475409836064
RT_STRING	0x24f234	0x2f4	data	Japanese	Japan	0.5595238095238095
RT_STRING	0x24f528	0x2d8	data	Korean	North Korea	0.5892857142857143
RT_STRING	0x24f528	0x2d8	data	Korean	South Korea	0.5892857142857143
RT_STRING	0x24f800	0x49a	data	Dutch	Netherlands	0.37436332767402375
RT_STRING	0x24fc9c	0x40e	data	Norwegian	Norway	0.38246628131021193
RT_STRING	0x2500ac	0x544	data	Polish	Poland	0.37537091988130566
RT_STRING	0x2505f0	0x4ba	data	Portuguese	Brazil	0.39090909090909093
RT_STRING	0x250aac	0x4c8	data	Russian	Russia	0.4027777777777778
RT_STRING	0x250f74	0x498	data	Slovak	Slovakia	0.4098639455782313
RT_STRING	0x25140c	0x470	data	Swedish	Sweden	0.37764084507042256
RT_STRING	0x25187c	0x41a	data	Thai	Thailand	0.4180952380952381
RT_STRING	0x251c98	0x510	AmigaOS bitmap font "\374", fc_YSize 27904, 19456 elements, 2nd "4", 3rd "a"	Turkish	Turkey	0.38503086419753085
RT_STRING	0x2521a8	0x5c6	data	Ukrainian	Ukrain	0.36400541271989173
RT_STRING	0x252770	0x4bc	data	Slovenian	Slovenia	0.37293729372937295
RT_STRING	0x252c2c	0x23e	data	Chinese	China	0.5592334494773519
RT_STRING	0x252e6c	0x418	data	English	Great Britain	0.37309160305343514
RT_STRING	0x253284	0x51a	data	Spanish	Mexico	0.3460949464012251
RT_STRING	0x2537a0	0x4b0	data	Portuguese	Portugal	0.3641666666666667
RT_STRING	0x253c50	0x144	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0			0.38271604938271603
RT_STRING	0x253d94	0x102	data	Arabic	Saudi Arabia	0.45348837209302323
RT_STRING	0x253e98	0x76	data	Chinese	Taiwan	0.5847457627118644
RT_STRING	0x253f10	0x10e	data	Czech	Czech Republic	0.4703703703703704
RT_STRING	0x254020	0x12a	data	Danish	Denmark	0.37583892617449666
RT_STRING	0x25414c	0x106	data	German	Germany	0.40458015267175573
RT_STRING	0x254254	0xfa	data	Greek	Greece	0.484
RT_STRING	0x254350	0xf6	data	English	United States	0.42276422764227645
RT_STRING	0x254448	0xfa	data	Finnish	Finland	0.4
RT_STRING	0x254544	0x120	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	French	France	0.4340277777777778
RT_STRING	0x254664	0xc6	data	Hebrew	Israel	0.5202020202020202
RT_STRING	0x25472c	0x126	data	Hungarian	Hungary	0.41836734693877553
RT_STRING	0x254854	0x10e	data	Italian	Italy	0.4222222222222222
RT_STRING	0x254964	0x82	data	Japanese	Japan	0.5846153846153846
RT_STRING	0x2549e8	0x78	data	Korean	North Korea	0.5833333333333334
RT_STRING	0x2549e8	0x78	data	Korean	South Korea	0.5833333333333334
RT_STRING	0x254a60	0x114	data	Dutch	Netherlands	0.38405797101449274
RT_STRING	0x254b74	0x12c	data	Norwegian	Norway	0.36666666666666664
RT_STRING	0x254ca0	0x12e	data	Polish	Poland	0.38741721854304634
RT_STRING	0x254dd0	0x140	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Portuguese	Brazil	0.384375
RT_STRING	0x254f10	0x106	data	Russian	Russia	0.44274809160305345
RT_STRING	0x255018	0x120	data	Slovak	Slovakia	0.4513888888888889
RT_STRING	0x255138	0x12a	data	Swedish	Sweden	0.3859060402684564
RT_STRING	0x255264	0x100	data	Thai	Thailand	0.41796875
RT_STRING	0x255364	0xf2	data	Turkish	Turkey	0.4628099173553719
RT_STRING	0x255458	0x10c	data	Ukrainian	Ukrain	0.4701492537313433
RT_STRING	0x255564	0x104	data	Slovenian	Slovenia	0.4307692307692308
RT_STRING	0x255668	0x70	data	Chinese	China	0.5535714285714286
RT_STRING	0x2556d8	0xf6	data	English	Great Britain	0.42276422764227645
RT_STRING	0x2557d0	0x15e	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Spanish	Mexico	0.4
RT_STRING	0x255930	0x12e	data	Portuguese	Portugal	0.37748344370860926
RT_MESSAGETABLE	0x255a60	0x20	Matlab v4 mat-file (little endian) %, text, rows 1, columns 1, imaginary	English	United States	0.875
RT_GROUP_ICON	0x255a80	0x5a	data	English	United States	0.7666666666666667
RT_VERSION	0x255adc	0x360	data			0.44328703703703703
RT_VERSION	0x255e3c	0x360	data	Arabic	Saudi Arabia	0.4444444444444444
RT_VERSION	0x25619c	0x368	data	Chinese	Taiwan	0.44495412844036697
RT_VERSION	0x256504	0x360	data	Czech	Czech Republic	0.44328703703703703
RT_VERSION	0x256864	0x360	data	German	Germany	0.4444444444444444
RT_VERSION	0x256bc4	0x360	data	Greek	Greece	0.44560185185185186
RT_VERSION	0x256f24	0x360	data	English	United States	0.4398148148148148
RT_VERSION	0x257284	0x360	data	Finnish	Finland	0.44328703703703703
RT_VERSION	0x2575e4	0x360	data	French	France	0.44328703703703703
RT_VERSION	0x257944	0x360	data	Hebrew	Israel	0.44560185185185186
RT_VERSION	0x257ca4	0x360	data	Hungarian	Hungary	0.44560185185185186
RT_VERSION	0x258004	0x360	data	Italian	Italy	0.4444444444444444
RT_VERSION	0x258364	0x360	data	Japanese	Japan	0.44560185185185186
RT_VERSION	0x2586c4	0x360	data	Korean	North Korea	0.44675925925925924
RT_VERSION	0x2586c4	0x360	data	Korean	South Korea	0.44675925925925924
RT_VERSION	0x258a24	0x360	data	Dutch	Netherlands	0.44560185185185186
RT_VERSION	0x258d84	0x360	data	Norwegian	Norway	0.44328703703703703
RT_VERSION	0x2590e4	0x360	data	Polish	Poland	0.44560185185185186
RT_VERSION	0x259444	0x368	data	Portuguese	Brazil	0.4426605504587156
RT_VERSION	0x2597ac	0x360	data	Russian	Russia	0.44675925925925924
RT_VERSION	0x259b0c	0x360	data	Slovak	Slovakia	0.44560185185185186
RT_VERSION	0x259e6c	0x360	data	Swedish	Sweden	0.44328703703703703
RT_VERSION	0x25a1cc	0x360	data	Thai	Thailand	0.44675925925925924
RT_VERSION	0x25a52c	0x360	data	Turkish	Turkey	0.4444444444444444
RT_VERSION	0x25a88c	0x360	data	Ukrainian	Ukrain	0.4479166666666667
RT_VERSION	0x25abec	0x360	data	Slovenian	Slovenia	0.4444444444444444
RT_VERSION	0x25af4c	0x368	data	Chinese	China	0.4461009174311927
RT_VERSION	0x25b2b4	0x360	data	English	Great Britain	0.44328703703703703
RT_VERSION	0x25b614	0x368	data	Spanish	Mexico	0.44380733944954126
RT_VERSION	0x25b97c	0x360	data	Portuguese	Portugal	0.44560185185185186
RT_VXD	0x25bcdc	0xa47d4	data			0.8354637045304772
RT_MANIFEST	0x3004b0	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
SHLWAPI.dll	PathFileExistsW, SHDeleteKeyW, StrStrIW, StrStrW
KERNEL32.dll	CreateFileW, GetFileSize, ReadFile, SetFilePointer, WriteFile, FormatMessageA, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetLocaleInfoEx, CompareStringEx, GetCPInfo, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, GetModuleHandleW, RtlCaptureContext, VirtualAlloc, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlPcToFileHeader, RaiseException, RtlUnwindEx, InterlockedPushEntrySList, InterlockedFlushSList, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetFileAttributesW, GetCommandLineA, GetLocalTime, ExitProcess, GetModuleHandleExW, SetFileAttributesW, HeapAlloc, GetStdHandle, GetFileType, GetTempPathW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, HeapReAlloc, SetConsoleCtrlHandler, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, GetFileSizeEx, SetFilePointerEx, SetStdHandle, ReadConsoleW, HeapSize, SetEndOfFile, WriteConsoleW, GetUserDefaultUILanguage, K32GetModuleFileNameExW, K32EnumProcessModules, GetModuleFileNameW, OpenProcess, OpenThread, GetCurrentProcessId, CloseHandle, GlobalAlloc, FreeResource, FindNextFileW, DeleteFileW, GetSystemDirectoryW, CreateProcessW, ResetEvent, SetEvent, MapViewOfFileEx, CreateFileMappingW, GetSystemInfo, UnmapViewOfFile, OpenFileMappingW, LocalAlloc, CreateEventW, ReleaseMutex, FormatMessageW, GetCurrentThreadId, InitializeCriticalSection, RtlUnwind, QueryFullProcessImageNameW, CreateMutexW, OutputDebugStringW, lstrcpyW, GetProcAddress, GetModuleHandleA, GetVersionExW, HeapFree, GlobalUnlock, GlobalLock, GlobalFree, VerSetConditionMask, LoadLibraryW, GetFullPathNameW, CreateProcessA, GetModuleFileNameA, VerifyVersionInfoW, WTSGetActiveConsoleSessionId, MulDiv, K32EnumProcesses, CopyFileW, lstrlenW, lstrcmpW, LocalFree, IsWow64Process, GetThreadPriority, SetThreadPriority, GetCurrentThread, GetCurrentProcess, WaitForSingleObject, GetTempFileNameW, FindFirstFileW, FindClose, GetLastError, GetTickCount, ExitThread, CreateThread, Sleep, MoveFileExW, GetSystemWindowsDirectoryW, GetCommandLineW, LoadLibraryExW, K32GetModuleBaseNameW
USER32.dll	ReleaseDC, GetDC, GetSysColor, DestroyIcon, SystemParametersInfoW, GetMessageW, TranslateMessage, DispatchMessageW, PeekMessageW, PostThreadMessageW, DefWindowProcW, RegisterClassW, UnregisterClassW, CreateWindowExW, DestroyWindow, SetLayeredWindowAttributes, IsWindowVisible, SetTimer, KillTimer, BeginPaint, EndPaint, ValidateRect, EnumWindows, LoadCursorW, DrawIconEx, UnionRect, DisplayConfigGetDeviceInfo, ChangeDisplaySettingsExW, EnumDisplayDevicesW, EnumDisplaySettingsW, EnumDisplaySettingsExW, MonitorFromPoint, GetMonitorInfoW, GetCursorPos, WindowFromPoint, GetDesktopWindow, CharUpperW, IntersectRect, EnumDisplayMonitors, PtInRect, OffsetRect, IsZoomed, SetWindowPlacement, CopyRect, GetWindowPlacement, SetWindowLongPtrW, MonitorFromRect, EqualRect, GetWindow, IsWindowEnabled, FindWindowExW, AllowSetForegroundWindow, SetForegroundWindow, GetForegroundWindow, InsertMenuItemW, InsertMenuW, IsIconic, SetWindowPos, ShowWindow, SendMessageTimeoutW, wsprintfW, GetWindowThreadProcessId, RegisterWindowMessageW, GetAncestor, GetParent, GetWindowLongPtrW, IsRectEmpty, GetClientRect, GetWindowTextW, GetClassNameW, GetSystemMetrics, GetAsyncKeyState, LoadImageW, LoadBitmapW, LoadStringW, CharLowerW, FindWindowW, MessageBoxW, IsWindow, PostMessageW, SendMessageW, FillRect, GetWindowRect, SetProcessDPIAware
SHELL32.dll	SHGetSpecialFolderPathW, ShellExecuteW, ExtractIconExW, SHGetFileInfoW, SHGetFolderPathW, SHCreateDirectoryExW, CommandLineToArgvW, ExtractIconW
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW
MSIMG32.dll	TransparentBlt
GDI32.dll	GetObjectW, SelectObject, GetDeviceCaps, DeleteDC, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, CreateSolidBrush, DeleteObject, CreateFontIndirectW, CreatePen, GetDIBits, GetStockObject, SetBkMode, StretchBlt, SetStretchBltMode, SetTextColor, BeginPath, EndPath, StrokeAndFillPath, TextOutW, SetBrushOrgEx
ADVAPI32.dll	RegSetKeySecurity, SetSecurityDescriptorOwner, RegQueryValueExA, RegEnumValueW, RegEnumKeyW, RegDeleteValueW, CreateProcessAsUserW, SetSecurityDescriptorDacl, AllocateAndInitializeSid, SetEntriesInAclW, FreeSid, InitializeSecurityDescriptor, RegQueryInfoKeyW, RegDeleteKeyW, RegEnumKeyExW, ReportEventW, RegisterEventSourceW, SetSecurityDescriptorGroup, RevertToSelf, IsValidSecurityDescriptor, InitializeAcl, ImpersonateSelf, DeregisterEventSource, SetSecurityInfo, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetSecurityDescriptorSacl, RegCopyTreeW, RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, RegCreateKeyExW, RegOpenCurrentUser, RegCloseKey, OpenProcessToken, OpenThreadToken, AccessCheck, AddAccessAllowedAce, CheckTokenMembership, CreateWellKnownSid, DuplicateTokenEx, GetLengthSid, GetTokenInformation, RegGetValueW
ole32.dll	StringFromGUID2, CLSIDFromString, CoCreateInstance, CoInitialize, CreateStreamOnHGlobal
OLEAUT32.dll	OleLoadPicture

Exports

Name	Ordinal	Address
DMAddNewDesktop	416	0x18008c760
DMEnumDesktopInfos	404	0x18008c790
DMEnumDesktops	403	0x18008c7b0
DMGetCurrentDesktop	407	0x18008ca20
DMGetDefaultDesktop	409	0x18008caa0
DMGetDesktopCount	410	0x18008cac0
DMGetDesktopInfo	414	0x18008cad0
DMGetDesktopMask	413	0x18008cb40
DMGetGrids	420	0x18008cb60
DMGetPerMonWallpapers	411	0x18008cbd0
DMGetSetting	400	0x18008cc20
DMMoveToDesktop	417	0x18008cc80
DMRemoveDesktop	406	0x18008cd20
DMSetCurrentDesktop	408	0x18008cd50
DMSetDesktopInfo	415	0x18008cda0
DMSetGrids	419	0x18008ce20
DMSetPerMonWallpapers	412	0x18008ceb0
DMSetSetting	401	0x18008cf30
DMStoreSettings	402	0x18008cfe0
GetNViewCAPS	814	0x18008d010
HKAdd	506	0x18008d040
HKEnable	509	0x18008d0e0
HKEnumActions	504	0x18008d130
HKEnumCommands	500	0x18008d180
HKGetAction	508	0x18008d270
HKIsValidBin	510	0x18008d2b0
HKRemove	503	0x18008d330
HKSetParams	513	0x18008d3e0
NVCreateNViewMainProc	206	0x18008d460
NVDesktopSystray	229	0x18008d770
NVDisable	205	0x18008d910
NVEnable	204	0x18008da00
NVGetAppAndClassFromHwnd	225	0x18008dad0
NVGetDisplayRects	216	0x18008db00
NVGetGridSetting	261	0x18008db60
NVGetLastError	209	0x18008dba0
NVGetMonitorNames	817	0x18008dbb0
NVGetNViewExecutablePath	217	0x18008dbc0
NVGetNumDisplays	215	0x18008dbd0
NVGetNviewRootKey	230	0x18008dbe0
NVGetPseudoMaxState	218	0x18008dbf0
NVGetSystemInfo	818	0x18008dc50
NVGetWindowRectViaNviewProc	233	0x18008e340
NVIsHookEnabled	203	0x18008e430
NVLaunchSysMenu	232	0x18008e440
NVMaxToDesktop	224	0x18008e480
NVMaxToDisplay	223	0x18008e4a0
NVMaxToGrid	221	0x18008e4c0
NVMaxToOverlapGrid	222	0x18008e4e0
NVMaxToRect	219	0x18008e500
NVNotifyClientWindows	214	0x18008e540
NVOpenNViewRegKey	212	0x18008e550
NVQueryDesktopContextMenu	226	0x18008e590
NVQueryDesktopContextMenuEx	227	0x18008e5b0
NVRegisterNotificationWindow	207	0x18008e710
NVRestore	220	0x18008e730
NVRunControlPanel	202	0x18008e750
NVSaveGridsToReg	263	0x18008ec00
NVSetForegroundWindow	228	0x18008ec30
NVSetGridSetting	262	0x18008ec50
NVSetLastError	210	0x18008ecd0
NVSetWindowPosViaNviewProc	234	0x18008ece0
NVShowMonGridIDOverlay	213	0x18008ed20
NVUnregisterNotificationWindow	208	0x18008ed60
NVVirtualDisplayEDID	201	0x18008ed80
NVWaitForNViewMain	292	0x18008edc0
NVWaitForNViewMainExit	293	0x18008edd0
NViewGlobalSetting	251	0x18008ede0
NViewUserInterfaceSetting	252	0x18008ee30
PMDelete	607	0x18008eec0
PMEnum	605	0x18008ef90
PMFindProfile	286	0x18008f180
PMGetCurrentProfile	608	0x18008f190
PMGetProfileDirectory	285	0x18008f290
PMGetProfileInfo	287	0x18008f2a0
PMGetProfileInfoEx	288	0x18008f3c0
PMGetStartupProfile	609	0x18008f410
PMImport	606	0x18008f4a0
PMLoad	601	0x18008f4b0
PMLoadApp	603	0x18008f4c0
PMLoadEx	602	0x18008f5e0
PMLock	611	0x18008f7a0
PMSave	604	0x18008f7b0
PMSetStartupProfile	610	0x18008f900
PMUpdate	289	0x18008fa80
WMParseSetting	307	0x18008fbc0
WMSetSettingHWND	303	0x18008fbf0
nViewCmd	104	0x1800844e0
nViewLoadHook	102	0x180084b90
nViewUninstallNotify	106	0x180084bb0
nViewUnload	103	0x180084bd0
nviewExecute	900	0x180095620

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Arabic	Saudi Arabia
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
Greek	Greece
Finnish	Finland
French	France
Hebrew	Israel
Hungarian	Hungary
Italian	Italy
Japanese	Japan
Korean	North Korea
Korean	South Korea
Dutch	Netherlands
Norwegian	Norway
Polish	Poland
Portuguese	Brazil
Russian	Russia
Slovak	Slovakia
Swedish	Sweden
Thai	Thailand
Turkish	Turkey
Ukrainian	Ukrain
Slovenian	Slovenia
Chinese	China
English	Great Britain
Spanish	Mexico
Portuguese	Portugal

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 09:19:22.295336962 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:22.415451050 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:22.415554047 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:22.439450979 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:22.559659958 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:29.194263935 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:29.194310904 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:29.194336891 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:29.194345951 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:29.194416046 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:29.194417000 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:29.225811005 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:29.345798969 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:36.621064901 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:36.621117115 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:36.633233070 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:36.753016949 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:43.831407070 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:19:43.831598997 CET	49741	8817	192.168.2.4	94.232.40.41
Dec 17, 2024 09:19:44.984237909 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:19:45.106317997 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:19:45.106620073 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:19:45.106976032 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:19:45.226632118 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:15.554939032 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:15.554963112 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:15.554995060 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:15.555030107 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:15.555084944 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:15.560060024 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:15.679790974 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:22.195498943 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:22.195883989 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:22.196615934 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:22.316468954 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.188671112 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.188771963 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.192287922 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.192323923 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.192368031 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.192409039 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308468103 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308511972 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308547020 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308579922 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308643103 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308640003 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308640957 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308677912 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308710098 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308711052 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308711052 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308737040 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308754921 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308762074 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308794975 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308816910 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308837891 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308881998 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308916092 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308927059 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308948994 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.308958054 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.308999062 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.380614042 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.380835056 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.380835056 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.380882978 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.384877920 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.384944916 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.384989023 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.385045052 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.415731907 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.415905952 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.428917885 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.429007053 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.429053068 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.429053068 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.433073044 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.433132887 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.433187962 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.433239937 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.441751003 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.441792965 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.441807985 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.441842079 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.450268030 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.450330973 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.450371027 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.450596094 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.456341028 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.456398010 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.456413984 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.456454992 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.462308884 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.462403059 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.462443113 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.462492943 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.468319893 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.468381882 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.468424082 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.468468904 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.474358082 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.474423885 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.474476099 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.474525928 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.480427980 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.480464935 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.480485916 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.480511904 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.494163036 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.494229078 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.494261026 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.494298935 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.500618935 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.500674009 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.500758886 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.500821114 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.503690004 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.503746033 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.572829962 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.572900057 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.572962999 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.573010921 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.575784922 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.575834036 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.575875998 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.575921059 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.581872940 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.581944942 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.581976891 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.582030058 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.587805033 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.587866068 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.587908983 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.587949991 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.594101906 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.594161034 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.594248056 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.594297886 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.600042105 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.600099087 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.600132942 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.600183964 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.605858088 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.605916977 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.605953932 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.606002092 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.611824036 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.611891985 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.611934900 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.611989975 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.617244005 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.617326975 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.617362976 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.617412090 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.622457027 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.622513056 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.622550011 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.622597933 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.627686024 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.627762079 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.627791882 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.627837896 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.632873058 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.632936954 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.632953882 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.632997036 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.636133909 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.636184931 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.636265039 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.636308908 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.647068024 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.647106886 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.647118092 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.647181034 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.647212982 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.647221088 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.647232056 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.647241116 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.647268057 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.647294044 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.659223080 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.659235954 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.659291983 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.659348965 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.659399986 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.659457922 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.659512043 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.659545898 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.659555912 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.659564972 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.659574986 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.659590006 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.659612894 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.662029982 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.662087917 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.662132025 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.662178993 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.665261984 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.665311098 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.665357113 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.665399075 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.692990065 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.693042040 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.693100929 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.693144083 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.694664001 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.694724083 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.694787025 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.694827080 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.697921991 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.697988987 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.698026896 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.698070049 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.701168060 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.701210976 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.701231956 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.701268911 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.764759064 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.764823914 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.764889002 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.764889002 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.766258955 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.766417980 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.766875982 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.766932964 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.767019033 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.767070055 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.768807888 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.768860102 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.768915892 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.768960953 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.772070885 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.772123098 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.772140980 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.772187948 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.775294065 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.775346994 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.775382996 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.775427103 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.778400898 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.778451920 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.778506994 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.778553009 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.781554937 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.781609058 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.781653881 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.781698942 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.784689903 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.784742117 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.784802914 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.784843922 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.787830114 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.787877083 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.787930012 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.787975073 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.790548086 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.790592909 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.790636063 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.790684938 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.793212891 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.793260098 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.793277025 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.793315887 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.795752048 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.795804024 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.795846939 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.795892954 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:42.798315048 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:42.798372984 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.597392082 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.597438097 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.597568035 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.597784996 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.597836018 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.597901106 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.597942114 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.599597931 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.599657059 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.600092888 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.600146055 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.600234032 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.600284100 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.601914883 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.601969004 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.602030993 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.602081060 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.603699923 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.603758097 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.603811026 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.603856087 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.605505943 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.605552912 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.711086988 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.711162090 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.711174965 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.711278915 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.711432934 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.711489916 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.711534977 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.711944103 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.713217020 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.713280916 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.713335991 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.713407040 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.714979887 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.715032101 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.715073109 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.715109110 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.716794968 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.716849089 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.716914892 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.716955900 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.718600035 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.718704939 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.718750954 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.720393896 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.720541000 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.720571041 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.720782042 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.722173929 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.722215891 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.722315073 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.722354889 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.724114895 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.724181890 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.724220991 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.724301100 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.725869894 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.725888968 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.725924969 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.725948095 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.727566957 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.727617025 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.727668047 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.727751017 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.729372978 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.729422092 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.729465008 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.729504108 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.789333105 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.792454004 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.824755907 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.824839115 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.824949026 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.825623989 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.825777054 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.825831890 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.827374935 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.827442884 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.827497959 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.829189062 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.829241991 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.829298973 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.830838919 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.830977917 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.831022978 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.831091881 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.831139088 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.832830906 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.832882881 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.832997084 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.833043098 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.834579945 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.834629059 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.834745884 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.835947037 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:20:48.836389065 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.836484909 CET	8817	49752	94.232.46.11	192.168.2.4
Dec 17, 2024 09:20:48.836534023 CET	49752	8817	192.168.2.4	94.232.46.11
Dec 17, 2024 09:21:13.845971107 CET	8817	49741	94.232.40.41	192.168.2.4
Dec 17, 2024 09:21:13.846065044 CET	49741	8817	192.168.2.4	94.232.40.41

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 09:19:21.544512987 CET	56452	53	192.168.2.4	1.1.1.1
Dec 17, 2024 09:19:22.289901018 CET	53	56452	1.1.1.1	192.168.2.4
Dec 17, 2024 09:19:43.835443020 CET	56716	53	192.168.2.4	1.1.1.1
Dec 17, 2024 09:19:44.828200102 CET	56716	53	192.168.2.4	1.1.1.1
Dec 17, 2024 09:19:44.983184099 CET	53	56716	1.1.1.1	192.168.2.4
Dec 17, 2024 09:19:44.983205080 CET	53	56716	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 09:19:21.544512987 CET	192.168.2.4	1.1.1.1	0x1ebf	Standard query (0)	cronoze.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 09:19:43.835443020 CET	192.168.2.4	1.1.1.1	0xb38e	Standard query (0)	muuxxu.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 09:19:44.828200102 CET	192.168.2.4	1.1.1.1	0xb38e	Standard query (0)	muuxxu.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 09:19:22.289901018 CET	1.1.1.1	192.168.2.4	0x1ebf	No error (0)	cronoze.com	94.232.40.41	A (IP address)	IN (0x0001)	false
Dec 17, 2024 09:19:44.983184099 CET	1.1.1.1	192.168.2.4	0xb38e	No error (0)	muuxxu.com	94.232.46.11	A (IP address)	IN (0x0001)	false
Dec 17, 2024 09:19:44.983205080 CET	1.1.1.1	192.168.2.4	0xb38e	No error (0)	muuxxu.com	94.232.46.11	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	03:19:00
Start date:	17/12/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\TiNgny4xSB.dll"
Imagebase:	0x7ff70cf20000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:19:00
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:19:00
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1
Imagebase:	0x7ff787060000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:19:00
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMAddNewDesktop
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:19:00
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",#1
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:19:01
Start date:	17/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4248 -s 496
Imagebase:	0x7ff7699e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:19:03
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMEnumDesktopInfos
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:19:04
Start date:	17/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2492 -s 492
Imagebase:	0x7ff7ca510000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:19:06
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\TiNgny4xSB.dll,DMEnumDesktops
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:19:07
Start date:	17/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7208 -s 488
Imagebase:	0x7ff7ca510000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMAddNewDesktop
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMEnumDesktopInfos
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",DMEnumDesktops
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nviewExecute
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewUnload
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewUninstallNotify
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewLoadHook
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",nViewCmd
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000015.00000002.3015117531.0000021809ECC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000015.00000002.3020109408.000002180A014000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000015.00000002.3015117531.0000021809F74000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",WMSetSettingHWND
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",WMParseSetting
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMUpdate
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMSetStartupProfile
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMSave
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLock
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoadEx
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoadApp
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMLoad
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMImport
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetStartupProfile
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileInfoEx
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileInfo
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetProfileDirectory
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMGetCurrentProfile
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMFindProfile
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMEnum
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",PMDelete
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",NViewUserInterfaceSetting
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:19:10
Start date:	17/12/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\TiNgny4xSB.dll",NViewGlobalSetting
Imagebase:	0x7ff6cbf50000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	99.2%
Signature Coverage:	18.4%
Total number of Nodes:	255
Total number of Limit Nodes:	8

Executed Functions

Function 00007FFDFB547CA4 Relevance: 24.0, APIs: 1, Strings: 2, Instructions: 19536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+=, xrefs: 00007FFDFB548C45
,=, xrefs: 00007FFDFB548B99

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID:
String ID: +=$,=
API String ID: 0-3116756818
Opcode ID: 86d877f4bfbdb9dbd774ef72c11f05b79659dfa0d66e50673e85384098f5fb92
Instruction ID: 217750a8d1908cb955c2d51eded8c7d8101ab4a50f48bc8bcf8da0a0d082182f
Opcode Fuzzy Hash: 86d877f4bfbdb9dbd774ef72c11f05b79659dfa0d66e50673e85384098f5fb92
Instruction Fuzzy Hash: E3242B52F7569C06EE59C1720AB17FA40C65FB6BE9F64F73AFC0A26BE0D91E54834080

Function 00007FFDFB549790 Relevance: 18.7, APIs: 1, Instructions: 17454
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FFDFB550878

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cf5cb5571d315598206a8790c9a41924e950f52808e5ddc8a3697dcb9696509b
Instruction ID: 35dcd01f8609a933a9e15dee1416dc6d2e9547fcda4a8b132a070716fc7f6b63
Opcode Fuzzy Hash: cf5cb5571d315598206a8790c9a41924e950f52808e5ddc8a3697dcb9696509b
Instruction Fuzzy Hash: F6142B52F7569C06EE59C1720AA17FA80C65FB67E9F64F73AFC0A26BE0DD1E54834080

Function 00000001800026C0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 269
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180002CB0: GetModuleFileNameW.KERNEL32 ref: 0000000180002CFC

GetModuleFileNameW.KERNEL32 ref: 000000018000276F
SHGetSpecialFolderPathW.SHELL32 ref: 0000000180002786
lstrcatW.KERNEL32 ref: 000000018000279A
lstrcatW.KERNEL32 ref: 00000001800027AE
lstrcatW.KERNEL32 ref: 00000001800027C2
lstrcatW.KERNEL32 ref: 00000001800027D6
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0000000180002B4F

Strings

nViewCmd, xrefs: 0000000180002A43
\NTUSER.DAT.Not, xrefs: 000000018000278C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: lstrcat$FileModuleName$FolderIos_base_dtorPathSpecialstd::ios_base::_
String ID: \NTUSER.DAT.Not$nViewCmd
API String ID: 2606783807-1926657965
Opcode ID: a946bae1627097ab7b73f61163b0859f0a6ae39e4bd01eb7db3eba8b1cf675f5
Instruction ID: 3dd1c745be193ef327f8b6b82ef9b9860cbb876b441ce7f55bb8257e988bbc7a
Opcode Fuzzy Hash: a946bae1627097ab7b73f61163b0859f0a6ae39e4bd01eb7db3eba8b1cf675f5
Instruction Fuzzy Hash: 7FE15B32224B8989EBA1DF24D8943DD3761FB897C8F809126F64E47AA9DF74C64DC740

Function 000001ABB9100B00 Relevance: 4.1, APIs: 3, Instructions: 371
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000001ABB9100C5E
VirtualAlloc.KERNELBASE ref: 000001ABB9100CCC

Memory Dump Source

Source File: 00000000.00000002.3010135300.000001ABB9100000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001ABB9100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1abb9100000_loaddll64.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7479d515978b8398c8f18a7fbb8c6ce0b9f2a044b6e8d29228c90f9ede51720f
Instruction ID: 7dfc6ee1f97dc18e7abf28b850f0c568775909a36764838c8c8edc3bcf82f8d6
Opcode Fuzzy Hash: 7479d515978b8398c8f18a7fbb8c6ce0b9f2a044b6e8d29228c90f9ede51720f
Instruction Fuzzy Hash: 47E14D3021DB889FE794EB28C099B6ABBE0FB9D349F50495DF489C3261D775D880DB02

Non-executed Functions

Function 00007FFDFB533888 Relevance: 83.3, APIs: 55, Instructions: 815COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB5338E1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB53390A
_Getctype.LIBCPMT ref: 00007FFDFB53393E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB5339A3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB5339CC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533A13
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533A3C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533A8E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533AB7
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533B09
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533B32
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533B8B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533BB4
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533BE8
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533C11
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533C45
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533C6E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533CCC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533CF5
_Getcoll.LIBCPMT ref: 00007FFDFB533D29
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533D5F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533D88
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533DCB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533DF4
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533E33
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533E5C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533EA3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533ECC
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533F1E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533F47
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB533F99
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB533FC2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB53402F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB534058
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB5340BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB5340E8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB53411C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB534145
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB534179
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB5341A2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB5341D6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB5341FF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB534249
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB534272
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB5342EC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB534315
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB534395
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB5343BE
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB5343F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB53441B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB534464
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB53448D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB534504
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB53452D
_Getvals.LIBCPMT ref: 00007FFDFB5342BA

Part of subcall function 00007FFDFB51E35C: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB51E380
Part of subcall function 00007FFDFB51E35C: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB51E426

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$GetcollGetctypeGetvals
String ID:
API String ID: 553569086-0
Opcode ID: cc1d26aba2546da7b1fcf5844c4f230db50ba833807d6ae51ac09d0ade22bb7f
Instruction ID: 5bf8247adae537453bda2b6c8797fb481ab5400ec694285e6291f3079d4658d1
Opcode Fuzzy Hash: cc1d26aba2546da7b1fcf5844c4f230db50ba833807d6ae51ac09d0ade22bb7f
Instruction Fuzzy Hash: 79823D21B0BE43D5EB569F15D870AB826A1AF44784F085535EA2E8B7FBDF3CE5818340

Function 00007FFDFB5E59E0 Relevance: 59.8, APIs: 20, Strings: 14, Instructions: 260
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFDFB505ED0: RegOpenCurrentUser.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB4EEA7C), ref: 00007FFDFB505F11
Part of subcall function 00007FFDFB505ED0: RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB4EEA7C), ref: 00007FFDFB505F45
Part of subcall function 00007FFDFB505ED0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB4EEA7C), ref: 00007FFDFB505F52

SHDeleteKeyW.SHLWAPI ref: 00007FFDFB5E5A47

Part of subcall function 00007FFDFB505E70: RegCreateKeyExW.ADVAPI32 ref: 00007FFDFB505EA6

lstrlenW.KERNEL32 ref: 00007FFDFB5E5AE4
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5B0D
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5B40
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5B76
lstrlenW.KERNEL32 ref: 00007FFDFB5E5BD3
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5BFE
lstrlenW.KERNEL32 ref: 00007FFDFB5E5C0B
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5C38
lstrlenW.KERNEL32 ref: 00007FFDFB5E5C4C
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5C72
lstrlenW.KERNEL32 ref: 00007FFDFB5E5CE7
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5D12
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5D9F
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5DCC
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5DF9
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5E26
lstrlenW.KERNEL32 ref: 00007FFDFB5E5E31
RegSetValueExW.ADVAPI32 ref: 00007FFDFB5E5E5C
RegCloseKey.ADVAPI32 ref: 00007FFDFB5E5E8B

Strings

Desktop, xrefs: 00007FFDFB5E5BDE
Flags, xrefs: 00007FFDFB5E5B61
DesktopGUID, xrefs: 00007FFDFB5E5C16
MonGridID, xrefs: 00007FFDFB5E5B2B
Key, xrefs: 00007FFDFB5E5E3C
Profile, xrefs: 00007FFDFB5E5C57
Alt, xrefs: 00007FFDFB5E5D8A
Shift, xrefs: 00007FFDFB5E5DE4
Ctrl, xrefs: 00007FFDFB5E5DB7
Hotkeys, xrefs: 00007FFDFB5E5A38, 00007FFDFB5E5A62
Software\NVIDIA Corporation\Global\nView, xrefs: 00007FFDFB5E5A11
Action, xrefs: 00007FFDFB5E5AEF
Window, xrefs: 00007FFDFB5E5E11
Application, xrefs: 00007FFDFB5E5CF2

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Value$lstrlen$CloseCreate$CurrentDeleteOpenUser
String ID: Action$Alt$Application$Ctrl$Desktop$DesktopGUID$Flags$Hotkeys$Key$MonGridID$Profile$Shift$Software\NVIDIA Corporation\Global\nView$Window
API String ID: 1715684290-2541343727
Opcode ID: a33a7fb957cd7eaee88febeababe780ee3a1b426742b96cacf49444184a1573b
Instruction ID: f3b8c8d18dfe1f16658f80cfcc98e9268aec8fa474d76964cf4d6ed89e0290d0
Opcode Fuzzy Hash: a33a7fb957cd7eaee88febeababe780ee3a1b426742b96cacf49444184a1573b
Instruction Fuzzy Hash: 0CD1A376719B8286EB61CF15F460AAAB7A1FB85784F484031DA9D47BADDF3CD109CB00

Function 00007FFDFB541AE4 Relevance: 51.5, APIs: 34, Instructions: 509COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB53F474: _Getcoll.LIBCPMT ref: 00007FFDFB53F510

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541B4D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541B76
_Getcoll.LIBCPMT ref: 00007FFDFB541BAA
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541BE3
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541C0C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541C4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541C78
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541CB7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541CE0
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541D27
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541D50
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541DA2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541DCB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541E1D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541E46
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541EB8
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541EE1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541F49
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541F72
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB541FA6
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB541FCF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB542003
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB54202C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB542060
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB542089
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB5420D0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB5420F9
_Getvals.LIBCPMT ref: 00007FFDFB542141
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB542173
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB54219C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB54221C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB542245
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB542279
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB5422A2

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getcoll$Getvals
String ID:
API String ID: 3082291583-0
Opcode ID: 8b1a8ad9373894655f5b98a5904e86640b72ee8057499afeee4d687079a7b8ae
Instruction ID: 925917399839b31c3fa4233e8538665cfc92662169927ba2c9f214a440bf4fec
Opcode Fuzzy Hash: 8b1a8ad9373894655f5b98a5904e86640b72ee8057499afeee4d687079a7b8ae
Instruction Fuzzy Hash: 27324C21B1BA53D4EB429B15D870ABA37A5AF44784F085435EA2D4B7FFDE3CE6818340

Function 00000001800330A8 Relevance: 29.1, APIs: 19, Instructions: 555COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00000001800341D7

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 00000001800341FE

Part of subcall function 0000000180031B68: malloc.LIBCMT ref: 0000000180031B93
Part of subcall function 0000000180031B68: Sleep.KERNEL32(?,?,00000000,00000001800302E4,?,?,00000000,00000001800301E3,?,?,00000000,0000000180038B02,?,?,00000000,0000000180038A6E), ref: 0000000180031BA6

_invoke_watson.LIBCMT ref: 0000000180034821
_invoke_watson.LIBCMT ref: 0000000180034837
_invoke_watson.LIBCMT ref: 000000018003484D
_invoke_watson.LIBCMT ref: 0000000180034863
_invoke_watson.LIBCMT ref: 0000000180034879
_invoke_watson.LIBCMT ref: 000000018003488F
_invoke_watson.LIBCMT ref: 00000001800348A5
_invoke_watson.LIBCMT ref: 00000001800348BB
_invoke_watson.LIBCMT ref: 00000001800348D1
_invoke_watson.LIBCMT ref: 00000001800348E7
_invoke_watson.LIBCMT ref: 00000001800348FD
_invoke_watson.LIBCMT ref: 0000000180034913
_invoke_watson.LIBCMT ref: 0000000180034929
_invoke_watson.LIBCMT ref: 000000018003493F
_invoke_watson.LIBCMT ref: 0000000180034955
_invoke_watson.LIBCMT ref: 000000018003496B
_invoke_watson.LIBCMT ref: 0000000180034981

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _invoke_watson$Locale$SleepUpdateUpdate::___updatetlocinfo__updatetmbcinfo_getptd_malloc_crtmalloc
String ID:
API String ID: 3294838543-0
Opcode ID: 521078f5cd82ac0f084921f5033d007348db3b2902225dc428b05784ca17b11c
Instruction ID: 084eb429915106ff2183acdcc5e5956807c1a06688872eada26f31bf39ac8827
Opcode Fuzzy Hash: 521078f5cd82ac0f084921f5033d007348db3b2902225dc428b05784ca17b11c
Instruction Fuzzy Hash: C8220332320A4882EBA7DA65E51A3EF2391F7497C4F45D126EF4E8E695DF38D6098300

Function 00007FFDFB5CB880 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 201libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FFDFB5CB8D9
GetProcAddress.KERNEL32 ref: 00007FFDFB5CB909
GetProcAddress.KERNEL32 ref: 00007FFDFB5CB939
GetProcAddress.KERNEL32 ref: 00007FFDFB5CB965
GetProcAddress.KERNEL32 ref: 00007FFDFB5CB991

Part of subcall function 00007FFDFB5CD730: VerSetConditionMask.KERNEL32 ref: 00007FFDFB5CD77C
Part of subcall function 00007FFDFB5CD730: VerifyVersionInfoW.KERNEL32 ref: 00007FFDFB5CD7A7

LocalAlloc.KERNEL32 ref: 00007FFDFB5CBA66
LocalFree.KERNEL32 ref: 00007FFDFB5CBB35
LocalFree.KERNEL32 ref: 00007FFDFB5CBB49
LocalFree.KERNEL32 ref: 00007FFDFB5CBBA9

Strings

SetupDiDestroyDeviceInfoList, xrefs: 00007FFDFB5CB987
SetupDiGetDeviceInterfaceDetailW, xrefs: 00007FFDFB5CB95B
SetupDiGetClassDevsW, xrefs: 00007FFDFB5CB8CF
SetupDiEnumDeviceInfo, xrefs: 00007FFDFB5CB8FF
SetupDiGetDeviceRegistryPropertyW, xrefs: 00007FFDFB5CB92F
Setupapi.dll, xrefs: 00007FFDFB5CB8AA

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: AddressProc$Local$Free$AllocConditionInfoMaskVerifyVersion
String ID: SetupDiDestroyDeviceInfoList$SetupDiEnumDeviceInfo$SetupDiGetClassDevsW$SetupDiGetDeviceInterfaceDetailW$SetupDiGetDeviceRegistryPropertyW$Setupapi.dll
API String ID: 3934038308-2811369298
Opcode ID: e85f8b9fea547775601d8e81dcbe227e5add79599dd2361e74400f1dff2c490d
Instruction ID: 16c499cfa4e32fb392a153a65e403dfbc6b50d52caab379cb345b26644267c49
Opcode Fuzzy Hash: e85f8b9fea547775601d8e81dcbe227e5add79599dd2361e74400f1dff2c490d
Instruction Fuzzy Hash: 0C917A65B0BB4786EB628F25E864A7563A1BF44B94F484231CA6D067FDEF7CE584C300

Function 00000001800176E4 Relevance: 22.1, APIs: 10, Strings: 2, Instructions: 1114COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000F2A8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2C9
Part of subcall function 000000018000F2A8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2EE

_Mpunct.LIBCPMT ref: 00000001800178AF
_Mpunct.LIBCPMT ref: 0000000180017E71
_Mpunct.LIBCPMT ref: 0000000180017E94
_Mpunct.LIBCPMT ref: 0000000180017F99
_Mpunct.LIBCPMT ref: 0000000180017FFE
_Mpunct.LIBCPMT ref: 0000000180018024
_Mpunct.LIBCPMT ref: 000000018001812B
_Mpunct.LIBCPMT ref: 0000000180018191
_Mpunct.LIBCPMT ref: 00000001800181D6
_Mpunct.LIBCPMT ref: 000000018001821B

Strings

, xrefs: 000000018001850A
0123456789-, xrefs: 000000018001783F, 00000001800179A1, 0000000180017BCB, 0000000180017DB4

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID: $0123456789-
API String ID: 491317670-700845222
Opcode ID: bfea4566b3dd4f2453845a7a2c0565e6247bc10b50b38d8d916d4313fb2cf9fb
Instruction ID: a70e222771d2648924d77d9fb61618b5019d1f7d64ecee5f6b6d25d0e3028cf4
Opcode Fuzzy Hash: bfea4566b3dd4f2453845a7a2c0565e6247bc10b50b38d8d916d4313fb2cf9fb
Instruction Fuzzy Hash: 99A26D32704A8885EBA68B65D0503ED27B1FB49BC8F54D016EE4E1BB96DF34CB99D340

Function 0000000180016744 Relevance: 22.1, APIs: 10, Strings: 2, Instructions: 1110COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000F048: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F069
Part of subcall function 000000018000F048: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F08E

_Mpunct.LIBCPMT ref: 000000018001690F
_Mpunct.LIBCPMT ref: 0000000180016ED1
_Mpunct.LIBCPMT ref: 0000000180016EF4
_Mpunct.LIBCPMT ref: 0000000180016FF9
_Mpunct.LIBCPMT ref: 000000018001705E
_Mpunct.LIBCPMT ref: 0000000180017084
_Mpunct.LIBCPMT ref: 000000018001718B
_Mpunct.LIBCPMT ref: 00000001800171F1
_Mpunct.LIBCPMT ref: 0000000180017236
_Mpunct.LIBCPMT ref: 000000018001727B

Strings

, xrefs: 000000018001756A
0123456789-, xrefs: 000000018001689F, 0000000180016A01, 0000000180016C2B, 0000000180016E14

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID: $0123456789-
API String ID: 491317670-700845222
Opcode ID: 7023ceb1d819ec1a1cf44c7629e55f05b0496f09250da5da42953131b9d5b64b
Instruction ID: 80943f5e6f8277e2c6515c65fe0f4c286d5afc9ab992b988177440c4078c9487
Opcode Fuzzy Hash: 7023ceb1d819ec1a1cf44c7629e55f05b0496f09250da5da42953131b9d5b64b
Instruction Fuzzy Hash: 3FA26F32B04A8885EBA68B65D4503ED27B1FB49BC8F54D416FE4E17BA5DF34CA99C300

Function 0000000180024F60 Relevance: 22.1, APIs: 10, Strings: 2, Instructions: 1051COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180023DE4: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E05
Part of subcall function 0000000180023DE4: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E2A

_Mpunct.LIBCPMT ref: 0000000180025125
_Mpunct.LIBCPMT ref: 0000000180025675
_Mpunct.LIBCPMT ref: 0000000180025692
_Mpunct.LIBCPMT ref: 0000000180025784
_Mpunct.LIBCPMT ref: 00000001800257BB
_Mpunct.LIBCPMT ref: 00000001800257DF
_Mpunct.LIBCPMT ref: 00000001800258D3
_Mpunct.LIBCPMT ref: 0000000180025908
_Mpunct.LIBCPMT ref: 0000000180025948
_Mpunct.LIBCPMT ref: 0000000180025988

Strings

0123456789-, xrefs: 00000001800250C1, 0000000180025202, 000000018002540A, 00000001800255C0
, xrefs: 0000000180025C35

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID: $0123456789-
API String ID: 491317670-700845222
Opcode ID: 5b1f11ae308e5f978eadb6c2e653d3aa161437b62689c1e79878b92cd71a40da
Instruction ID: 357b8073b20dd1810e5d3b735acf5af2621e0edfda92cd437dcbf710b5a8daa8
Opcode Fuzzy Hash: 5b1f11ae308e5f978eadb6c2e653d3aa161437b62689c1e79878b92cd71a40da
Instruction Fuzzy Hash: 10A2C032604A8889FBA7CB65C4503EC27A1F749BC9F94C516EE8A1B7D6CF79C649C304

Function 00007FFDFB4F3AC0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 373COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB4F3EFF

Part of subcall function 00007FFDFB507DB0: OutputDebugStringW.KERNEL32(?,?,00000000,00007FFDFB4F3F9F), ref: 00007FFDFB507DCC

Part of subcall function 00007FFDFB4F3AC0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB4F4091

Strings

PROCESS_DPI_UNAWARE: , xrefs: 00007FFDFB4F3AFE
pos(%4i %4i) size(%4i %4i), xrefs: 00007FFDFB4F3B65, 00007FFDFB4F3C25, 00007FFDFB4F3D5C, 00007FFDFB4F3E16
PROCESS_SYSTEM_DPI_AWARE:, xrefs: 00007FFDFB4F3CF5

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$DebugOutputString
String ID: PROCESS_DPI_UNAWARE: $PROCESS_SYSTEM_DPI_AWARE:$pos(%4i %4i) size(%4i %4i)
API String ID: 2094900029-4252665117
Opcode ID: 85a60f2d8ffb92b3b955a4c4e3d9345ff51b603904541ac03c4a1694e57f1e83
Instruction ID: add3b8c0c5b4b7a964252f38a127ea519940a33b0a4cdb2cc9c6b8de9b4e82cc
Opcode Fuzzy Hash: 85a60f2d8ffb92b3b955a4c4e3d9345ff51b603904541ac03c4a1694e57f1e83
Instruction Fuzzy Hash: 2DF1C272B1968285EB00CB69E950AAD6771FB85798F405231EEAD57BEDDF3CD180C700

Function 00007FFDFB58BAA0 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFDFB58BB19
VirtualAlloc.KERNEL32 ref: 00007FFDFB58BB31
RtlVirtualUnwind.KERNEL32 ref: 00007FFDFB58BB6C
IsDebuggerPresent.KERNEL32 ref: 00007FFDFB58BBA5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB58BBAF
UnhandledExceptionFilter.KERNEL32 ref: 00007FFDFB58BBBA

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterUnhandledVirtual$AllocCaptureContextDebuggerPresentUnwind
String ID:
API String ID: 652048205-0
Opcode ID: 74f302650ea22c8baa3c60128528fb1732c039564dfa2e4d10febfda72840b98
Instruction ID: 0ef7ae8c6c6b41c38304b2b7454c1da3b4eefa8411bf3fa8f5f80d4716b8c325
Opcode Fuzzy Hash: 74f302650ea22c8baa3c60128528fb1732c039564dfa2e4d10febfda72840b98
Instruction Fuzzy Hash: DC31AF36719F8286DB618F24E8606AE73A4FB88754F440135EAAD43BA9DF3CC2458B00

Function 00007FFDFB4FF920 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 498COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB4FFF9D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB4FFFA3
IntersectRect.USER32 ref: 00007FFDFB5000D1

Part of subcall function 00007FFDFB5ABD58: _invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB5ABD7E

Strings

%s.%d, xrefs: 00007FFDFB4FFC8A

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$IntersectRect_invalid_parameter_noinfo
String ID: %s.%d
API String ID: 4259794798-645285463
Opcode ID: 6438858dd273fba176203d8a1c05fd6ef383d212fa491cf30b253a11f741a631
Instruction ID: 2b4b9115c4cab38a978847534764768e98840fb109734beb888676cb0526643f
Opcode Fuzzy Hash: 6438858dd273fba176203d8a1c05fd6ef383d212fa491cf30b253a11f741a631
Instruction Fuzzy Hash: C122B172B0A6C286E7608F14E1647A9BBA0FB44784F544136EAAD477EDDF3CE544CB00

Function 000000018001B924 Relevance: 6.5, APIs: 4, Instructions: 543COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 000000018001BA07
_Mpunct.LIBCPMT ref: 000000018001BB21
_Mpunct.LIBCPMT ref: 000000018001BBAA

Part of subcall function 000000018000F2A8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2C9
Part of subcall function 000000018000F2A8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2EE

_Mpunct.LIBCPMT ref: 000000018001BB3A

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID:
API String ID: 491317670-0
Opcode ID: 32a054681ada761a3f21b934110cbacde2a58451cc4452ceb2e2b32a685144d7
Instruction ID: ae333f1357bb5ac04765cce638402cad7685101a5c7d4aa2e7d208c612dcf27a
Opcode Fuzzy Hash: 32a054681ada761a3f21b934110cbacde2a58451cc4452ceb2e2b32a685144d7
Instruction Fuzzy Hash: 1F32B032604E9885EBA68F25D8453ED63A4F75CBC8F548111FB8957B99EF38CA89C340

Function 000000018001B138 Relevance: 6.5, APIs: 4, Instructions: 543COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 000000018001B21B
_Mpunct.LIBCPMT ref: 000000018001B335
_Mpunct.LIBCPMT ref: 000000018001B3BE

Part of subcall function 000000018000F048: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F069
Part of subcall function 000000018000F048: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F08E

_Mpunct.LIBCPMT ref: 000000018001B34E

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID:
API String ID: 491317670-0
Opcode ID: d8653a78ccc0500016ee3a39bc8ed8050953f96735a7a63760c9342397005fa0
Instruction ID: 4647e442d3bcfc851c9f4701ce4f14d67acf718bc96bb144a9f397481643842c
Opcode Fuzzy Hash: d8653a78ccc0500016ee3a39bc8ed8050953f96735a7a63760c9342397005fa0
Instruction Fuzzy Hash: 9C32B132604E9886EBA29F25D8453ED63A5F758BC8F54C111FF8957B99EF38C689C300

Function 0000000180026890 Relevance: 6.5, APIs: 4, Instructions: 524COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 000000018002696A
_Mpunct.LIBCPMT ref: 0000000180026AA6
_Mpunct.LIBCPMT ref: 0000000180026B14

Part of subcall function 0000000180023DE4: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E05
Part of subcall function 0000000180023DE4: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E2A

_Mpunct.LIBCPMT ref: 0000000180026AC2

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct$LockitLockit::_std::_
String ID:
API String ID: 491317670-0
Opcode ID: 72a7ac2e2c1f111e1b61ae734374779d00f08ed685c08311d7ac3453d226d6ed
Instruction ID: 2589bcd918802237b5c990292f2751727b1abcad383ca43231b0e5c6f6b0472f
Opcode Fuzzy Hash: 72a7ac2e2c1f111e1b61ae734374779d00f08ed685c08311d7ac3453d226d6ed
Instruction Fuzzy Hash: 93324E72A04BC885EB678F25C4503ED6761F399BC8F54C112EA8D57BAADF39C689C340

Function 00000001800147EC Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 962COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000FAF8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB19
Part of subcall function 000000018000FAF8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB3E

_Mpunct.LIBCPMT ref: 000000018001488A
localeconv.LIBCMT ref: 0000000180014F23

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 00000001800148DA, 0000000180014C1B, 0000000180014E4D, 0000000180015096, 00000001800153AC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 3643605086-3606100449
Opcode ID: 94432bfd2f8d95df277d2e9dbc6edac5d8f0baf28bc49a8a7a32c7f5d36230e7
Instruction ID: 5ab51ccc94a7dab44ec95765bb0b019680b649c223dae5af60e6b35ee96dccf9
Opcode Fuzzy Hash: 94432bfd2f8d95df277d2e9dbc6edac5d8f0baf28bc49a8a7a32c7f5d36230e7
Instruction Fuzzy Hash: C8925E37204A88C5EBA68B65C1503FD37A1FB49BC4F54C016EE9A1BBA5DF35CA5AC310

Function 0000000180013BA0 Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 962COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000F9C8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F9E9
Part of subcall function 000000018000F9C8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FA0E

_Mpunct.LIBCPMT ref: 0000000180013C3E
localeconv.LIBCMT ref: 00000001800142D7

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 0000000180013C8E, 0000000180013FCF, 0000000180014201, 000000018001444A, 0000000180014760

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 3643605086-3606100449
Opcode ID: 2b3747df4bcc6815d0ca050ff0a1d26fc9399c5a2f48bb3d04cf2418fda5afce
Instruction ID: 15170c7321f925de93854cd2b60bf2d9794a6949502e19fd89cf563b34aba275
Opcode Fuzzy Hash: 2b3747df4bcc6815d0ca050ff0a1d26fc9399c5a2f48bb3d04cf2418fda5afce
Instruction Fuzzy Hash: 46927E37204A88C5EBA68B66D1503FD27A1FB49BC8F54C415EF5A1B7A1CF35CA9AC310

Function 00000001800097A8 Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 928COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180008330: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008351
Part of subcall function 0000000180008330: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008376

_Mpunct.LIBCPMT ref: 0000000180009842
localeconv.LIBCMT ref: 0000000180009E67

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 0000000180009892, 0000000180009B91, 0000000180009D26, 0000000180009F44, 000000018000A219

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunctlocaleconv
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 3643605086-3606100449
Opcode ID: ee78207987aaf8e6898c223f5fdc8bfa83aea163ec8c7af802b6eb0c56abaefe
Instruction ID: 0951dfdd3adb040bfd2425e3f0e5ac157d4fc1802d06d2afbb1654cb7f49c3dd
Opcode Fuzzy Hash: ee78207987aaf8e6898c223f5fdc8bfa83aea163ec8c7af802b6eb0c56abaefe
Instruction Fuzzy Hash: A782B4323096888AFBA6CBA581503FD3BA1F74ABC4F54C115EF9907796CF25CA5AC310

Function 0000000180013078 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 870COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000000180013135

Part of subcall function 00000001800147EC: _Mpunct.LIBCPMT ref: 000000018001488A

Strings

0123456789-+Ee, xrefs: 0000000180013192, 0000000180013383, 00000001800135BC, 0000000180013805, 0000000180013B1B

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: 0123456789-+Ee
API String ID: 4240859931-1347306980
Opcode ID: d972bc5eca4d0b82fe2e94bffa6b7d9434b9e5222b7b794ba326fb571b0aa537
Instruction ID: 7fa30803b5596d2040c40fa2d6deab6b9b1eebdfa1222772e05d0cd440f79c75
Opcode Fuzzy Hash: d972bc5eca4d0b82fe2e94bffa6b7d9434b9e5222b7b794ba326fb571b0aa537
Instruction Fuzzy Hash: E882A032208A8886FBA68B65C1523FD37A1FB49BC4F54C416EF4A17B95DF39CA59C310

Function 0000000180012550 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 870COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 000000018001260D

Part of subcall function 0000000180013BA0: _Mpunct.LIBCPMT ref: 0000000180013C3E

Strings

0123456789-+Ee, xrefs: 000000018001266A, 000000018001285B, 0000000180012A94, 0000000180012CDD, 0000000180012FF3

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: 0123456789-+Ee
API String ID: 4240859931-1347306980
Opcode ID: 821b9d4d01ecd75d4b1e2aa44c8194800fa5c52a50f71f3b929308d42d9b6223
Instruction ID: 541b46e9ef04b4a6691a8844132f360519d1f98d966391b6e758a932985ee6d9
Opcode Fuzzy Hash: 821b9d4d01ecd75d4b1e2aa44c8194800fa5c52a50f71f3b929308d42d9b6223
Instruction Fuzzy Hash: CF829036204A888AFBA68B65C1503FD37A1FB49BC4F54D416EF4A17795EF34CA69C310

Function 0000000180032E14 Relevance: 6.1, APIs: 4, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180032E3E

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 0000000180032E7E
_invoke_watson.LIBCMT ref: 0000000180032F3C

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 0000000180032F52

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID:
API String ID: 1584724053-0
Opcode ID: bb9541adda1de7d3445963b5d25e419d471c8ff25f1e67a4739099756cf48ec5
Instruction ID: 3aca14fc27a6a15d1b1d6d791e791982332b7847b4ff029bd85a204ab66ebf99
Opcode Fuzzy Hash: bb9541adda1de7d3445963b5d25e419d471c8ff25f1e67a4739099756cf48ec5
Instruction Fuzzy Hash: A331C53232078885EB97DB26D5093DE7795E789BC4F19C135BE8E4BB9ACE38C1068304

Function 0000000180008D6C Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 834COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000000180008E28

Part of subcall function 00000001800097A8: _Mpunct.LIBCPMT ref: 0000000180009842

Strings

0123456789-+Ee, xrefs: 0000000180008E7D, 000000018000903F, 00000001800091D0, 00000001800093E2, 00000001800096B6

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID: 0123456789-+Ee
API String ID: 4240859931-1347306980
Opcode ID: e67974f2d9ac711acb042ba2c3b51c72e12c7e8c571ddf96fbd68d540ecca808
Instruction ID: e252262f3d62f599d6f49dd2fa522cb368fb81fbd5ecc78d30e2ce65ba09eaa7
Opcode Fuzzy Hash: e67974f2d9ac711acb042ba2c3b51c72e12c7e8c571ddf96fbd68d540ecca808
Instruction Fuzzy Hash: 9372A23260A68899FB96CBA681503EC3BA1BB49BC8F54C155EF99077D6CF35C65EC300

Function 00000001800158A0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000F9C8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F9E9
Part of subcall function 000000018000F9C8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FA0E

_Mpunct.LIBCPMT ref: 00000001800158FB

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0000000180015936, 0000000180015C83

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2786813426-2799312399
Opcode ID: 310c16e434c6fb425f377aa5a3344d56e60155a5009237bc210dd0dc5f72e661
Instruction ID: 5fe4dd189a2d79ce61165057c9ebb2e090cd9d14d433b9fec00325c66f72dead
Opcode Fuzzy Hash: 310c16e434c6fb425f377aa5a3344d56e60155a5009237bc210dd0dc5f72e661
Instruction Fuzzy Hash: F0129C36704A88C9FBA28F65D0507ED27A1EB49BC9F54C112EE8A1F789DF35CA49C350

Function 0000000180015EA0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 467COMMON

Download Yara Rule

APIs

Part of subcall function 000000018000FAF8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB19
Part of subcall function 000000018000FAF8: std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB3E

_Mpunct.LIBCPMT ref: 0000000180015EFB

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 0000000180015F36, 0000000180016283

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2786813426-2799312399
Opcode ID: 7f9bde8d58b3e2620bf608a5cc9520c0ecd61f189b4a8a455c5414453c571840
Instruction ID: 027a829814d0a7af50161521d001647e6a208036f76e6a0cfd0a3acd19813199
Opcode Fuzzy Hash: 7f9bde8d58b3e2620bf608a5cc9520c0ecd61f189b4a8a455c5414453c571840
Instruction Fuzzy Hash: 3312C036B04A8885FBA3CB65C4507ED37A1E749BC8F58C016EE4A1B7A5CF35CA49C340

Function 000000018000A314 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 451COMMON

Download Yara Rule

APIs

Part of subcall function 0000000180008330: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008351
Part of subcall function 0000000180008330: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008376

_Mpunct.LIBCPMT ref: 000000018000A36E

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 000000018000A3A5, 000000018000A6A9

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Mpunct
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2786813426-2799312399
Opcode ID: cc0dd99451e0eb2a4836ac02799361a5a9bcabcee1e262923024bb7c99d54d77
Instruction ID: f7f63c79d1b94fbb45dab63fbf242b30916648d9a31090d02f6495e4854cce8f
Opcode Fuzzy Hash: cc0dd99451e0eb2a4836ac02799361a5a9bcabcee1e262923024bb7c99d54d77
Instruction Fuzzy Hash: B9129036708A8889FB92CA75C4503EC3BB1A74ABD8F58C115EE491B796CF75CA4EC350

Function 0000000180019020 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000000180019172

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID:
API String ID: 4240859931-0
Opcode ID: 63fef931675e363a9749f96429758758dd3006f32cce81dee63d7a14f1cdfd87
Instruction ID: b4b31d92be3c4c8e502b6ea2e0a282e668397faed0ae34e767a83c581478e39b
Opcode Fuzzy Hash: 63fef931675e363a9749f96429758758dd3006f32cce81dee63d7a14f1cdfd87
Instruction Fuzzy Hash: FBC1A232B06A9899FB52CFB5C4013EC63B1BB5DB88F448111EE4967A99DF39C64EC340

Function 00000001800193F0 Relevance: 1.8, APIs: 1, Instructions: 283COMMON

Download Yara Rule

APIs

_Mpunct.LIBCPMT ref: 0000000180019542

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Mpunct
String ID:
API String ID: 4240859931-0
Opcode ID: 9787ca75ca63df748a1499e8dd1c5abcefd6f6751ff6d03e7f7fc609e9ac6cfc
Instruction ID: 7c40f0623f709e12c7f828199f14d4f1bd29be792234f51f62a64cc8c6a646a4
Opcode Fuzzy Hash: 9787ca75ca63df748a1499e8dd1c5abcefd6f6751ff6d03e7f7fc609e9ac6cfc
Instruction Fuzzy Hash: B2C1A332B06E9889FB52CFB5D4017EC63B1BB59788F448511EE4967A89EF38C64EC340

Function 00000001800353EC Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,?,00000001800423DB,?,?,00000140,0000000180042AAB), ref: 000000018003541D

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: ef170b939dcdfe0a6fa8f39585badaf32e39fbe27d88ffb3e5b79058c9fef6a5
Instruction ID: a17f45a68611e7ce09ab532a4d12380a5d0071377e1487d1a7a9af1b51f9b2a3
Opcode Fuzzy Hash: ef170b939dcdfe0a6fa8f39585badaf32e39fbe27d88ffb3e5b79058c9fef6a5
Instruction Fuzzy Hash: 5EE0EC35A05A0C81F7C74B12FCD57C623A0A75D3C6FE19601E44C56A70CE7883DD8B00

Function 0000000180032DD8 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0000000180032DE3

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8ebd1b43ab214313b2ad0a09dfd0eba3f354677c67a457a5e5e63f9d14e391ab
Instruction ID: 12656fcb5de8b69835b2dd3a9c331cf0c0323df84e8e99bcec695bc93526836d
Opcode Fuzzy Hash: 8ebd1b43ab214313b2ad0a09dfd0eba3f354677c67a457a5e5e63f9d14e391ab
Instruction Fuzzy Hash: 3DC09B33758D0CC2FB6D1BF274953751111D31DB94F0954349D17053508D2C81DD570C

Function 000000018001F28C Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 11ca8ba6c9e4bc976ad0728efb636439ff8e0f3983e089c52a7ed5c8f874d3e2
Instruction ID: 84605ef311baa56bc5b68e2491e6a8dcf644c937c9e5222fdf1f18ce1bf163ab
Opcode Fuzzy Hash: 11ca8ba6c9e4bc976ad0728efb636439ff8e0f3983e089c52a7ed5c8f874d3e2
Instruction Fuzzy Hash: 0A427A72604A8886FBA68F25D5503BD3361FB89BC8F54D602EF8A17B95DF38C659C300

Function 000000018001FA9C Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: de02513275ad1c1a37e0096a818261c58a998aecf4f08ba4a5899afd53db8295
Instruction ID: 7802ca9db5044afc23cb1f38c8e105cc531337a4395501fdb7ec6a4e23d2f7b6
Opcode Fuzzy Hash: de02513275ad1c1a37e0096a818261c58a998aecf4f08ba4a5899afd53db8295
Instruction Fuzzy Hash: 3D427C32604B4886FBA68B25D5803BD7361FB89BC8F54C512EF8A17B96DF39C659C300

Function 00000001800279B8 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: LockitLockit::_std::_$Stollx
String ID:
API String ID: 3628700584-0
Opcode ID: eb53157097b9bda4a8a3cf500f3039b16533609824c5f9a5ce3e351e3c28d2aa
Instruction ID: 42b5d6b38fa8120ab5fcb54182bbeb98c0f4066ebeec1de4c937208e3a875605
Opcode Fuzzy Hash: eb53157097b9bda4a8a3cf500f3039b16533609824c5f9a5ce3e351e3c28d2aa
Instruction Fuzzy Hash: B8428D72704A8885EBA78B29C5403AD3762FB89BC8F14C616EF9D17796DF39C659C300

Function 00007FFDFB5CF860 Relevance: 44.2, APIs: 22, Strings: 3, Instructions: 441memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CF876
LocalAlloc.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CF9B4
LocalFree.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFA03
LocalAlloc.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFA8A
LocalFree.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFB43
GetLastError.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFBA6
LocalAlloc.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFC08
LocalFree.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFCD4
SetLastError.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFD5C
LocalAlloc.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFDF3
LocalFree.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFE78
LocalFree.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFE81
SetLastError.KERNEL32(?,?,?,?,00000000,00000800,00007FFDFB5D083D,?,?,?,00007FFDFB48127B), ref: 00007FFDFB5CFE9C

Strings

.dll, xrefs: 00007FFDFB5CFD33
system32\, xrefs: 00007FFDFB5CFA14
\SystemRoot\system32\, xrefs: 00007FFDFB5CFA25

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Local$Free$AllocErrorLast
String ID: .dll$\SystemRoot\system32\$system32\
API String ID: 1812497382-2245151201
Opcode ID: 986d128cd5ec6c03168bcf7d5a32634fd447ec2578d54a3a9d6b9f609389f4ff
Instruction ID: 1bd55af3d6479dc811723d4481a6601771c81c9c07f6a1b57577c3423abd33d5
Opcode Fuzzy Hash: 986d128cd5ec6c03168bcf7d5a32634fd447ec2578d54a3a9d6b9f609389f4ff
Instruction Fuzzy Hash: 27F16F91B0B75342FF565B219934A7966A2AF44BC4F484135DE2E477FAEF2CE84E8200

Function 00007FFDFB5CBBD0 Relevance: 38.8, APIs: 15, Strings: 7, Instructions: 291memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBC56
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBC86
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBCC1
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBCFC
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBD25
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBD50
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBE27
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBEFC
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBF27
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBF8A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CBFDD
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CC010
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CC03A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CC043
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FFDFB5CC04C

Part of subcall function 00007FFDFB5CD730: VerSetConditionMask.KERNEL32 ref: 00007FFDFB5CD77C
Part of subcall function 00007FFDFB5CD730: VerifyVersionInfoW.KERNEL32 ref: 00007FFDFB5CD7A7

Strings

nvpowerapi.dll, xrefs: 00007FFDFB5CBBD2
gdi32.dll, xrefs: 00007FFDFB5CBC27
D3DKMTQueryAdapterInfo, xrefs: 00007FFDFB5CBC7C
D3DKMTEnumAdapters3, xrefs: 00007FFDFB5CBCB7
NVDA, xrefs: 00007FFDFB5CBDE8
\SystemRoot\system32\, xrefs: 00007FFDFB5CBEBC
D3DKMTEnumAdapters2, xrefs: 00007FFDFB5CBC4C

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Local$Free$Alloc$AddressProc$ConditionInfoMaskVerifyVersion
String ID: D3DKMTEnumAdapters2$D3DKMTEnumAdapters3$D3DKMTQueryAdapterInfo$NVDA$\SystemRoot\system32\$gdi32.dll$nvpowerapi.dll
API String ID: 2279137159-3107539435
Opcode ID: d09d7bbbbed21704cfcfd05ad7500aad5fc57f30abe4b9fb1f51d63267c4621c
Instruction ID: d485468fae2b21b06e224e318b70784ea9877edf71c96229fdd0c29c281eaa41
Opcode Fuzzy Hash: d09d7bbbbed21704cfcfd05ad7500aad5fc57f30abe4b9fb1f51d63267c4621c
Instruction Fuzzy Hash: 85D17FA5B0AB9785FB528F61D460BB923A2AF48B84F444135CE2D57BE9EF3CE505C700

Function 00007FFDFB50DC50 Relevance: 33.7, APIs: 4, Strings: 15, Instructions: 499registrywindowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB5185AC: std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB5185C9
Part of subcall function 00007FFDFB5185AC: std::locale::_Setgloballocale.LIBCPMT ref: 00007FFDFB5185EC
Part of subcall function 00007FFDFB5185AC: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB518687

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB50E326
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB50E32C
SendMessageTimeoutW.USER32 ref: 00007FFDFB50E383
RegCloseKey.ADVAPI32 ref: 00007FFDFB50E40D

Strings

Right, xrefs: 00007FFDFB50E3CF
WindowRect, xrefs: 00007FFDFB50E413
2, xrefs: 00007FFDFB50E36F
Software\NVIDIA Corporation\Global\nView\WindowRect, xrefs: 00007FFDFB50E3A9
Displays:, xrefs: 00007FFDFB50DEF8
driver version , xrefs: 00007FFDFB50DE4E
os: $osTag, xrefs: 00007FFDFB50DE95
205.22, xrefs: 00007FFDFB50DE06
NVIDIA RTX Desktop Manager, xrefs: 00007FFDFB50DDE3
Left, xrefs: 00007FFDFB50E3BE
GPUs:, xrefs: 00007FFDFB50DEAE
Bottom, xrefs: 00007FFDFB50E3F6
Top, xrefs: 00007FFDFB50E3E2
Software\NVIDIA Corporation\Global\nView, xrefs: 00007FFDFB50E41A
version , xrefs: 00007FFDFB50DDF7

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Lockit_invalid_parameter_noinfo_noreturnstd::_$CloseLockit::_Lockit::~_MessageSendSetgloballocaleTimeoutstd::locale::_
String ID: GPUs:$ version $2$205.22$Bottom$Displays:$Left$NVIDIA RTX Desktop Manager$Right$Software\NVIDIA Corporation\Global\nView$Software\NVIDIA Corporation\Global\nView\WindowRect$Top$WindowRect$driver version $os: $osTag
API String ID: 3304796370-1363665941
Opcode ID: 0a10524fb1272b94fb291a584150af6e89b44a10d7abaca0b5ee1a8cb5dbf160
Instruction ID: ac6153b25a3062b40866a6c833e9715d2d8a63a1c3ff57e98ac0004f2765581e
Opcode Fuzzy Hash: 0a10524fb1272b94fb291a584150af6e89b44a10d7abaca0b5ee1a8cb5dbf160
Instruction Fuzzy Hash: 7B229F72B1AB8785EB018F64D4606A967A1FB84BD8F544136EA9D07BEEDF3CE040C700

Function 00007FFDFB5D1BC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

WTSGetActiveConsoleSessionId.KERNEL32 ref: 00007FFDFB5D1C22
RegGetValueW.ADVAPI32 ref: 00007FFDFB5D1C87
K32EnumProcesses.KERNEL32 ref: 00007FFDFB5D1CEB
OpenProcess.KERNEL32 ref: 00007FFDFB5D1D17
K32EnumProcessModules.KERNEL32 ref: 00007FFDFB5D1D3B
K32GetModuleBaseNameW.KERNEL32 ref: 00007FFDFB5D1D55
CloseHandle.KERNEL32 ref: 00007FFDFB5D1D7B
OpenProcessToken.ADVAPI32 ref: 00007FFDFB5D1D9D
DuplicateTokenEx.ADVAPI32 ref: 00007FFDFB5D1DC8
CloseHandle.KERNEL32 ref: 00007FFDFB5D1DD3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB5D1E43

Strings

Shell, xrefs: 00007FFDFB5D1C72
vector too long, xrefs: 00007FFDFB5D1BC4
Software\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00007FFDFB5D1C79

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Process$CloseEnumHandleOpenToken$ActiveBaseConsoleDuplicateModuleModulesNameProcessesSessionValue_invalid_parameter_noinfo_noreturn
String ID: Shell$Software\Microsoft\Windows NT\CurrentVersion\Winlogon$vector too long
API String ID: 1446407951-1940046086
Opcode ID: d41c97a93e5cd1837abc3fa556a7b24cdb74e75b0d1d46294a661ddf68452fbc
Instruction ID: d9f701ca182565a7facbb8c4d489129ce9dd0f19f6739d669af6624823290d5e
Opcode Fuzzy Hash: d41c97a93e5cd1837abc3fa556a7b24cdb74e75b0d1d46294a661ddf68452fbc
Instruction Fuzzy Hash: 3061B57271AB8385EB11DB25E854AAA6760EB887A0F540335DA7C43BEDDF3CD545C700

Function 00000001800368B0 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,000000018002F067), ref: 00000001800368C1
free.LIBCMT ref: 00000001800368DE

Part of subcall function 000000018002D5F4: HeapFree.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D60A
Part of subcall function 000000018002D5F4: _errno.LIBCMT ref: 000000018002D614
Part of subcall function 000000018002D5F4: GetLastError.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D61C

free.LIBCMT ref: 00000001800368F3
free.LIBCMT ref: 0000000180036914
free.LIBCMT ref: 0000000180036929
free.LIBCMT ref: 000000018003693D
free.LIBCMT ref: 0000000180036949
free.LIBCMT ref: 0000000180036974
EncodePointer.KERNEL32(?,?,?,000000018002F067), ref: 000000018003697C
free.LIBCMT ref: 0000000180036995
free.LIBCMT ref: 00000001800369AE
free.LIBCMT ref: 00000001800369DF

Strings

E"fY, xrefs: 00000001800368BA

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: free$Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID: E"fY
API String ID: 4099253644-93874851
Opcode ID: c236f47fa00f1eb095f464021b61fc5b1928e1c18c896dc44bc4746b0c097f4e
Instruction ID: e2653a9f16c68cd9db8ac6c19f3406fb9b710f8bb8de90df47967776b1696018
Opcode Fuzzy Hash: c236f47fa00f1eb095f464021b61fc5b1928e1c18c896dc44bc4746b0c097f4e
Instruction Fuzzy Hash: 6B314E31601A4C89FED7DB11E9613E563A0BB4D7D4F19C226BA190AAE5DFBCC68D8301

Function 00007FFDFB507BA0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FFDFB507C02
GetWindowLongPtrW.USER32 ref: 00007FFDFB507C10
GetAncestor.USER32 ref: 00007FFDFB507C21
GetParent.USER32 ref: 00007FFDFB507C35
GetClientRect.USER32 ref: 00007FFDFB507C5E
IsRectEmpty.USER32 ref: 00007FFDFB507C6C
GetWindowLongPtrW.USER32 ref: 00007FFDFB507C7E
GetClientRect.USER32 ref: 00007FFDFB507CA4
IsRectEmpty.USER32 ref: 00007FFDFB507CB2

Strings

hwnd(0x%08x) class(%s) rootOwner(%i) child(%i) pop(%i) vis(%i) cap(%i) thick(%i) max(%i) rect(%i) parent(vis(%i) rect(%i)), xrefs: 00007FFDFB507D52

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Rect$ClientEmptyLongWindow$AncestorClassNameParent
String ID: hwnd(0x%08x) class(%s) rootOwner(%i) child(%i) pop(%i) vis(%i) cap(%i) thick(%i) max(%i) rect(%i) parent(vis(%i) rect(%i))
API String ID: 1814797616-3427189458
Opcode ID: 74a99a62fac07763e797a5255ed2ad9a0e80ffb0614fd098865b18a1db196fb4
Instruction ID: 9b3cd75de28bc16f0f7032089fab91d2720cd28dce32806d56c76a539b34302c
Opcode Fuzzy Hash: 74a99a62fac07763e797a5255ed2ad9a0e80ffb0614fd098865b18a1db196fb4
Instruction Fuzzy Hash: 8141956271A7C686EB218F26F85079BB760FB88B94F484125DE9D43BA9DF3CD144CB04

Function 00007FFDFB5D1BE0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 105registryCOMMON

Download Yara Rule

APIs

WTSGetActiveConsoleSessionId.KERNEL32 ref: 00007FFDFB5D1C22
RegGetValueW.ADVAPI32 ref: 00007FFDFB5D1C87
K32EnumProcesses.KERNEL32 ref: 00007FFDFB5D1CEB
OpenProcess.KERNEL32 ref: 00007FFDFB5D1D17
K32EnumProcessModules.KERNEL32 ref: 00007FFDFB5D1D3B
K32GetModuleBaseNameW.KERNEL32 ref: 00007FFDFB5D1D55
CloseHandle.KERNEL32 ref: 00007FFDFB5D1D7B
OpenProcessToken.ADVAPI32 ref: 00007FFDFB5D1D9D
DuplicateTokenEx.ADVAPI32 ref: 00007FFDFB5D1DC8
CloseHandle.KERNEL32 ref: 00007FFDFB5D1DD3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB5D1E43

Strings

Shell, xrefs: 00007FFDFB5D1C72
Software\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00007FFDFB5D1C79

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Process$CloseEnumHandleOpenToken$ActiveBaseConsoleDuplicateModuleModulesNameProcessesSessionValue_invalid_parameter_noinfo_noreturn
String ID: Shell$Software\Microsoft\Windows NT\CurrentVersion\Winlogon
API String ID: 1446407951-2454539505
Opcode ID: 5bdaef2c39089f75fa48d7c9970810c087d07c4f83131bfedaa235a0de9c1b38
Instruction ID: 41038074cf623b2f4ce8acf3acd1582b7d49c63df1f90bdfeef66bde51b7f642
Opcode Fuzzy Hash: 5bdaef2c39089f75fa48d7c9970810c087d07c4f83131bfedaa235a0de9c1b38
Instruction Fuzzy Hash: B141B572719B8385EB11DF25E450AAA6360FB89790F540236EAAC43BEDDF3CD545CB40

Function 00000001800012F0 Relevance: 15.1, APIs: 10, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000132B

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000018000136C

Part of subcall function 000000018000775C: setlocale.LIBCMT ref: 0000000180007770
Part of subcall function 000000018000775C: setlocale.LIBCMT ref: 0000000180007799

_Getcvt.LIBCPMT ref: 0000000180001376

Part of subcall function 00000001800073D0: ___lc_codepage_func.LIBCMT ref: 00000001800073F4
Part of subcall function 00000001800073D0: ___mb_cur_max_func.LIBCMT ref: 00000001800073FB
Part of subcall function 00000001800073D0: ___lc_locale_name_func.LIBCMT ref: 0000000180007403

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 000000018000139E

Part of subcall function 00000001800077C8: setlocale.LIBCMT ref: 00000001800077E2

free.LIBCMT ref: 00000001800013AC

Part of subcall function 000000018002D5F4: HeapFree.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D60A
Part of subcall function 000000018002D5F4: _errno.LIBCMT ref: 000000018002D614
Part of subcall function 000000018002D5F4: GetLastError.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D61C

free.LIBCMT ref: 00000001800013BE
free.LIBCMT ref: 00000001800013D0
free.LIBCMT ref: 00000001800013E2
free.LIBCMT ref: 00000001800013F4
free.LIBCMT ref: 0000000180001406

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: free$setlocalestd::_$Locinfo::_$ErrorFreeGetcvtHeapLastLocinfo_ctorLocinfo_dtorLockitLockit::____lc_codepage_func___lc_locale_name_func___mb_cur_max_func_errno_lock
String ID:
API String ID: 3682056076-0
Opcode ID: ca3fb0b8572f38f04c8e7f887ed93a46820372b37fb06955fdddff351c3b93c0
Instruction ID: 0d852a346218120d3da4cb41429ba606f2c3b38bf25389faa73f1b0c9af31080
Opcode Fuzzy Hash: ca3fb0b8572f38f04c8e7f887ed93a46820372b37fb06955fdddff351c3b93c0
Instruction Fuzzy Hash: 87416B32B45B8889EB52DBB4D4503DC33B9AB687C8F05811AAA4927A9ADE70C659C340

Function 00007FFDFB58DABC Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB58DAFF
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB58DEEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FFDFB58E188

Strings

p, xrefs: 00007FFDFB58DC29
p, xrefs: 00007FFDFB58DBB1
:, xrefs: 00007FFDFB58DCB8
f, xrefs: 00007FFDFB58DC21
-, xrefs: 00007FFDFB58DB95

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: de602ac8ff022a4ff53410ae60c26684bfbecfd39bdf7640684e28d1363bd85f
Instruction ID: c98b2231a8135b74659868d65be428774842ad41713f097f4a1bc9f26df9b95b
Opcode Fuzzy Hash: de602ac8ff022a4ff53410ae60c26684bfbecfd39bdf7640684e28d1363bd85f
Instruction Fuzzy Hash: F812C372F0E95386FB625A14E064A7976A1FB40750FC4C539E6A9077EEDF3CE8848B00

Function 00007FFDFB4ED940 Relevance: 13.6, APIs: 9, Instructions: 88COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FFDFB4ED96E
EnterCriticalSection.KERNEL32 ref: 00007FFDFB4ED987
InitializeCriticalSection.KERNEL32 ref: 00007FFDFB4ED9DC
LeaveCriticalSection.KERNEL32 ref: 00007FFDFB4ED9F5
InitializeCriticalSection.KERNEL32 ref: 00007FFDFB4EDA34
LeaveCriticalSection.KERNEL32 ref: 00007FFDFB4EDA4D
FreeLibrary.KERNEL32 ref: 00007FFDFB4EDA6A
InitializeCriticalSection.KERNEL32 ref: 00007FFDFB4EDAC9
LeaveCriticalSection.KERNEL32 ref: 00007FFDFB4EDAE2

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: CriticalSection$Initialize$Leave$EnterFreeLibrary
String ID:
API String ID: 3518392267-0
Opcode ID: 23329b1970a4fbed670d33c2c2c16f4f298de89f17d4aed16765008b6f957f1c
Instruction ID: 3b33fb1fd534c229c74f296336eb2a92809c82ff1d474751541a0189f95e86af
Opcode Fuzzy Hash: 23329b1970a4fbed670d33c2c2c16f4f298de89f17d4aed16765008b6f957f1c
Instruction Fuzzy Hash: 0141A570F0EA43D6FBA19B50EA74B7827A0AF64314F840175C46D8A6FDDF6CAA49C640

Function 000000018000E7F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E819

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E83E
ctype.LIBCPMT ref: 000000018000E8C1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E8D8
_CxxThrowException.LIBCMT ref: 000000018000E8E9
std::_Facet_Register.LIBCPMT ref: 000000018000E907

Strings

bad cast, xrefs: 000000018000E8CC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3320480354-3145022300
Opcode ID: 1518c0a335d86cbaa4542f68ea49f77159dfa4c437a71da536b0f71a588ef4d3
Instruction ID: 903a1047ac448027b450ec25c1a64425b0a144e6aa285fcf7086c7a1e7952437
Opcode Fuzzy Hash: 1518c0a335d86cbaa4542f68ea49f77159dfa4c437a71da536b0f71a588ef4d3
Instruction Fuzzy Hash: 87313D31604A8881FA97DB15E4503D97761F799BE0F58C222FA6E176E9DF38C68AC700

Function 000000018000F048 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F069

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F08E
moneypunct.LIBCPMT ref: 000000018000F111
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F128
_CxxThrowException.LIBCMT ref: 000000018000F139
std::_Facet_Register.LIBCPMT ref: 000000018000F157

Strings

bad cast, xrefs: 000000018000F11C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 72116e41904cd7165d87d3b7b8d6bb6200793e546d858aed617fd641d52c83dc
Instruction ID: 703a4cad84fdcc045a2871730030fa27516cb42ee1b9283c4040bcabb6153e8b
Opcode Fuzzy Hash: 72116e41904cd7165d87d3b7b8d6bb6200793e546d858aed617fd641d52c83dc
Instruction Fuzzy Hash: 50312331604A4881EAA6DB15E4503E97760F798BE4F648322F66D17BE6DF38C68DD700

Function 000000018000F898 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F8B9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F8DE
messages.LIBCPMT ref: 000000018000F961
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F978
_CxxThrowException.LIBCMT ref: 000000018000F989
std::_Facet_Register.LIBCPMT ref: 000000018000F9A7

Strings

bad cast, xrefs: 000000018000F96C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 6d24588b9a7590b3b87b70300c70b3292790a8bd1c5b1071349b1aa35c1d1e7e
Instruction ID: ac250751d58bdd5496b533042141eb838cccab87bb5e4a6a326be43682a2c53b
Opcode Fuzzy Hash: 6d24588b9a7590b3b87b70300c70b3292790a8bd1c5b1071349b1aa35c1d1e7e
Instruction Fuzzy Hash: F5312E72604A4891EAA6DB15E4407E97760B79CBE0F148322FA6D13BA5DF28C68AD700

Function 00000001800080D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800080F1

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008116
messages.LIBCPMT ref: 0000000180008199
std::bad_exception::bad_exception.LIBCMT ref: 00000001800081B0
_CxxThrowException.LIBCMT ref: 00000001800081C1
std::_Facet_Register.LIBCPMT ref: 00000001800081DF

Strings

bad cast, xrefs: 00000001800081A4

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 0e8088bbc94c94de44c6ead9a77a8b98552ca770167b247603108ec63001514d
Instruction ID: 35d3f142cde19c3a048b0fcb9483086a618d1f742b40768914a1a8e34770720a
Opcode Fuzzy Hash: 0e8088bbc94c94de44c6ead9a77a8b98552ca770167b247603108ec63001514d
Instruction Fuzzy Hash: 2E314131604B4891FA93DB15E8503D973A5FB987E0F588321FAAD076E5DE38C68E9700

Function 0000000180023924 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023945

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018002396A
collate.LIBCPMT ref: 00000001800239ED
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023A04
_CxxThrowException.LIBCMT ref: 0000000180023A15
std::_Facet_Register.LIBCPMT ref: 0000000180023A33

Strings

bad cast, xrefs: 00000001800239F8

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3240839640-3145022300
Opcode ID: dd54ca0da77a0209b6aeec4e3b00398d8d0106adb950ddbf77bc546178640126
Instruction ID: c2a974b2d7a60a2b086a420e70802605e61706e16da007e4f81136d50c598c2d
Opcode Fuzzy Hash: dd54ca0da77a0209b6aeec4e3b00398d8d0106adb950ddbf77bc546178640126
Instruction Fuzzy Hash: 15316F72605A4C81FAD7DB15E4413D96361F79CBE0F548226FA9D076E5DE38CA8DC700

Function 000000018000E928 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E949

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E96E
messages.LIBCPMT ref: 000000018000E9F1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EA08
_CxxThrowException.LIBCMT ref: 000000018000EA19
std::_Facet_Register.LIBCPMT ref: 000000018000EA37

Strings

bad cast, xrefs: 000000018000E9FC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: c72775a103d99b6f837bcf2226a3accdb6696da6bb77df867dd2bc43998cf69d
Instruction ID: 32bc1acb226f066091d62a6c54883872f8d60ae5ef2b5e81e47e51f18fae378c
Opcode Fuzzy Hash: c72775a103d99b6f837bcf2226a3accdb6696da6bb77df867dd2bc43998cf69d
Instruction Fuzzy Hash: 62314F32604A8881FAD6DB15E4403D97761F79DBE0F148222F66D636E5DE38C78DC700

Function 000000018000F178 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F199

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F1BE
moneypunct.LIBCPMT ref: 000000018000F241
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F258
_CxxThrowException.LIBCMT ref: 000000018000F269
std::_Facet_Register.LIBCPMT ref: 000000018000F287

Strings

bad cast, xrefs: 000000018000F24C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: db4531463fb4ed7b9e84e20dd1357846afa3d7ca33d6adf5fa5f8d6b27529a5f
Instruction ID: b0aa7ca52775649b56220f307fd84676fe4e09e30895342a551203fcddcd03a4
Opcode Fuzzy Hash: db4531463fb4ed7b9e84e20dd1357846afa3d7ca33d6adf5fa5f8d6b27529a5f
Instruction Fuzzy Hash: 67313036604A4881EAA6DB15E4503E97760F79C7E0F548322FA6D03BE9DE38C68EC700

Function 000000018000F9C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F9E9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FA0E
numpunct.LIBCPMT ref: 000000018000FA91
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FAA8
_CxxThrowException.LIBCMT ref: 000000018000FAB9
std::_Facet_Register.LIBCPMT ref: 000000018000FAD7

Strings

bad cast, xrefs: 000000018000FA9C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4068408745-3145022300
Opcode ID: ee33bc0723efa5aa4c366d82e68c788871106819f50c989c870ed83f44bc0ef7
Instruction ID: 0ed4759d308908f78153d5154aa8bc73361bf9988d8352dbe00c3883d08f4416
Opcode Fuzzy Hash: ee33bc0723efa5aa4c366d82e68c788871106819f50c989c870ed83f44bc0ef7
Instruction Fuzzy Hash: 84315271704B4881EAA2DB15E4407E97760E79DBE4F148221FA6D17BE9DF38C68EC701

Function 0000000180008200 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008221

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008246
messages.LIBCPMT ref: 00000001800082C9
std::bad_exception::bad_exception.LIBCMT ref: 00000001800082E0
_CxxThrowException.LIBCMT ref: 00000001800082F1
std::_Facet_Register.LIBCPMT ref: 000000018000830F

Strings

bad cast, xrefs: 00000001800082D4

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 0d872b1ba248602230f18a3585586ef29a0b918caca146d4684eaa2802e5b407
Instruction ID: ba173e527248ad616717990ad57c3ea3ffa836c4fcce1a36eb2f310dd1d629a6
Opcode Fuzzy Hash: 0d872b1ba248602230f18a3585586ef29a0b918caca146d4684eaa2802e5b407
Instruction Fuzzy Hash: A5313E31605F4881EA92DB15E4443D977A1FB98BE0F548221FAAD176E9DF38C68ED700

Function 0000000180023A54 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023A75

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023A9A
messages.LIBCPMT ref: 0000000180023B1D
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023B34
_CxxThrowException.LIBCMT ref: 0000000180023B45
std::_Facet_Register.LIBCPMT ref: 0000000180023B63

Strings

bad cast, xrefs: 0000000180023B28

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 6042c083aaf9d19d0e0f3061719a0287c51729f22326b78e9f0788faf9e04fe2
Instruction ID: 8bbbb137a0339c4dc54c9029d106e5257286d05d285556903a5a2b1fb779c90b
Opcode Fuzzy Hash: 6042c083aaf9d19d0e0f3061719a0287c51729f22326b78e9f0788faf9e04fe2
Instruction Fuzzy Hash: 88316171604A4881EA97DB15E4513D96760F79CBE0F148322F76D136E5DF38C68DC700

Function 000000018000EA58 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EA79

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EA9E
messages.LIBCPMT ref: 000000018000EB21
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EB38
_CxxThrowException.LIBCMT ref: 000000018000EB49
std::_Facet_Register.LIBCPMT ref: 000000018000EB67

Strings

bad cast, xrefs: 000000018000EB2C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 32b660dc0e0ff8b2840d4f21ec67105e4c0f753b12f06fb9ea139e048b570729
Instruction ID: 0e6cdc202ab0faf405a73aae82ebcdbb06b13299b5b79274f84cc1b9637a6d3e
Opcode Fuzzy Hash: 32b660dc0e0ff8b2840d4f21ec67105e4c0f753b12f06fb9ea139e048b570729
Instruction Fuzzy Hash: 0C315071704B8881FA96DB15E4403DA7361F79DBE0F148222BA6E176E5DF38D68DC700

Function 000000018000F2A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2C9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F2EE
moneypunct.LIBCPMT ref: 000000018000F371
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F388
_CxxThrowException.LIBCMT ref: 000000018000F399
std::_Facet_Register.LIBCPMT ref: 000000018000F3B7

Strings

bad cast, xrefs: 000000018000F37C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 5c641469a2d30daa8160390feef35362dee9b3f3e43551c59d405e4c7c364bf2
Instruction ID: 85f0ddc1fb455183e8826907cb9b5ce322fb28c6acbd3a1f7897a95eead57acb
Opcode Fuzzy Hash: 5c641469a2d30daa8160390feef35362dee9b3f3e43551c59d405e4c7c364bf2
Instruction Fuzzy Hash: 89313032604A4882EAA6DB15E4503E97361E798BE0F548221FA6D437E5DF78C78E9700

Function 000000018000FAF8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB19

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FB3E
numpunct.LIBCPMT ref: 000000018000FBC1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FBD8
_CxxThrowException.LIBCMT ref: 000000018000FBE9
std::_Facet_Register.LIBCPMT ref: 000000018000FC07

Strings

bad cast, xrefs: 000000018000FBCC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4068408745-3145022300
Opcode ID: ae0ea46a9ee9c3e86daeac0d3234f15b2964b553704b4edd4ab6e31ed39ad8f6
Instruction ID: 29293d91807841274312c0898b4eab7eb0361c7ebc024cff1c6093db3a856592
Opcode Fuzzy Hash: ae0ea46a9ee9c3e86daeac0d3234f15b2964b553704b4edd4ab6e31ed39ad8f6
Instruction Fuzzy Hash: 7E313071604A4881FAA7DB15E4507E97361E79CBE0F148221FA6E137E9DF38C68ED700

Function 0000000180008330 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008351

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180008376
numpunct.LIBCPMT ref: 00000001800083F9
std::bad_exception::bad_exception.LIBCMT ref: 0000000180008410
_CxxThrowException.LIBCMT ref: 0000000180008421
std::_Facet_Register.LIBCPMT ref: 000000018000843F

Strings

bad cast, xrefs: 0000000180008404

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4068408745-3145022300
Opcode ID: c202a5770c39ab57ed84ceb3e68100b3a73b5e5cfc957b9efda8ad8bf9c3945a
Instruction ID: 93b7f2e2961d43802aa01675c6e34dc0c733fb271d42efec73ddf7d9136c2f33
Opcode Fuzzy Hash: c202a5770c39ab57ed84ceb3e68100b3a73b5e5cfc957b9efda8ad8bf9c3945a
Instruction Fuzzy Hash: F2314F31605A4881FA96DB15E4507DA77A1FB98BE0F148321FAAE036E5DE38C78ED700

Function 0000000180023B84 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023BA5

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023BCA
messages.LIBCPMT ref: 0000000180023C4D
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023C64
_CxxThrowException.LIBCMT ref: 0000000180023C75
std::_Facet_Register.LIBCPMT ref: 0000000180023C93

Strings

bad cast, xrefs: 0000000180023C58

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 7c5417a85a408d482a06928c82b709df55114473f0ba7bb4651cdaf59540ff60
Instruction ID: 75f7d5b72cde2ed98477708e3d1a4d82b3ea81c6c5906bfc7a9d9a34f9766923
Opcode Fuzzy Hash: 7c5417a85a408d482a06928c82b709df55114473f0ba7bb4651cdaf59540ff60
Instruction Fuzzy Hash: 0E315071604A4C81FAA7DB15E4513E96760F79CBE0F64C322BA5E176E5DE38C68EC700

Function 000000018000EB88 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EBA9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EBCE
messages.LIBCPMT ref: 000000018000EC51
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EC68
_CxxThrowException.LIBCMT ref: 000000018000EC79
std::_Facet_Register.LIBCPMT ref: 000000018000EC97

Strings

bad cast, xrefs: 000000018000EC5C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 51d939a1685a2bea652c7bde2fffae8489b2ff6d25f45c1629a8571a2a082665
Instruction ID: 011b7c4e06debffad8918965d35e9ac5ee19e89f5e81af284a0d200ba2a5a2d3
Opcode Fuzzy Hash: 51d939a1685a2bea652c7bde2fffae8489b2ff6d25f45c1629a8571a2a082665
Instruction Fuzzy Hash: 96316132604A8C81FA96DB15E4407D97761F799BE0F14C222FA6E236E5DF39C68EC700

Function 000000018000F3D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F3F9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F41E
moneypunct.LIBCPMT ref: 000000018000F4A1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F4B8
_CxxThrowException.LIBCMT ref: 000000018000F4C9
std::_Facet_Register.LIBCPMT ref: 000000018000F4E7

Strings

bad cast, xrefs: 000000018000F4AC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 13f34df5b8dca6365bf56936fc197be976fcfd57eef588af3eb235ac7314212c
Instruction ID: af194abc5343017d69ccae0d00c3f84e880894c87c78bc69f84cbf70def1933b
Opcode Fuzzy Hash: 13f34df5b8dca6365bf56936fc197be976fcfd57eef588af3eb235ac7314212c
Instruction Fuzzy Hash: 45314331604A4881EAA6DB15E4503EA7760F79CBE4F548222FA6D177E5DF38C68ED700

Function 000000018000E468 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E489

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E4AE
codecvt.LIBCPMT ref: 000000018000E531
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E548
_CxxThrowException.LIBCMT ref: 000000018000E559
std::_Facet_Register.LIBCPMT ref: 000000018000E577

Strings

bad cast, xrefs: 000000018000E53C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcodecvtstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 2666907392-3145022300
Opcode ID: c388285eeef8162b9337bba61029a55adadbbccc6a3321af76d71b019ff4cab9
Instruction ID: 9f8509df617fee80e8d8dfa9a623ec6440d9e8a68142cbaf352e872acf36d8d2
Opcode Fuzzy Hash: c388285eeef8162b9337bba61029a55adadbbccc6a3321af76d71b019ff4cab9
Instruction Fuzzy Hash: 18316131604E8881EA97DB15E8403D97761E79DBE4F548222FAAD136E5DE38C68DC700

Function 0000000180023CB4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023CD5

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023CFA
messages.LIBCPMT ref: 0000000180023D7D
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023D94
_CxxThrowException.LIBCMT ref: 0000000180023DA5
std::_Facet_Register.LIBCPMT ref: 0000000180023DC3

Strings

bad cast, xrefs: 0000000180023D88

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 480e9808ded4dd9ce93b9611af4d871cbfd108c73a0c2514d78019fd0e2b9d8d
Instruction ID: d9abbdc1c59c89ecb922db9c6cf2075237f80f35d562cec5bde8faddb7bf7778
Opcode Fuzzy Hash: 480e9808ded4dd9ce93b9611af4d871cbfd108c73a0c2514d78019fd0e2b9d8d
Instruction Fuzzy Hash: A5315271604A4881EAA3DB15F4413D96761F79CBE0F548322FA6D076E9DF38C68DC700

Function 000000018000ECB8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000ECD9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000ECFE
messages.LIBCPMT ref: 000000018000ED81
std::bad_exception::bad_exception.LIBCMT ref: 000000018000ED98
_CxxThrowException.LIBCMT ref: 000000018000EDA9
std::_Facet_Register.LIBCPMT ref: 000000018000EDC7

Strings

bad cast, xrefs: 000000018000ED8C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: cc7960cd80689731206c88487c0de69d9e60d2192e2557925d807d75d2f5c5e1
Instruction ID: 7e9a7ef3db8d0513497969ea559276415be1bfe1d386d7b59b03975b12a9fb17
Opcode Fuzzy Hash: cc7960cd80689731206c88487c0de69d9e60d2192e2557925d807d75d2f5c5e1
Instruction Fuzzy Hash: 7D316F32604A8882EA96DB15E8503D97761F798BE0F64C322FA6D176E5DF38C68DC700

Function 000000018000F508 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F529

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F54E
messages.LIBCPMT ref: 000000018000F5D1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F5E8
_CxxThrowException.LIBCMT ref: 000000018000F5F9
std::_Facet_Register.LIBCPMT ref: 000000018000F617

Strings

bad cast, xrefs: 000000018000F5DC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 3587b487d705abe092835c4f5a3cb7e3f979531b66054bbeb9aa7d553986a25e
Instruction ID: 6d09809d2825c675cc3354ec29be6d882d9351c6da2981936af5edb680e291e5
Opcode Fuzzy Hash: 3587b487d705abe092835c4f5a3cb7e3f979531b66054bbeb9aa7d553986a25e
Instruction Fuzzy Hash: 7A316132604B4881EAA6DB15E8403E97760F79CBE0F548222FA5D037E9DF39C68ED700

Function 000000018000E598 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E5B9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E5DE
collate.LIBCPMT ref: 000000018000E661
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E678
_CxxThrowException.LIBCMT ref: 000000018000E689
std::_Facet_Register.LIBCPMT ref: 000000018000E6A7

Strings

bad cast, xrefs: 000000018000E66C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3240839640-3145022300
Opcode ID: eda171fb9a849b4f616c3e08da64b58d4c66e3ddf2523fe25397e19311bc49a1
Instruction ID: 71537928979aec7902da3243a871980667c4c30672dd1b9dca4b0184ee6d3b67
Opcode Fuzzy Hash: eda171fb9a849b4f616c3e08da64b58d4c66e3ddf2523fe25397e19311bc49a1
Instruction Fuzzy Hash: 36313E72605A8881FA96DB15E4403D97361F7A9BE0F188222FA6D636E5DF39C68D8700

Function 0000000180023DE4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E05

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023E2A
moneypunct.LIBCPMT ref: 0000000180023EAD
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023EC4
_CxxThrowException.LIBCMT ref: 0000000180023ED5
std::_Facet_Register.LIBCPMT ref: 0000000180023EF3

Strings

bad cast, xrefs: 0000000180023EB8

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 6d32b28b6ca3663ff3abfb41e9471f4c917f2c1054da530c376a0520937a3486
Instruction ID: b60f097be7739bb6dc934a6eb27d4ad299f47afb1e08747a93c7bf12596e6123
Opcode Fuzzy Hash: 6d32b28b6ca3663ff3abfb41e9471f4c917f2c1054da530c376a0520937a3486
Instruction Fuzzy Hash: 7F316C72604A4981EE93DB19E4513D96760F79CBE0F158322BA6E076E5DF38CA8EC700

Function 000000018000EDE8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EE09

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EE2E
messages.LIBCPMT ref: 000000018000EEB1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EEC8
_CxxThrowException.LIBCMT ref: 000000018000EED9
std::_Facet_Register.LIBCPMT ref: 000000018000EEF7

Strings

bad cast, xrefs: 000000018000EEBC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 9a938acf533d3934332a6247e24f5e54ece76f8414f260b4929eae246823290b
Instruction ID: 114c17726efd3ac1399dd98c0993eddc8de426ae5a52da213f0347ec5244437b
Opcode Fuzzy Hash: 9a938acf533d3934332a6247e24f5e54ece76f8414f260b4929eae246823290b
Instruction Fuzzy Hash: 55314132604B8C81EA96DB15E8403D97761F79DBE0F14C222F66D236E6DE38CA8DC700

Function 000000018000F638 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F659

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F67E
messages.LIBCPMT ref: 000000018000F701
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F718
_CxxThrowException.LIBCMT ref: 000000018000F729
std::_Facet_Register.LIBCPMT ref: 000000018000F747

Strings

bad cast, xrefs: 000000018000F70C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 96317be4258d393e0a29fd177015503871ef1b8472f330f26a4596696f7ded08
Instruction ID: d5a0afbf97bf32ff6c3350b5f01d45652f3842558bd94ec47325ba3e195b39a4
Opcode Fuzzy Hash: 96317be4258d393e0a29fd177015503871ef1b8472f330f26a4596696f7ded08
Instruction Fuzzy Hash: E0314132604A4C91EAA7DB15E4503E97760F7987E0F148222F6AD13BE9DF39C68DC700

Function 0000000180007E70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180007E91

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180007EB6
messages.LIBCPMT ref: 0000000180007F39
std::bad_exception::bad_exception.LIBCMT ref: 0000000180007F50
_CxxThrowException.LIBCMT ref: 0000000180007F61
std::_Facet_Register.LIBCPMT ref: 0000000180007F7F

Strings

bad cast, xrefs: 0000000180007F44

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: e5bc7bed0252b8b1eac2afdacdede538a10b35561d0a981faa6039916fcc0b90
Instruction ID: fcae424b2c24524ac6a2dc0f7b7d658d6964671266eecf1fc0c25137e3d741c2
Opcode Fuzzy Hash: e5bc7bed0252b8b1eac2afdacdede538a10b35561d0a981faa6039916fcc0b90
Instruction Fuzzy Hash: 77313E31704B4981EA93DB15E4407E97361E7AC7E0F18C321FA6D176E6DE38CA8E8700

Function 000000018000E6C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E6E9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000E70E
collate.LIBCPMT ref: 000000018000E791
std::bad_exception::bad_exception.LIBCMT ref: 000000018000E7A8
_CxxThrowException.LIBCMT ref: 000000018000E7B9
std::_Facet_Register.LIBCPMT ref: 000000018000E7D7

Strings

bad cast, xrefs: 000000018000E79C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockcollatestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3240839640-3145022300
Opcode ID: 82d6dfd595e0919862318aaa4c0101f1d4fe4afb7754d539f957bde6888f6d2a
Instruction ID: f8ae8055f2c2bb27548f621051a3e9b0c7ecbe39d78b1a5e4a20972fbb614263
Opcode Fuzzy Hash: 82d6dfd595e0919862318aaa4c0101f1d4fe4afb7754d539f957bde6888f6d2a
Instruction Fuzzy Hash: 14313272608A8881FA96DB25E8403D97761F79DBE0F548322F66D176E5DF38C68EC700

Function 0000000180023F14 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023F35

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180023F5A
moneypunct.LIBCPMT ref: 0000000180023FDD
std::bad_exception::bad_exception.LIBCMT ref: 0000000180023FF4
_CxxThrowException.LIBCMT ref: 0000000180024005
std::_Facet_Register.LIBCPMT ref: 0000000180024023

Strings

bad cast, xrefs: 0000000180023FE8

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmoneypunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3809448442-3145022300
Opcode ID: 468e8583f91d548cbd29b93b68de9fe69da34fbf07c94fac8ff66319a34d3499
Instruction ID: 86d7a962d46641e92d15d66fca1501ef3728ada81f482cdfd9b3151a9865967a
Opcode Fuzzy Hash: 468e8583f91d548cbd29b93b68de9fe69da34fbf07c94fac8ff66319a34d3499
Instruction Fuzzy Hash: 7F316F72A04A4C81FAD7DB15E5413D96361F79CBE0F148222FA5D076E5DE38C68DC700

Function 000000018000EF18 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EF39

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000EF5E
messages.LIBCPMT ref: 000000018000EFE1
std::bad_exception::bad_exception.LIBCMT ref: 000000018000EFF8
_CxxThrowException.LIBCMT ref: 000000018000F009
std::_Facet_Register.LIBCPMT ref: 000000018000F027

Strings

bad cast, xrefs: 000000018000EFEC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: a97d4a0103f654b4b20c800e4f62322db3453708dd72828d55e479ce89410c5e
Instruction ID: f3f19d9c217fac931ce927225a4939fad5f6d9221ff3f3f816bb9e389d9f9663
Opcode Fuzzy Hash: a97d4a0103f654b4b20c800e4f62322db3453708dd72828d55e479ce89410c5e
Instruction Fuzzy Hash: 7C316171604B4D81FA96DB15E4403E97761E79CBE0F64C222BA6E177E6DE38CA8DC700

Function 000000018000F768 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F789

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000F7AE
messages.LIBCPMT ref: 000000018000F831
std::bad_exception::bad_exception.LIBCMT ref: 000000018000F848
_CxxThrowException.LIBCMT ref: 000000018000F859
std::_Facet_Register.LIBCPMT ref: 000000018000F877

Strings

bad cast, xrefs: 000000018000F83C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 8e5fefe93561a59ad46ce85a37caf660d85c16939c4905db0fbb578ad49114bb
Instruction ID: 96f0fb2c830b6a1955649fbd0b773edd4971c9b10982643f56ec6eb2397e4fe1
Opcode Fuzzy Hash: 8e5fefe93561a59ad46ce85a37caf660d85c16939c4905db0fbb578ad49114bb
Instruction Fuzzy Hash: A5313F32604B4881EAA6DB15E4403E97760F798BE4F64C322BA5D037E9DF38C68ED700

Function 0000000180007FA0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180007FC1

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180007FE6
ctype.LIBCPMT ref: 0000000180008069
std::bad_exception::bad_exception.LIBCMT ref: 0000000180008080
_CxxThrowException.LIBCMT ref: 0000000180008091
std::_Facet_Register.LIBCPMT ref: 00000001800080AF

Strings

bad cast, xrefs: 0000000180008074

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3320480354-3145022300
Opcode ID: 917c673cf237d7768db5174921dcc6ae41103a5902e4674f2ebf9e3ddd9a3165
Instruction ID: 2949d1dbb2558bb8b0e553727a052f62747b73423eec58154c0806c570db14de
Opcode Fuzzy Hash: 917c673cf237d7768db5174921dcc6ae41103a5902e4674f2ebf9e3ddd9a3165
Instruction Fuzzy Hash: 70311D31604A4C81EA97DB15E8513D977A1FB98BE0F148322FAAD076E5DF39C68E9700

Function 0000000180006940 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006961

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006986
std::bad_exception::bad_exception.LIBCMT ref: 0000000180006A21
_CxxThrowException.LIBCMT ref: 0000000180006A32
std::_Facet_Register.LIBCPMT ref: 0000000180006A50

Strings

bad cast, xrefs: 0000000180006A15
ios_base::badbit set, xrefs: 0000000180006940

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast$ios_base::badbit set
API String ID: 1776536810-182444483
Opcode ID: 1f1de01e030e88115448670c1250ec0f749da08e23ff95ccc15e6e7bba8c242b
Instruction ID: 3155b743d34470ed5679d7b64c3638ca01dfa7372a6c5b669332cd991d85d7a9
Opcode Fuzzy Hash: 1f1de01e030e88115448670c1250ec0f749da08e23ff95ccc15e6e7bba8c242b
Instruction Fuzzy Hash: FD315D35600B4881EA97DB15E5403D97361E798BE0F58D222FA6E177F9DE38C68EC701

Function 00007FFDFB50B940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB507150: GetCurrentProcess.KERNEL32 ref: 00007FFDFB507192
Part of subcall function 00007FFDFB507150: IsWow64Process.KERNEL32 ref: 00007FFDFB5071A0
Part of subcall function 00007FFDFB507150: RegOpenKeyExW.ADVAPI32 ref: 00007FFDFB50720B
Part of subcall function 00007FFDFB507150: RegQueryValueExW.ADVAPI32 ref: 00007FFDFB50723E
Part of subcall function 00007FFDFB507150: RegCloseKey.ADVAPI32 ref: 00007FFDFB507251

CreateProcessW.KERNEL32 ref: 00007FFDFB50BA56
WaitForSingleObject.KERNEL32 ref: 00007FFDFB50BA6A
CloseHandle.KERNEL32 ref: 00007FFDFB50BA75
CloseHandle.KERNEL32 ref: 00007FFDFB50BA80

Strings

nViewMain64.exe, xrefs: 00007FFDFB50B99A
%s\%s %s, xrefs: 00007FFDFB50B9B3
h, xrefs: 00007FFDFB50B9CF

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: CloseProcess$Handle$CreateCurrentObjectOpenQuerySingleValueWaitWow64
String ID: %s\%s %s$h$nViewMain64.exe
API String ID: 563726375-2808350667
Opcode ID: 454a5909347dd663a7aff94882edc13ab49f069e81745075fcd0f01081e62d5a
Instruction ID: 35ba8089f51cfcbf7a2d3a5077a4072eb7a20a01c05f777cad34c6391ff58fa9
Opcode Fuzzy Hash: 454a5909347dd663a7aff94882edc13ab49f069e81745075fcd0f01081e62d5a
Instruction Fuzzy Hash: 57315423A19BC282E761CB20E8517ABB3A1FBD9344F445235D6DD42BAADF7CD155CB00

Function 000000018003BAE0 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 000000018003BB09

Part of subcall function 0000000180031B68: malloc.LIBCMT ref: 0000000180031B93
Part of subcall function 0000000180031B68: Sleep.KERNEL32(?,?,00000000,00000001800302E4,?,?,00000000,00000001800301E3,?,?,00000000,0000000180038B02,?,?,00000000,0000000180038A6E), ref: 0000000180031BA6

free.LIBCMT ref: 000000018003BC0A
free.LIBCMT ref: 000000018003BC26

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: 3fbd0b3e35addabc098f64ab091990d7b6a2871f8ac9e4cce4e35d3e8861d74a
Instruction ID: fc16e1660138297f9bb3e8678e6c16cd315b57137c63fc5872edf9e7c8194a9d
Opcode Fuzzy Hash: 3fbd0b3e35addabc098f64ab091990d7b6a2871f8ac9e4cce4e35d3e8861d74a
Instruction Fuzzy Hash: 30619F32301B4892EBA3DB16E94139A73A0F78CBD8F058125AF4D47B51DF78C66AC740

Function 0000000180005730 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0000000180005A4B
_CxxThrowException.LIBCMT ref: 0000000180005A66
std::exception::exception.LIBCMT ref: 0000000180005AC9
_CxxThrowException.LIBCMT ref: 0000000180005AE4

Part of subcall function 0000000180006440: std::_Xbad_alloc.LIBCPMT ref: 00000001800064CD

Strings

bad conversion, xrefs: 0000000180005A36, 0000000180005AB4
string too long, xrefs: 00000001800059B0, 00000001800059BD, 00000001800059D4, 00000001800059E1

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrowstd::exception::exception$Xbad_allocstd::_
String ID: bad conversion$string too long
API String ID: 1519488521-500853860
Opcode ID: bf6df7041d4449f49d10bdcf2d7bbb40e5c4d876ee2b76c3840bffa6f91f8fdb
Instruction ID: fad14312ad47d1d51249c0a7a389eb41bb91f270e5ec6e02dd255712d111446d
Opcode Fuzzy Hash: bf6df7041d4449f49d10bdcf2d7bbb40e5c4d876ee2b76c3840bffa6f91f8fdb
Instruction Fuzzy Hash: D4D17B32704B88C9FB42CBA4E4503ED37B5F7497A8F948626EAA917AD5DF34C649C340

Function 0000000180044B68 Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180044B93
_errno.LIBCMT ref: 0000000180044B88

Part of subcall function 000000018002F2DC: _getptd_noexit.LIBCMT ref: 000000018002F2E0

_errno.LIBCMT ref: 0000000180044C36
_invalid_parameter_noinfo.LIBCMT ref: 0000000180044C41

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 7b47a042eea3f3de49294c888d2e7f7195dfd9dc128bccc2e4caf73cebc8c57f
Instruction ID: f2ef72c2d081a62da6ba206108f7190fcdc76fe894ca0d405d2fc84784ff5a10
Opcode Fuzzy Hash: 7b47a042eea3f3de49294c888d2e7f7195dfd9dc128bccc2e4caf73cebc8c57f
Instruction Fuzzy Hash: 50411677A01A9D81EBE69B1191C03F972A0F7487DDF9AC116FA845B6C4DF38C7498308

Function 000000018003E554 Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018003E57A
_errno.LIBCMT ref: 000000018003E56F

Part of subcall function 000000018002F2DC: _getptd_noexit.LIBCMT ref: 000000018002F2E0

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000000018003E5F9
_errno.LIBCMT ref: 000000018003E60A
_invalid_parameter_noinfo.LIBCMT ref: 000000018003E615

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 1996f2f9ceac77ac49b72366ba56ab82fbc49c57b1b3130c14664040d3ec86e6
Instruction ID: 8ce04cb9124dd54c6d4ddcc2c6da84841e497bcc28cebf8c8d46b4611f73f4df
Opcode Fuzzy Hash: 1996f2f9ceac77ac49b72366ba56ab82fbc49c57b1b3130c14664040d3ec86e6
Instruction Fuzzy Hash: 28415B72A106E881EBE3AB1180513FE33E0E359BE4F96C225B794076C5EF28CB59C700

Function 0000000180024044 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180024065

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018002408A
std::bad_exception::bad_exception.LIBCMT ref: 0000000180024124
_CxxThrowException.LIBCMT ref: 0000000180024135
std::_Facet_Register.LIBCPMT ref: 0000000180024153

Strings

bad cast, xrefs: 0000000180024118

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: ab939dc476349fa0fdaab308a684cfe4368de580aaf06aec8b938b68da6e425a
Instruction ID: e37e8b3caca8d6a150532a67f206124a5a8e0b77ae31ba5b87879bce6c6f3b3a
Opcode Fuzzy Hash: ab939dc476349fa0fdaab308a684cfe4368de580aaf06aec8b938b68da6e425a
Instruction Fuzzy Hash: E5314172604A4981EA97DB15E4907D97760E79CBE0F548222BA6D0B7E9DE38C6CDC700

Function 0000000180024174 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000180024195

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800241BA
std::bad_exception::bad_exception.LIBCMT ref: 0000000180024254
_CxxThrowException.LIBCMT ref: 0000000180024265
std::_Facet_Register.LIBCPMT ref: 0000000180024283

Strings

bad cast, xrefs: 0000000180024248

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 10cc8910cc85584bd4a3460428c8224b28d9867b334426348c47967f8e79c69e
Instruction ID: 5280669f5cee9c1c10b6307b5616e8497b2b20f45e6c0148fb90ff969be6db11
Opcode Fuzzy Hash: 10cc8910cc85584bd4a3460428c8224b28d9867b334426348c47967f8e79c69e
Instruction Fuzzy Hash: AD315432604A4881EA97DB15E4403D96761F7987E0F549322FA5E576E5DF38CA8DC700

Function 000000018000FC28 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FC49

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FC6E
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FD08
_CxxThrowException.LIBCMT ref: 000000018000FD19
std::_Facet_Register.LIBCPMT ref: 000000018000FD37

Strings

bad cast, xrefs: 000000018000FCFC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 62fdf57a96092745c62a34c7ea652cdc8cbd8a8d616748e806eab291326f5f4d
Instruction ID: 651fb656c3f290362de763b1ee359234d87ce794770dba1f6b2753c03b7c62f2
Opcode Fuzzy Hash: 62fdf57a96092745c62a34c7ea652cdc8cbd8a8d616748e806eab291326f5f4d
Instruction Fuzzy Hash: 3F315232604A4D81FAA6DB15E5417E97361F7987E0F148222BA6D077E5DF38CA8EC700

Function 000000018000FD58 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FD79

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FD9E
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FE38
_CxxThrowException.LIBCMT ref: 000000018000FE49
std::_Facet_Register.LIBCPMT ref: 000000018000FE67

Strings

bad cast, xrefs: 000000018000FE2C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: e9c222ff3a7390eeb7995fd0964985c14573391c4c93fb8924965464058be729
Instruction ID: 6ee744d50b30d82c78f3f63e2e17a70b14ef85af489d316716f56745e473c8ac
Opcode Fuzzy Hash: e9c222ff3a7390eeb7995fd0964985c14573391c4c93fb8924965464058be729
Instruction Fuzzy Hash: 50315232604A4C85EAA2DB15E8403E97761F79CBE0F548222F65D077E6DF38C68DC700

Function 000000018000FE88 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FEA9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FECE
std::bad_exception::bad_exception.LIBCMT ref: 000000018000FF68
_CxxThrowException.LIBCMT ref: 000000018000FF79
std::_Facet_Register.LIBCPMT ref: 000000018000FF97

Strings

bad cast, xrefs: 000000018000FF5C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 7ebc46492d4dac5414eace0dc4bc23cdeb242ea3acaa4deefd90ef76b8116496
Instruction ID: ec51a6cea0b166713f805a236551c1283cd08e0c28255429b56f9ce5f8cbadc2
Opcode Fuzzy Hash: 7ebc46492d4dac5414eace0dc4bc23cdeb242ea3acaa4deefd90ef76b8116496
Instruction Fuzzy Hash: 76316132604B4981EAA6DB15E4407E97760F799BE4F648231F66D077E5DE38C78EC700

Function 000000018000FFB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FFD9

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 000000018000FFFE
std::bad_exception::bad_exception.LIBCMT ref: 0000000180010098
_CxxThrowException.LIBCMT ref: 00000001800100A9
std::_Facet_Register.LIBCPMT ref: 00000001800100C7

Strings

bad cast, xrefs: 000000018001008C

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 9261657b17084aba6423a854777eb8a9a4c09b6e3969408025c508acd221764b
Instruction ID: ba7f2a953198e62413a15f720fea67b0a98ff4fd57fa2979048f6802ea0a1aa0
Opcode Fuzzy Hash: 9261657b17084aba6423a854777eb8a9a4c09b6e3969408025c508acd221764b
Instruction Fuzzy Hash: 0D313031604E4882FB97DB15E8403D96361F79CBE0F288322B69D176E5DE79DA8EC700

Function 0000000180007180 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800071A1

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800071C6
std::bad_exception::bad_exception.LIBCMT ref: 0000000180007261
_CxxThrowException.LIBCMT ref: 0000000180007272
std::_Facet_Register.LIBCPMT ref: 0000000180007290

Strings

bad cast, xrefs: 0000000180007255

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 0ac0953fd19857d648c264f06a73748a9098f24d820f7a16771c37c3a699e4c5
Instruction ID: 5c309b77fee12f51d110db927d2fe456d8342975b36495e84ceae0cc68268f47
Opcode Fuzzy Hash: 0ac0953fd19857d648c264f06a73748a9098f24d820f7a16771c37c3a699e4c5
Instruction Fuzzy Hash: 33315031700A4881FA96DB15E4407D97761E7A8BE0F58C321FA6D036E6DE38C68EC740

Function 000000018004772C Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180047760

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_errno.LIBCMT ref: 000000018004777B
_invalid_parameter_noinfo.LIBCMT ref: 0000000180047786

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: ec2a6dd435b50d5e993b3328a406cbf0fc12b9938289ae1a38fd3c4af6446b14
Instruction ID: 4b6da2c887b896db48c8bf2af78125f2489fc4292198535c1cc227c838a58a5b
Opcode Fuzzy Hash: ec2a6dd435b50d5e993b3328a406cbf0fc12b9938289ae1a38fd3c4af6446b14
Instruction Fuzzy Hash: 2B31CC72704B888AE6A39B5190847EDB7A4F348BE4F668125FE5803B96CF74CA49C704

Function 00000001800023F0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 0000000180002442
_CxxThrowException.LIBCMT ref: 000000018000247E
_CxxThrowException.LIBCMT ref: 00000001800024A6
_CxxThrowException.LIBCMT ref: 00000001800024CE

Strings

ios_base::failbit set, xrefs: 0000000180002484
ios_base::badbit set, xrefs: 000000018000244F
ios_base::eofbit set, xrefs: 00000001800024AC

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: c4755da1f0456530d0fa2dca688d121101a445544884d577615891b101f1b86f
Instruction ID: a05f63984e831ba9eb21b9b46173f67e56e275c27f518e2d554fe2b11f73e329
Opcode Fuzzy Hash: c4755da1f0456530d0fa2dca688d121101a445544884d577615891b101f1b86f
Instruction Fuzzy Hash: 80215E71A11B5D99FB92DB64E8813EC3374B718388F908126F94922A69EF35C74EC340

Function 00007FFDFB50DA00 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDFB50D460: CreateMutexW.KERNEL32 ref: 00007FFDFB50D49A
Part of subcall function 00007FFDFB50D460: GetLastError.KERNEL32 ref: 00007FFDFB50D4A8
Part of subcall function 00007FFDFB50D460: WaitForSingleObject.KERNEL32 ref: 00007FFDFB50D4BD

Part of subcall function 00007FFDFB505ED0: RegOpenCurrentUser.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB4EEA7C), ref: 00007FFDFB505F11
Part of subcall function 00007FFDFB505ED0: RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB4EEA7C), ref: 00007FFDFB505F45
Part of subcall function 00007FFDFB505ED0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFDFB4EEA7C), ref: 00007FFDFB505F52

RegCloseKey.ADVAPI32 ref: 00007FFDFB50DA6A
RegCloseKey.ADVAPI32 ref: 00007FFDFB50DABD

Part of subcall function 00007FFDFB506490: RegSetValueExW.ADVAPI32 ref: 00007FFDFB5064B4

Strings

nViewNextLoaded, xrefs: 00007FFDFB50DA59
Software\NVIDIA Corporation\Global\nView, xrefs: 00007FFDFB50DA40
nViewAutoRun, xrefs: 00007FFDFB50DAAC
Software\NVIDIA Corporation\Global\nViewInstalled, xrefs: 00007FFDFB50DA8C

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Close$Create$CurrentErrorLastMutexObjectOpenSingleUserValueWait
String ID: Software\NVIDIA Corporation\Global\nView$Software\NVIDIA Corporation\Global\nViewInstalled$nViewAutoRun$nViewNextLoaded
API String ID: 1572674430-972942980
Opcode ID: 2b53140f13742c1fceefd5b7d1b197221aff8bbbbadfeb63a278f3f936b43a1b
Instruction ID: 4d5b2abb71fdb52bf170fdf19310236c52991e9cf2fe03a3d4a6bd709bc5b117
Opcode Fuzzy Hash: 2b53140f13742c1fceefd5b7d1b197221aff8bbbbadfeb63a278f3f936b43a1b
Instruction Fuzzy Hash: 63111C31B1A64781EB129B11E860B7A6760FB84788F484131DAAD47BFEDF6DE909C740

Function 0000000180001180 Relevance: 10.5, APIs: 7, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 000000018000118D

Part of subcall function 00000001800077C8: setlocale.LIBCMT ref: 00000001800077E2

free.LIBCMT ref: 000000018000119B

Part of subcall function 000000018002D5F4: HeapFree.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D60A
Part of subcall function 000000018002D5F4: _errno.LIBCMT ref: 000000018002D614
Part of subcall function 000000018002D5F4: GetLastError.KERNEL32(?,?,00000000,0000000180038A82,?,?,00000000,000000018002F2E5,?,?,?,?,000000018002DB16,?,?,00000000), ref: 000000018002D61C

free.LIBCMT ref: 00000001800011AF
free.LIBCMT ref: 00000001800011C1
free.LIBCMT ref: 00000001800011D3
free.LIBCMT ref: 00000001800011E5
free.LIBCMT ref: 00000001800011F7

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_errnosetlocalestd::_
String ID:
API String ID: 1855319098-0
Opcode ID: 2f9469f7e86d9ed662453ed7390a40d8cb98c28b94d45fdd9a0046f49d435607
Instruction ID: b48272a0fe48caf80c68cbfff6fe37b1983f1ac57bfd09bfec3c9c3905106cea
Opcode Fuzzy Hash: 2f9469f7e86d9ed662453ed7390a40d8cb98c28b94d45fdd9a0046f49d435607
Instruction Fuzzy Hash: 85010831202A9888EF9FDF65D5917EC73A4EF59FC8F188116BA4906A86CE64CD94C740

Function 00000001800312AC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000001800312CD
_getptd.LIBCMT ref: 00000001800312DB
_getptd.LIBCMT ref: 00000001800312ED

Strings

MOC, xrefs: 00000001800312BB
RCC, xrefs: 00000001800312B3
csm, xrefs: 00000001800312C3

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 79c6bdfdf6facc246eee842b2de7a644aa034f1ac0e2309a20206dc5bd345c8d
Instruction ID: cee1693f68b0781dadb7962070319637af549046bf3e62ebc375f9a8a227fa41
Opcode Fuzzy Hash: 79c6bdfdf6facc246eee842b2de7a644aa034f1ac0e2309a20206dc5bd345c8d
Instruction Fuzzy Hash: 6DF0303550814CCAE6DB2B5484053FF2790EB9DB87F8BC1A2A30082382CFBC47989B57

Function 0000000180006DB0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 263COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00000001800070C2
_CxxThrowException.LIBCMT ref: 00000001800070FB
_CxxThrowException.LIBCMT ref: 0000000180007133

Part of subcall function 0000000180006940: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006961
Part of subcall function 0000000180006940: std::_Lockit::_Lockit.LIBCPMT ref: 0000000180006986

Strings

ios_base::failbit set, xrefs: 00000001800070D2
ios_base::badbit set, xrefs: 0000000180007094
ios_base::eofbit set, xrefs: 0000000180007101

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow$LockitLockit::_std::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1691487403-1866435925
Opcode ID: 0db30ec67b73ccdcabdd15c275040f157008ca9554cbf0563cdfb27b905dc0a0
Instruction ID: 767f78a192eeebaa216b8aed547a68a7fb289aba9e2ffc4a09429269e94dafed
Opcode Fuzzy Hash: 0db30ec67b73ccdcabdd15c275040f157008ca9554cbf0563cdfb27b905dc0a0
Instruction Fuzzy Hash: 22C17372600B49C5EBA6CF19E0903A9B7A1F788BD4F50C522EB4D437A5DF7AC64AC740

Function 0000000180006A80 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 210COMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 0000000180006CF2
_CxxThrowException.LIBCMT ref: 0000000180006D2B
_CxxThrowException.LIBCMT ref: 0000000180006D63

Strings

ios_base::failbit set, xrefs: 0000000180006D02
ios_base::badbit set, xrefs: 0000000180006CC4
ios_base::eofbit set, xrefs: 0000000180006D31

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 8d1da8b0088b82ce8472ecfb309f3f6d6294f4c20df7e85d44d77dd3078eb974
Instruction ID: a8b4bdf90a1f4ad9093596da8dc1c2238f82fb5394a2230a05445288838e8596
Opcode Fuzzy Hash: 8d1da8b0088b82ce8472ecfb309f3f6d6294f4c20df7e85d44d77dd3078eb974
Instruction Fuzzy Hash: B2A15672605B4885EBA6CF19D0903AD77A1F788BC4F50C512EA8E437B5DF3AC68AC700

Function 00007FFDFB4FD8B0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB4FD8C6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FFDFB4FD8EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB4FD915
std::_Facet_Register.LIBCPMT ref: 00007FFDFB4FD984
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FFDFB4FD99E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB4FD9B3

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 37271f0760c40865950aeb79783db2491e3a86690c86196550daa4963bca67e8
Instruction ID: 2c874dc7b171e7337f0bcb1188684047adad128c304e989030157359734c8ccf
Opcode Fuzzy Hash: 37271f0760c40865950aeb79783db2491e3a86690c86196550daa4963bca67e8
Instruction Fuzzy Hash: 81318022B0AA8391EB169F55D560AB96760FF44B94F081531DB6D0B7FEDF2CE4418340

Function 000000018000702A Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00000001800070C2
_CxxThrowException.LIBCMT ref: 00000001800070FB
_CxxThrowException.LIBCMT ref: 0000000180007133

Strings

ios_base::failbit set, xrefs: 00000001800070D2
ios_base::badbit set, xrefs: 0000000180007094
ios_base::eofbit set, xrefs: 0000000180007101

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 13b14e47e50a117b45a7778c449b81f96b46451b12d824cac215d1e20a6c26ef
Instruction ID: 749b6e3399a9a358d8b44ea8bf4972b4671ad478281f1e69b97e26da144d3d08
Opcode Fuzzy Hash: 13b14e47e50a117b45a7778c449b81f96b46451b12d824cac215d1e20a6c26ef
Instruction Fuzzy Hash: DF316472604A4891EAA2DB08E4913D973A0F79C7C4F508522F68D53AA6DF3DC74EC740

Function 0000000180006C5A Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 0000000180006CF2
_CxxThrowException.LIBCMT ref: 0000000180006D2B
_CxxThrowException.LIBCMT ref: 0000000180006D63

Strings

ios_base::failbit set, xrefs: 0000000180006D02
ios_base::badbit set, xrefs: 0000000180006CC4
ios_base::eofbit set, xrefs: 0000000180006D31

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 9c7b1aa60feacb23789e46315638fef29d19575f7816bd3068f614c3fe862f5d
Instruction ID: c8b34f633450288d0747754450d333132d257ba904ae0c0c3cccce57b6605a3c
Opcode Fuzzy Hash: 9c7b1aa60feacb23789e46315638fef29d19575f7816bd3068f614c3fe862f5d
Instruction Fuzzy Hash: EE316172615B8891EAA2CB14E4913D973A1F78C7C4F908522FA8D53B65DF39C74EC740

Function 0000000180003E60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

fgetwc.LIBCMT ref: 0000000180003F1F

Strings

string too long, xrefs: 00000001800040FE, 000000018000410B

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: fgetwc
String ID: string too long
API String ID: 2948136663-2556327735
Opcode ID: 2c54e6a053e8696a3d6b4ce687133d9b1274fd72c1f8f27c02397be768dd15f8
Instruction ID: e9e8eae9dbfed57877077c82a3db96da082da43fa004c8d24fdad90a2db03b72
Opcode Fuzzy Hash: 2c54e6a053e8696a3d6b4ce687133d9b1274fd72c1f8f27c02397be768dd15f8
Instruction Fuzzy Hash: 00912873700A89D9EB62CF25C4903EC33A5F758798F918622EB1D47A99DF35CA68C314

Function 0000000180034034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180034066

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 00000001800340B1
_invoke_watson.LIBCMT ref: 0000000180034199

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 00000001800341AE

Strings

:, xrefs: 00000001800340CF

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID: :
API String ID: 1584724053-336475711
Opcode ID: 604a302fabdb042f4ebc9b27cedb385bdeaebfe8a2c90ea295b00d5b5a1e0000
Instruction ID: 6d0e94c2461dd84b0edd1b1838a9f5cfcbcc86ad0ff0a6976e9d1f2ec4836e13
Opcode Fuzzy Hash: 604a302fabdb042f4ebc9b27cedb385bdeaebfe8a2c90ea295b00d5b5a1e0000
Instruction Fuzzy Hash: 5C41D032320B4881EB46DF26A8053DE63A5FB88BC4F4AD025EF5D4B785DE38D616C304

Function 0000000180033EB4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 0000000180033F31
_invoke_watson.LIBCMT ref: 0000000180034019

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 000000018003402E
_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180033EE6

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

Strings

:, xrefs: 0000000180033F4F

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID: :
API String ID: 1584724053-336475711
Opcode ID: f6eab2cf8d0451a383fcd1094c8bc586515c01fa06371aa533fca521f759249e
Instruction ID: 3ed635f29bcd3bbc21113fbea3335e451753d90b531e1a175994c922d52f3f57
Opcode Fuzzy Hash: f6eab2cf8d0451a383fcd1094c8bc586515c01fa06371aa533fca521f759249e
Instruction Fuzzy Hash: 8441E03232074881EB46EF26A4453DE63A5FB49BC4F4AD025EF5D47785DE38D61AC304

Function 00000001800311AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 0000000180031203
_getptd.LIBCMT ref: 00000001800311B7

Part of subcall function 00000001800389F4: _getptd_noexit.LIBCMT ref: 00000001800389FA
Part of subcall function 00000001800389F4: _amsg_exit.LIBCMT ref: 0000000180038A0A

_getptd.LIBCMT ref: 0000000180031269
_getptd.LIBCMT ref: 0000000180031275

Strings

csm, xrefs: 0000000180031237

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit_getptd_noexit
String ID: csm
API String ID: 2951875022-1018135373
Opcode ID: 19bc60ab7c8d46f879a577fdbd2134b4bea23403eb8b854014e227e093e25ad5
Instruction ID: cbf58d6bb5dae3ded25f47af1c64b690f48564a0522dc2334fd63855ea109656
Opcode Fuzzy Hash: 19bc60ab7c8d46f879a577fdbd2134b4bea23403eb8b854014e227e093e25ad5
Instruction Fuzzy Hash: D52101362046888AE6B2DF56E0407EFB760F78DBA5F058216EF9943795CF38D689C701

Function 0000000180038C3C Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180038C9E
_isleadbyte_l.LIBCMT ref: 0000000180038CCE
MultiByteToWideChar.KERNEL32 ref: 0000000180038D0D
MultiByteToWideChar.KERNEL32 ref: 0000000180038D5B
_errno.LIBCMT ref: 0000000180038D65

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: ce750271998e25300b2e646f02fc7aaebec70d68116cdf7c58e233941e4e38ee
Instruction ID: 54a50374dbd1f0619f5f0edc3d7c0374764c2683045a736cdbb11a7d2bf11c8c
Opcode Fuzzy Hash: ce750271998e25300b2e646f02fc7aaebec70d68116cdf7c58e233941e4e38ee
Instruction Fuzzy Hash: D841E53221578486E7A38F15E1403AAB7A1FF99FC0F199165FB8857BD9CF38C6458700

Function 000000018002FC18 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000000018002FC25

Part of subcall function 00000001800389F4: _getptd_noexit.LIBCMT ref: 00000001800389FA
Part of subcall function 00000001800389F4: _amsg_exit.LIBCMT ref: 0000000180038A0A

_inconsistency.LIBCMT ref: 000000018002FC33

Part of subcall function 000000018003A450: DecodePointer.KERNEL32(?,?,?,?,000000018003A3FD,?,?,?,000000018002F87E), ref: 000000018003A45B

_getptd.LIBCMT ref: 000000018002FC38
_inconsistency.LIBCMT ref: 000000018002FC54
_getptd.LIBCMT ref: 000000018002FC64

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
String ID:
API String ID: 3669027769-0
Opcode ID: d84545b744132abf258f2739307021ab7867776e2950de2c885c0764620f8872
Instruction ID: 484109b601cdb60bdd28eb5de1a6cf464c0836e84c8d7e2c0ed591a5095a7b89
Opcode Fuzzy Hash: d84545b744132abf258f2739307021ab7867776e2950de2c885c0764620f8872
Instruction Fuzzy Hash: E5F0FE322086CCC1EAE7AB55D2413FD5350AB8DBC4F1DC171BB840738B9E20C6989315

Function 00000001800039C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

string too long, xrefs: 0000000180003C53, 0000000180003C60

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID:
String ID: string too long
API String ID: 0-2556327735
Opcode ID: 4bcb7b9e46f5ff7cc52432c6c311dcb44bcc844c052dc368eac45e35e3a37bff
Instruction ID: 445ab153e7c438d5d2aafa17d0e773ba3e554981103aaf2981c75933f28ac080
Opcode Fuzzy Hash: 4bcb7b9e46f5ff7cc52432c6c311dcb44bcc844c052dc368eac45e35e3a37bff
Instruction Fuzzy Hash: D0919D72310B8899EB56CF66C0417EC33A5F319B98F818922EB5D67B99DF34CA59C310

Function 00007FFDFB5C3B50 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32 ref: 00007FFDFB5C3C25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB5C3CED

Strings

/, xrefs: 00007FFDFB5C3BE4
(, xrefs: 00007FFDFB5C3BD7

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: FromString_invalid_parameter_noinfo_noreturn
String ID: ($/
API String ID: 4208966878-2468745909
Opcode ID: e86f0ecaa3be94866e7fa5bfc826fc8b204ab50b5608c3affe33a1c089aea301
Instruction ID: bc95cdd0d9e58d5cc78767b107e8a5aab22a1d03eed2e52c2dbf169855144b51
Opcode Fuzzy Hash: e86f0ecaa3be94866e7fa5bfc826fc8b204ab50b5608c3affe33a1c089aea301
Instruction Fuzzy Hash: 1651F362B19B8682EB119B20E550BAE7761FB85BD4F404231EBAD07BEADF3CD551C700

Function 00007FFDFB4F9AA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB4F9B15
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFDFB4F9B9A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFDFB4F9BA0

Strings

vector too long, xrefs: 00007FFDFB4F9AA4

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: vector too long
API String ID: 3936042273-2873823879
Opcode ID: c3c7fdc940e69ba5ce45d1b963d3e03ddaf2e867e316d3fed9d6bbdb2af885f4
Instruction ID: dc9422119852a6142468c3c9e726efdf84323f839515798818ec320f7bf4ecc8
Opcode Fuzzy Hash: c3c7fdc940e69ba5ce45d1b963d3e03ddaf2e867e316d3fed9d6bbdb2af885f4
Instruction Fuzzy Hash: 6921CE22B1BB8391EF589B25D5616783290AF08BE8F644730DA3D477EEDE2CD4908300

Function 00007FFDFB50FBF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FFDFB50FC42
PostMessageW.USER32 ref: 00007FFDFB50FC69
SetWindowPos.USER32 ref: 00007FFDFB50FCFA

Strings

#, xrefs: 00007FFDFB50FCD5

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: MessagePost$Window
String ID: #
API String ID: 625243999-1885708031
Opcode ID: ec91c7267931f0259de04be5352fd3fb5e5bf072d78545cdd5dd902155c6f963
Instruction ID: 9dfcefc68500e6da824d021d18a499a7ace739b09eda56770bf46f6df6adc7c7
Opcode Fuzzy Hash: ec91c7267931f0259de04be5352fd3fb5e5bf072d78545cdd5dd902155c6f963
Instruction Fuzzy Hash: DC315E72B09B4286E7518F1AF450A69B360FB88BD4F480135DE9D43BAEDF6CD9458B00

Function 000000018002EF40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 000000018002EF4E
malloc.LIBCMT ref: 000000018002EF5A

Part of subcall function 000000018002DA78: _FF_MSGBANNER.LIBCMT ref: 000000018002DAA8
Part of subcall function 000000018002DA78: _NMSG_WRITE.LIBCMT ref: 000000018002DAB2
Part of subcall function 000000018002DA78: HeapAlloc.KERNEL32(?,?,00000000,000000018002CDB6,?,?,00000001,000000018002CCA4,?,?,?,0000000180007B34), ref: 000000018002DACD
Part of subcall function 000000018002DA78: _callnewh.LIBCMT ref: 000000018002DAE6
Part of subcall function 000000018002DA78: _errno.LIBCMT ref: 000000018002DAF1
Part of subcall function 000000018002DA78: _errno.LIBCMT ref: 000000018002DAFC

_CxxThrowException.LIBCMT ref: 000000018002EFA3

Part of subcall function 000000018002F788: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180007B51), ref: 000000018002F7F6
Part of subcall function 000000018002F788: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000180007B51), ref: 000000018002F835

Strings

bad allocation, xrefs: 000000018002EF6A

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: 738ca98c6a90698db2108c0c022190bcd32b331751dc6fe347bc8814740b5120
Instruction ID: c34e540c3145ef8f8a06282e5f5fd2721dda0450d804faa98ee3730b4d12842b
Opcode Fuzzy Hash: 738ca98c6a90698db2108c0c022190bcd32b331751dc6fe347bc8814740b5120
Instruction Fuzzy Hash: 3AF09AB1605B8E80EEA79B50A0517E95394E78D3C8F488025FA8D0B7A6EE39C34DCB01

Function 0000000180010C38 Relevance: 6.3, APIs: 4, Instructions: 332stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 0000000180010CE1
localeconv.LIBCMT ref: 0000000180010CF3
strcspn.LIBCMT ref: 0000000180010D07
_Mpunct.LIBCPMT ref: 0000000180010DD8

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: strcspn$Mpunctlocaleconv
String ID:
API String ID: 2882554788-0
Opcode ID: 58ecd130f00b09f8bef17f7d97753f2651f40aaaca60dedd1df9ae10203089cb
Instruction ID: 98907bd55804cf440550a9984b5626c23124420e0867e0600be7f70ad20b48f8
Opcode Fuzzy Hash: 58ecd130f00b09f8bef17f7d97753f2651f40aaaca60dedd1df9ae10203089cb
Instruction Fuzzy Hash: DFE18E32B04E8889EB529F65C4413ED63B1FB4CB88F658115EE8D57B99DF78C64AC340

Function 00000001800107A4 Relevance: 6.3, APIs: 4, Instructions: 331stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 000000018001084D
localeconv.LIBCMT ref: 000000018001085F
strcspn.LIBCMT ref: 0000000180010873
_Mpunct.LIBCPMT ref: 0000000180010944

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: strcspn$Mpunctlocaleconv
String ID:
API String ID: 2882554788-0
Opcode ID: 224329cea580c2bc9a473805bd80dcfbc8fe358384d0317fe36835c614ca270f
Instruction ID: 0755191b1818215e47aef75f24144b8be0e7d395005ccb8dbfd754ea295aee4c
Opcode Fuzzy Hash: 224329cea580c2bc9a473805bd80dcfbc8fe358384d0317fe36835c614ca270f
Instruction Fuzzy Hash: 44E18E32B04E8889FB529FA5C4513ED63B1FB58B88F648115EE8D57B99DF78C24AC340

Function 0000000180008524 Relevance: 6.3, APIs: 4, Instructions: 302stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 00000001800085CC
localeconv.LIBCMT ref: 00000001800085DF
strcspn.LIBCMT ref: 00000001800085F5
_Mpunct.LIBCPMT ref: 00000001800086C7

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: strcspn$Mpunctlocaleconv
String ID:
API String ID: 2882554788-0
Opcode ID: fce10359bc36b8c483969d2f07a480db227c72c73635d2d78eb5f884875fabf2
Instruction ID: 7cedfd9f43536d940008849a18cc50f9a484f0cb7e860469d92b1f85863b93e9
Opcode Fuzzy Hash: fce10359bc36b8c483969d2f07a480db227c72c73635d2d78eb5f884875fabf2
Instruction Fuzzy Hash: 9DD15B32B05A8889EB52CBB5D4503DD37B1F749BC8F949115EE8967B8ADF38C24AC740

Function 0000000180032F58 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180032F82

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_malloc_crt.LIBCMT ref: 0000000180032FC5
_invoke_watson.LIBCMT ref: 000000018003308A

Part of subcall function 0000000180035CD8: _call_reportfault.LIBCMT ref: 0000000180035D00

_invoke_watson.LIBCMT ref: 00000001800330A0

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale_invoke_watson$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_call_reportfault_getptd_malloc_crt
String ID:
API String ID: 1584724053-0
Opcode ID: 3daca0f6dc92f9794fddbcc1cdaa0d0f178e51dead4e14673644e8c31eb13f91
Instruction ID: 60c5c1db5c3b6a439df75705f13e8ee1368a37c7c8ec72173617ca3056aafd03
Opcode Fuzzy Hash: 3daca0f6dc92f9794fddbcc1cdaa0d0f178e51dead4e14673644e8c31eb13f91
Instruction Fuzzy Hash: F231C57271064886EB57DB26941539E67A1E789FC4F05C135EF5D0BB9ACF38D2068304

Function 000000018000CF54 Relevance: 6.1, APIs: 4, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

_wfsopen.LIBCMT ref: 000000018000CEE9
fclose.LIBCMT ref: 000000018000CEF6
_wfsopen.LIBCMT ref: 000000018000CF0B
fseek.LIBCMT ref: 000000018000CF25

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 060668c88b56fe38f5c44a18ba7740774a474d3c0946bdb231730e3168279bf2
Instruction ID: ca7f0c424757e16301a012df31de7f28ede8ce03464d2c668ee3546fdfd8efa6
Opcode Fuzzy Hash: 060668c88b56fe38f5c44a18ba7740774a474d3c0946bdb231730e3168279bf2
Instruction Fuzzy Hash: 6921E5327216C885FBE6CB1AD441BE67691A78CBC4F19C134BE0943B95DE35C60A8341

Function 0000000180048310 Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0000000180048334

Part of subcall function 000000018002F34C: _getptd.LIBCMT ref: 000000018002F362
Part of subcall function 000000018002F34C: __updatetlocinfo.LIBCMT ref: 000000018002F397
Part of subcall function 000000018002F34C: __updatetmbcinfo.LIBCMT ref: 000000018002F3BE

_errno.LIBCMT ref: 0000000180048340

Part of subcall function 000000018002F2DC: _getptd_noexit.LIBCMT ref: 000000018002F2E0

_invalid_parameter_noinfo.LIBCMT ref: 000000018004834B
strchr.LIBCMT ref: 0000000180048361

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: eb64e8c74a50022202f8ee626fe7dbe8f97126340f84a3ce38f6fe5f0cae3986
Instruction ID: 9616a423f97e3a452b980222ce2d2f9dcf0e870d32183e3c52a82e7da15984e5
Opcode Fuzzy Hash: eb64e8c74a50022202f8ee626fe7dbe8f97126340f84a3ce38f6fe5f0cae3986
Instruction Fuzzy Hash: D0213872204AAC40F7E75E1194D03FD66C0EB88FDAF1AC824FAC6076C5CD28C749A708

Function 00000001800072C0 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800072FF

Part of subcall function 0000000180007BD8: _lock.LIBCMT ref: 0000000180007BEA

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 000000018000733C
free.LIBCMT ref: 0000000180007363
malloc.LIBCMT ref: 0000000180007382

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_LockitLockit::__lockfreemallocstd::_std::locale::_
String ID:
API String ID: 2732429687-0
Opcode ID: 4c7c4e4cdeb69145b53e9993b344bfcc5c5a1a68407a660adf776166b3026ff4
Instruction ID: 76cda7fa5ebd9028eb80fcaf77cbf10d53a700b3cb3c5ee5f831434e332e8d90
Opcode Fuzzy Hash: 4c7c4e4cdeb69145b53e9993b344bfcc5c5a1a68407a660adf776166b3026ff4
Instruction Fuzzy Hash: 84213B71604A8881EBA2CF11E4403DAB3A0F7597E0F548216EB9D57BA6CF7CC6998740

Function 00000001800495E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000001800496A8

Strings

csm, xrefs: 000000018004960B
csm, xrefs: 0000000180049664

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: ce9d772766a9f3e407c5664677aefc26ffad84ba179c49f55fff2b9c6189d35d
Instruction ID: f7e595c495de74603a87214bb7ed729c6939f290df5d238fa3d8429b20b6b438
Opcode Fuzzy Hash: ce9d772766a9f3e407c5664677aefc26ffad84ba179c49f55fff2b9c6189d35d
Instruction Fuzzy Hash: 6031A773101B48CADBA18F66C0843993BB5F358B9DF8B5225FA4D1BB64CB75C984C788

Function 00007FFDFB507AE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetWindowTextW.USER32 ref: 00007FFDFB507B11
GetWindowRect.USER32 ref: 00007FFDFB507B27

Strings

hwnd(0x%08x) pos(%d %d) dim(%d %d) %s, xrefs: 00007FFDFB507B6C

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Window$RectText
String ID: hwnd(0x%08x) pos(%d %d) dim(%d %d) %s
API String ID: 3244772712-1731226318
Opcode ID: ab3949e57376ec885a1af7c9daca5177edca3585cc7dbd67c50f2748e189522b
Instruction ID: 92b01b5dcd441b929ae7df912ca680b1e58ecf935882f4103ce8325e60c5377d
Opcode Fuzzy Hash: ab3949e57376ec885a1af7c9daca5177edca3585cc7dbd67c50f2748e189522b
Instruction Fuzzy Hash: B1116A72A2968586EB118B15E45075AE760FB887D0F444121EE8D07B68DB7CE5988F00

Function 00007FFDFB507A30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FFDFB507A78

Part of subcall function 00007FFDFB507E10: GetCurrentThreadId.KERNEL32 ref: 00007FFDFB507ECD
Part of subcall function 00007FFDFB507E10: GetCurrentProcessId.KERNEL32 ref: 00007FFDFB507ED5

LocalFree.KERNEL32 ref: 00007FFDFB507AB9

Strings

API function failed with %d: %s, xrefs: 00007FFDFB507A9B

Memory Dump Source

Source File: 00000000.00000002.3011201976.00007FFDFB481000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FFDFB480000, based on PE: true

Associated: 00000000.00000002.3011182983.00007FFDFB480000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011284110.00007FFDFB5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011313056.00007FFDFB644000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011326899.00007FFDFB646000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011339701.00007FFDFB647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3011352647.00007FFDFB64E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffdfb480000_loaddll64.jbxd

Similarity

API ID: Current$FormatFreeLocalMessageProcessThread
String ID: API function failed with %d: %s
API String ID: 1087594894-470931892
Opcode ID: 0f953ed10209e1cd2ae3cab99d472e1bb3b644d22f0039629b56ab57d6aab400
Instruction ID: ca618582be875cbda7444c90dd54c1121e462fcff1563e49c7fd14459519dd05
Opcode Fuzzy Hash: 0f953ed10209e1cd2ae3cab99d472e1bb3b644d22f0039629b56ab57d6aab400
Instruction Fuzzy Hash: 5F115A32B09B8286D7518F12F89056AB6A1F788BC0F180139EB9D83F6EDF3CC5018B44

Function 00000001800496D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 000000018002FC18: _getptd.LIBCMT ref: 000000018002FC25
Part of subcall function 000000018002FC18: _inconsistency.LIBCMT ref: 000000018002FC33
Part of subcall function 000000018002FC18: _getptd.LIBCMT ref: 000000018002FC38
Part of subcall function 000000018002FC18: _inconsistency.LIBCMT ref: 000000018002FC54

_getptd.LIBCMT ref: 000000018004972B
_getptd.LIBCMT ref: 000000018004973E

Part of subcall function 000000018002FCA8: _getptd.LIBCMT ref: 000000018002FCB1

Strings

csm, xrefs: 00000001800496F8

Memory Dump Source

Source File: 00000000.00000002.3008848971.0000000180001000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000000.00000002.3008764024.0000000180000000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008903358.000000018004A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3008959527.0000000180060000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3009001687.00000001800A3000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_180000000_loaddll64.jbxd

Similarity

API ID: _getptd$_inconsistency
String ID: csm
API String ID: 1773999731-1018135373
Opcode ID: 242ad1541a1665e7e88aaf19789ec1deda19dbf05a08f0dcd3087e0f0a85a81f
Instruction ID: 6596bc08887fd2df5714e5c2ca6ea54ff60e088d84c846dd7f248314ba4ebb2f
Opcode Fuzzy Hash: 242ad1541a1665e7e88aaf19789ec1deda19dbf05a08f0dcd3087e0f0a85a81f
Instruction Fuzzy Hash: 8D01A736115A4989DBA2AF71D4C17FD2394E7497C9F099171FE4946349DE20C6C9C340

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TiNgny4xSB.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_04504176a318ef6a4711c8eb84999e6f6eb1_8f532422_fab5e15b-9538-4913-9e97-d15e50033763\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_63179dbefcf24b1f63fa956696d2b85246a0d5db_8f532422_730590ba-86b0-4eb5-be05-e341ed564ef1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_TiN_916a7d8f75978f3384e540b6f642fd74f32736_8f532422_007882f3-b647-418e-b212-463ae2cad8a6\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16EA.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1768.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1798.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2273.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER22E2.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2312.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD18.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD67.tmp.xml

C:\Users\user\NTUSER.DAT.Not

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
TiNgny4xSB.dll