Edit tour

Windows Analysis Report
nsdksetup.dll

Overview

General Information

Sample name:	nsdksetup.dll
Analysis ID:	1576918
MD5:	e0b7d6b9d4f1666b6ac5e52dd78a0273
SHA1:	3cdd84acf09a5905e7dd93fc1043b59bdd0231bb
SHA256:	5060a37c40ba559ab4bd39f6b838dd7142d400b6d2d2876abe37019509a53d0a
Tags:	dlluser-smica83
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Sigma detected: Windows Binaries Write Suspicious Extensions

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7416 cmdline: loaddll32.exe "C:\Users\user\Desktop\nsdksetup.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7468 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 7492 cmdline: rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 8092 cmdline: cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1256 cmdline: tasklist /FI "IMAGENAME eq rundll32.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2288 cmdline: findstr /I "rundll32.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

timeout.exe (PID: 3480 cmdline: timeout /t 30 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

tasklist.exe (PID: 4872 cmdline: tasklist /FI "IMAGENAME eq rundll32.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5972 cmdline: findstr /I "rundll32.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

rundll32.exe (PID: 7408 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: 889B99C52A60DD49227C5E485A016679)

timeout.exe (PID: 5476 cmdline: timeout /t 30 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

tasklist.exe (PID: 3492 cmdline: tasklist /FI "IMAGENAME eq rundll32.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1820 cmdline: findstr /I "rundll32.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

rundll32.exe (PID: 2192 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: 889B99C52A60DD49227C5E485A016679)

timeout.exe (PID: 1524 cmdline: timeout /t 30 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

tasklist.exe (PID: 1404 cmdline: tasklist /FI "IMAGENAME eq rundll32.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 4112 cmdline: findstr /I "rundll32.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

rundll32.exe (PID: 4680 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: 889B99C52A60DD49227C5E485A016679)

timeout.exe (PID: 4944 cmdline: timeout /t 30 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

rundll32.exe (PID: 7476 cmdline: rundll32.exe C:\Users\user\Desktop\nsdksetup.dll,SteamAPI_Init MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 8084 cmdline: cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3332 cmdline: tasklist /FI "IMAGENAME eq rundll32.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7212 cmdline: findstr /I "rundll32.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

timeout.exe (PID: 3956 cmdline: timeout /t 30 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

tasklist.exe (PID: 3952 cmdline: tasklist /FI "IMAGENAME eq rundll32.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7252 cmdline: findstr /I "rundll32.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

rundll32.exe (PID: 6864 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: 889B99C52A60DD49227C5E485A016679)

timeout.exe (PID: 6536 cmdline: timeout /t 30 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

tasklist.exe (PID: 2072 cmdline: tasklist /FI "IMAGENAME eq rundll32.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2016 cmdline: findstr /I "rundll32.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

rundll32.exe (PID: 2292 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: 889B99C52A60DD49227C5E485A016679)

timeout.exe (PID: 3236 cmdline: timeout /t 30 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

tasklist.exe (PID: 5700 cmdline: tasklist /FI "IMAGENAME eq rundll32.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3856 cmdline: findstr /I "rundll32.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

rundll32.exe (PID: 4516 cmdline: "C:\Windows\SysWOW64\rundll32.exe" MD5: 889B99C52A60DD49227C5E485A016679)

timeout.exe (PID: 6896 cmdline: timeout /t 30 /nobreak MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

rundll32.exe (PID: 7600 cmdline: rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",SteamAPI_Init MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Sigma Signatures

System Summary

Sigma detected: Windows Binaries Write Suspicious Extensions

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 7492, TargetFilename: C:\Users\user\AppData\Local\Temp\monitor.bat

Code function: 3_2_6D021100 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptSetKeyParam,CryptDestroyKey,CryptReleaseContext,CryptSetKeyParam,CryptDestroyKey,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,CryptDestroyKey,CryptReleaseContext,

3_2_6D021100

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D03ED00	3_2_6D03ED00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D034F70	3_2_6D034F70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1A69F2	3_2_6D1A69F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D18A804	3_2_6D18A804
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D182BE0	3_2_6D182BE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0345C0	3_2_6D0345C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D04849D	3_2_6D04849D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D04476E	3_2_6D04476E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D186651	3_2_6D186651
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D1906A6	3_2_6D1906A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D07A181	3_2_6D07A181
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0722EB	3_2_6D0722EB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D06BDBD	3_2_6D06BDBD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D04DC7F	3_2_6D04DC7F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D189E80	3_2_6D189E80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D011ED0	3_2_6D011ED0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D03B860	3_2_6D03B860
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D07B58F	3_2_6D07B58F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D05D435	3_2_6D05D435
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D01F470	3_2_6D01F470
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D05908D	3_2_6D05908D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D03F0B0	3_2_6D03F0B0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D04066B appears 63 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D05F655 appears 200 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D03D8B0 appears 31 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D05F6BE appears 63 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D05F75F appears 44 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6D05D890 appears 61 times

Source: nsdksetup.dll

Static PE information: invalid certificate

Source: nsdksetup.dll

Binary or memory string: OriginalFilenamensdksetupJ vs nsdksetup.dll

Source: nsdksetup.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: mal56.evad.winDLL@76/14@0/0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D03A5E0 GetCurrentProcessId,CreateToolhelp32Snapshot,Thread32First,GetCurrentThreadId,OpenThread,Wow64SuspendThread,Thread32Next,CloseHandle,

3_2_6D03A5E0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D05AD46 CoInitialize,CoCreateInstance,

3_2_6D05AD46

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D04AF5B FindResourceW,LoadResource,LockResource,

3_2_6D04AF5B

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\PolicyManagement.xml

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\monitor.pid

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat"

Source: nsdksetup.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nsdksetup.dll,SteamAPI_Init

Source: tasklist.exe, 0000001D.00000002.2651636735.0000000002C69000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'RUNDLL32.EXE'gram F;;

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\nsdksetup.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nsdksetup.dll,SteamAPI_Init
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",SteamAPI_Init
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\nsdksetup.dll,SteamAPI_Init	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",SteamAPI_Init	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Windows\SysWOW64\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: nsdksetup.dll

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: nsdksetup.dll

Static file information: File size 2291000 > 1048576

Source: nsdksetup.dll

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1a8c00

Source: nsdksetup.dll

Static PE information: More than 200 imports for USER32.dll

Source: nsdksetup.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: nsdksetup.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: nsdksetup.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: nsdksetup.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: nsdksetup.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: nsdksetup.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: nsdksetup.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: nsdksetup.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \YSS\Release\steam_api.pdb source: rundll32.exe, 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.2074189278.000000006D1BA000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000006.00000002.2102346644.000000006D1BA000.00000002.00000001.01000000.00000003.sdmp, nsdksetup.dll
Source:	Binary string: rundll32.pdb source: rundll32.exe, 00000004.00000003.2043078463.00000000028A3000.00000004.00000020.00020000.00000000.sdmp, backup.exe.4.dr
Source:	Binary string: rundll32.pdbGCTL source: rundll32.exe, 00000004.00000003.2043078463.00000000028A3000.00000004.00000020.00020000.00000000.sdmp, backup.exe.4.dr

Source: nsdksetup.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: nsdksetup.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: nsdksetup.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: nsdksetup.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: nsdksetup.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: backup.exe.4.dr

Static PE information: 0x6A8F1B39 [Wed Aug 26 16:58:33 2026 UTC]

Source: nsdksetup.dll	Static PE information: section name: .00cfg
Source: backup.exe.4.dr	Static PE information: section name: .didat

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D03F750 push eax; mov dword ptr [esp], 8007000Eh	3_2_6D03F754
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D04FDA3 push esi; ret	3_2_6D04FDA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D05F72D push ecx; ret	3_2_6D05F740

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Users\user\AppData\Local\Temp\backup.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D04E94E IsIconic,	3_2_6D04E94E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0787A4 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageW,UpdateWindow,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	3_2_6D0787A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D06305D GetParent,IsIconic,GetParent,__EH_prolog3,	3_2_6D06305D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0472BF IsIconic,IsWindowVisible,	3_2_6D0472BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0532C4 IsWindowVisible,IsIconic,	3_2_6D0532C4

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\timeout.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D03A5E0 GetCurrentProcessId,CreateToolhelp32Snapshot,Thread32First,GetCurrentThreadId,OpenThread,Wow64SuspendThread,Thread32Next,CloseHandle,

3_2_6D03A5E0

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_3-63201

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 3.7 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7556	Thread sleep time: -73000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7560	Thread sleep time: -73000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7616	Thread sleep time: -73000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 3784	Thread sleep count: 260 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 3816	Thread sleep count: 260 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 5232	Thread sleep count: 262 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 6260	Thread sleep count: 262 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 1816	Thread sleep count: 251 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 2508	Thread sleep count: 249 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 2296	Thread sleep count: 208 > 30
Source: C:\Windows\SysWOW64\timeout.exe TID: 4844	Thread sleep count: 206 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0882AF __EH_prolog3_GS,GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,	3_2_6D0882AF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D19F18B FindFirstFileExW,	3_2_6D19F18B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D19F23C FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_6D19F23C

Source: C:\Windows\System32\loaddll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 73000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 73000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 73000	Jump to behavior

Source: rundll32.exe, 00000003.00000002.2073045434.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.2043837773.00000000028A3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D05C225 IsDebuggerPresent,OutputDebugStringW,

3_2_6D05C225

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D041008 OutputDebugStringA,GetLastError,

3_2_6D041008

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D03A5E0 GetCurrentProcessId,CreateToolhelp32Snapshot,Thread32First,GetCurrentThreadId,OpenThread,Wow64SuspendThread,Thread32Next,CloseHandle,

3_2_6D03A5E0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D0126C0 GetProcessHeap,

3_2_6D0126C0

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0B8786 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6D0B8786
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D191F18 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6D191F18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D05D776 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6D05D776

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 192.168.2.9 0

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "IMAGENAME eq rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 30 /nobreak

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	3_2_6D1A6143
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_6D1A61EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	3_2_6D1A6023
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoW,	3_2_6D0660D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6D1A60F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	3_2_6D1A62F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_6D1A5D71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6D19BC5B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6D1A5CD6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6D1A5FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_6D1A5A85
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	3_2_6D19B63C

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D192EE2 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

3_2_6D192EE2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6D0495C5 __EH_prolog3_GS,GetCurrentThread,GetCurrentThreadId,GetVersionExW,

3_2_6D0495C5

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	111 Process Injection	1 Masquerading	21 Input Capture	1 System Time Discovery	Remote Services	21 Input Capture	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nsdksetup.dll	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\backup.exe	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576918
Start date and time:	2024-12-17 18:13:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nsdksetup.dll
Detection:	MAL
Classification:	mal56.evad.winDLL@76/14@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 31 Number of non-executed functions: 349
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
VT rate limit hit for: nsdksetup.dll

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9jSUEudm9taXZvci5ydS9Td1dIay8=/%23dGVzbGFAdGVzbGEuY29t	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://t.co/4MnukUbNZX	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	cpu_rootkit.exe	Get hash	malicious	CobaltStrike	Browse	13.107.246.63
	https://enrollmentportal.borlsfx.com/rwrzvvwfa/d8b09a/?2a6p5=test@test.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	http://www.delinian.com	Get hash	malicious	Unknown	Browse	13.107.246.63
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	13.107.246.63
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	13.107.246.63
	r63NANrAHS.js	Get hash	malicious	Unknown	Browse	13.107.246.63
	6xKgZHxo9S.js	Get hash	malicious	Unknown	Browse	13.107.246.63

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\backup.exe	#U63d0#U53d6Proxy.exe	Get hash	malicious	Gh0stCringe, Neshta, RunningRAT	Browse
	#U4ee3#U7406.exe	Get hash	malicious	Gh0stCringe, Neshta, RunningRAT	Browse
	#U63d0#U53d6Proxy (1).exe	Get hash	malicious	Gh0stCringe, Neshta, RunningRAT	Browse
	V6bBcEdp5a.dll	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse
	l10U7QN0CY.dll	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse
	KlzXRW4Ag7.dll	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse
	ZfJheGhddq.dll	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse
	PD5dVJNpz7.dll	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse
	7YtmCkMUx3.dll	Get hash	malicious	GhostRat, Mimikatz, Nitol	Browse
	tROeAyXq2X.exe	Get hash	malicious	Mimikatz, RunningRAT	Browse

Created / dropped Files

C:\Users\user\AppData\Local\PolicyManagement.xml

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1893
Entropy (8bit):	5.212287775015203
Encrypted:	false
SSDEEP:	48:c55XzDl4Q2ZbXL6Q0QFdOFQOzN33O4OiDdKrKsTLXbGMv:O5XzDl4Q2ZbGQhFdOFQOzBdKrKsTLXbV
MD5:	E3FB2ECD2AD10C30913339D97E0E9042
SHA1:	A004CE2B3D398312B80E2955E76BDA69EF9B7203
SHA-256:	1BD6DB55FFF870C9DF7A0AAC11B895B50F57774F20A5744E63BBC3BD40D11F28
SHA-512:	9D6F0C1E344F1DC5A0EF4CAAD86281F92A6C108E1085BACD8D6143F9C742198C2F759CA5BDFFAD4D9E40203E6B0460E84896D1C6B8B1759350452E1DE809B716
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2006-11-10T14:29:55.5851926</Date>. <Author>Microsoft Corporation</Author>. <Description>????? AD RMS ?????????????????? Web ?????????,???????????</Description>. <URI>\AS AMD updata</URI>. <SecurityDescriptor>D:(A;;FA;;;BA)(A;;FA;;;SY)(A;;FRFX;;;WD)</SecurityDescriptor>. </RegistrationInfo>. <Triggers>. <LogonTrigger id="06b3f632-87ad-4ac0-9737-48ea5ddbaf11">. <Enabled>true</Enabled>. <Delay>PT30S</Delay>. </LogonTrigger>. </Triggers>. <Principals>. <Principal id="AllUsers">. <GroupId>S-1-1-0</GroupId>. <RunLevel>HighestAvailable</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>. <AllowHardTerm

C:\Users\user\AppData\Local\Temp\backup.exe

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	6.199746098562656
Encrypted:	false
SSDEEP:	1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5:	889B99C52A60DD49227C5E485A016679
SHA1:	8FA889E456AA646A4D0A4349977430CE5FA5E2D7
SHA-256:	6CBE0E1F046B13B29BFA26F8B368281D2DDA7EB9B718651D5856F22CC3E02910
SHA-512:	08933106EAF338DD119C45CBF1F83E723AFF77CC0F8D3FC84E36253B1EB31557A54211D1D5D1CB58958188E32064D451F6C66A24B3963CCCD3DE07299AB90641
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: #U63d0#U53d6Proxy.exe, Detection: malicious, Browse Filename: #U4ee3#U7406.exe, Detection: malicious, Browse Filename: #U63d0#U53d6Proxy (1).exe, Detection: malicious, Browse Filename: V6bBcEdp5a.dll, Detection: malicious, Browse Filename: l10U7QN0CY.dll, Detection: malicious, Browse Filename: KlzXRW4Ag7.dll, Detection: malicious, Browse Filename: ZfJheGhddq.dll, Detection: malicious, Browse Filename: PD5dVJNpz7.dll, Detection: malicious, Browse Filename: 7YtmCkMUx3.dll, Detection: malicious, Browse Filename: tROeAyXq2X.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.....^...^...^.pb^...^.c._...^.c._...^...^c..^.c._...^.c._...^.c._...^.c.^...^.c._...^Rich...^........PE..L...9..j.................b...........a............@..........................@............@.............................................hg...................0..........T........................... ........................m..`....................text...La.......b.................. ..`.data................f..............@....idata...............h..............@..@.didat...............~..............@....rsrc...hg.......h..................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\monitor.bat

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	719
Entropy (8bit):	5.1641048528391025
Encrypted:	false
SSDEEP:	12:NFWdVWCPSmOWdVW+ZMmOWE+IwZzWcR7RwZ9/FZ+0Yp9Sqe/tA5dKQ+0Z+0VbphJm:NFW/W17W/WgM7WERwZzWcRlwZZKx31S1
MD5:	2610FFC2D40535D08C0B9CF2C8A3F461
SHA1:	D8F9770AC52B6D9D73F571B962365C4074F128D8
SHA-256:	62F2B62072F49D7A56AE16362B43611C9B03053AA48C03B3B177B7FCC79B216D
SHA-512:	C0C0381E97420B1A61145B8437EADD5364DADA05F87CBDCEC50EF6F1E4B2B2D375EC00CDB2D14C0C96DE2054DEDB24DCD706281029D9C4777B55FFD5C4FD18FD
Malicious:	true
Preview:	@echo off..:CheckProcess..set "ProcessName=rundll32.exe"..set "ProcessPath=C:\Windows\SysWOW64\rundll32.exe"..set "BackupProcessPath=C:\Users\user\AppData\Local\Temp\\backup.exe"..set "DLLPath="..set "BackupDLLPath=C:\Users\user\AppData\Local\Temp\\backup.dll"..if not exist "%ProcessPath%" (.. echo Process file not found, restoring from backup..... copy /Y "%BackupProcessPath%" "%ProcessPath%"..)..if not exist "%DLLPath%" (.. echo DLL file not found, restoring from backup..... copy /Y "%BackupDLLPath%" "%DLLPath%"..)..tasklist /FI "IMAGENAME eq %ProcessName%" \| findstr /I "%ProcessName%" >nul..if %ERRORLEVEL% neq 0 (.. start "" "%ProcessPath%"..)..timeout /t 30 /nobreak >nul..goto CheckProcess..

C:\Users\user\AppData\Local\Temp\monitor.pid

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:MX:MX
MD5:	630EFF1B380505A67570DFF952CE4AD7
SHA1:	C4DA4A14965F073D44330CDE4508905DF52E81EA
SHA-256:	BC7FE627D446AA7BF9D91C98487D414BEAF56EFAF7BA1748A354CA07850D889D
SHA-512:	60C813FD4303173CB98DB599892E515A7F73617C6D04D1226548953B23B5201E76BE6415E22EA39216F7EB6AEE6CEFC8826FD1C9A6D2FDA6A628F450657C3DC1
Malicious:	false
Preview:	8092

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	146
Entropy (8bit):	4.007045619960759
Encrypted:	false
SSDEEP:	3:hYFRZARcWmFsFJQZ/ctXvY/4to/9uF8cttEfYhnQUqg2Htysn:hYFRamFSQZ0lv5y/9JctESnQUq3tys
MD5:	142C2305671DED58170E6E5A0E4C59CB
SHA1:	C5AE6FDF759486E120830439E9102B616BA926C5
SHA-256:	3E26B1E9AAEC708A4924E2FD93ECA5F7418029AC568908430FB09B069D02A56E
SHA-512:	E96AF73EE8BC497C1AB2F3DF27155F0D17C84FC8C643955EB25335C59DC91013F572AA591FA71A01FDC3ABAEB715AAE73173FA4323FFA92CA4E7C44C50F52A3B
Malicious:	false
Preview:	..Waiting for 30 seconds, press CTRL+C to quit .....29..28..27..26..25..24..23..22..21..20..19..18..17..16..15..14..13..12..11..10.. 9.. 8.. 7.. 6

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.606106523352761
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nsdksetup.dll
File size:	2'291'000 bytes
MD5:	e0b7d6b9d4f1666b6ac5e52dd78a0273
SHA1:	3cdd84acf09a5905e7dd93fc1043b59bdd0231bb
SHA256:	5060a37c40ba559ab4bd39f6b838dd7142d400b6d2d2876abe37019509a53d0a
SHA512:	bd5908294adc6abc83cdcb99829323392654d2ded5bf299726714cd95fc595b8b3beec2b12e0ccb34130cf898c7016e4cb9dadb41985036e2c8d35c36511e587
SSDEEP:	49152:F/kcCMJuG+opH4CLOpd7ioYiKq8iBh3n1XK0pcioOgTjJ:FMcCMJuGhB4CLmZioYQ8iBh3nhK0pciC
TLSH:	EDB58D2135187877D35F02316D19B279E5FCAE302B3901DBE7449E1839364A286F7AAF
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...^8^g...........!.........<.......!.......................................`#...........@.............................N.......h..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x10172193
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x675E385E [Sun Dec 15 02:01:02 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e8e10a9a26ea7946a143d94d30a79a47

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	22/02/2024 20:25:52 19/02/2025 20:25:52
Subject Chain	CN=.NET, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	430565BEA94CD2EBC1BA24A3A2D7FC84
Thumbprint SHA-1:	724C8D7BBEB78F2618147BF7BA8060AC308B7468
Thumbprint SHA-256:	A7F501CB1578B030063B4490C3DAD52AFA6820FCB0CA047961B459E7DC43BDDF
Serial:	33000003D2DA19165D6DC749AF0000000003D2

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007EFF2CC16157h
call 00007EFF2CC1616Ah
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007EFF2CC1602Eh
add esp, 0Ch
pop ebp
retn 000Ch
mov ecx, dword ptr [10200DC0h]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007EFF2CC16156h
test esi, ecx
jne 00007EFF2CC16178h
call 00007EFF2CC16181h
mov ecx, eax
cmp ecx, edi
jne 00007EFF2CC16159h
mov ecx, BB40E64Fh
jmp 00007EFF2CC16160h
test esi, ecx
jne 00007EFF2CC1615Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [10200DC0h], ecx
not ecx
pop edi
mov dword ptr [10200E00h], ecx
pop esi
ret
push ebp
mov ebp, esp
sub esp, 14h
lea eax, dword ptr [ebp-0Ch]
xorps xmm0, xmm0
push eax
movlpd qword ptr [ebp-0Ch], xmm0
call dword ptr [101EC87Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [101EC804h]
xor dword ptr [ebp-04h], eax
call dword ptr [101EC7FCh]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [101EC968h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
push 1020A018h
call dword ptr [101EC8FCh]
ret

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1ebb8c	0x4e	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1ebbda	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20d000	0x4800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x22cc00	0x2938	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x212000	0x230bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1ea8a4	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1d6220	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1d1170	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1ec754	0xa10	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1a8ac9	0x1a8c00	abaaae5f1f08ebe7cce61d8c25d46985	False	0.5223954118231312	data	6.515437951178249	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1aa000	0x55eac	0x56000	495869d5a3f54fafe2a8b3bfe198025b	False	0.27931106922238375	0421 Alliant compact executable not stripped	5.3516520657079205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x200000	0xa800	0x5e00	98490a19b33f42cd9e6c6024e6fef6ae	False	0.24243683510638298	data	4.7964348900886815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x20b000	0x8	0x200	9b3fb53df9de8537e98313fc981a1ebb	False	0.033203125	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x20c000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x20d000	0x4800	0x4800	d02b766042ee6bd9361ea19b0bdc4c44	False	0.3206922743055556	data	4.363281198997168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x212000	0x230bc	0x23200	ee21bd4c6ceca71325aab0cc3f930ccd	False	0.46352313167259784	data	6.571525218821168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x20e004	0x40	openssl enc'd data with salted password, base64 encoded			1.125
RT_CURSOR	0x20e044	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x20e178	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x20e22c	0x134	data	Chinese	China	0.4090909090909091
RT_CURSOR	0x20e360	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	Chinese	China	0.5944444444444444
RT_CURSOR	0x20e414	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\370\037\377\377\370\037\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.32142857142857145
RT_CURSOR	0x20e548	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	Chinese	China	0.49444444444444446
RT_CURSOR	0x20e5fc	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\360\037\377\377\370?\377\377\374\177\377\377\376\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.33766233766233766
RT_CURSOR	0x20e730	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	Chinese	China	0.5
RT_CURSOR	0x20e7e4	0x134	AmigaOS bitmap font "(", fc_YSize 4294966787, 3840 elements, 2nd "\377\003\300\377\377\200\001\377\377\300\003\377\377\340\007\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5616883116883117
RT_CURSOR	0x20e918	0xb4	Targa image data - RLE 32 x 65536 x 1 +16 "\001"	Chinese	China	0.5444444444444444
RT_CURSOR	0x20e9cc	0x134	AmigaOS bitmap font "(", fc_YSize 4294967264, 5120 elements, 2nd "\377\360?\377\377\370\177\377\377\374\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.36363636363636365
RT_CURSOR	0x20eb00	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.35714285714285715
RT_CURSOR	0x20ec34	0x134	data	Chinese	China	0.37337662337662336
RT_CURSOR	0x20ed68	0x134	data	Chinese	China	0.37662337662337664
RT_CURSOR	0x20ee9c	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x20efd0	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x20f104	0x134	Targa image data - Mono - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.36688311688311687
RT_CURSOR	0x20f238	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	Chinese	China	0.38636363636363635
RT_CURSOR	0x20f36c	0x134	data	Chinese	China	0.44155844155844154
RT_CURSOR	0x20f4a0	0x134	data	Chinese	China	0.4155844155844156
RT_CURSOR	0x20f5d4	0x134	AmigaOS bitmap font "(", fc_YSize 4294966847, 3840 elements, 2nd "\377?\374\377\377\300\003\377\377\300\003\377\377\340\007\377\377\360\017\377\377\370\037\377\377\374?\377\377\376\177\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.5422077922077922
RT_CURSOR	0x20f708	0x134	data	Chinese	China	0.2662337662337662
RT_CURSOR	0x20f83c	0x134	data	Chinese	China	0.2824675324675325
RT_CURSOR	0x20f970	0x134	data	Chinese	China	0.3246753246753247
RT_BITMAP	0x20faa4	0x2c0	Device independent bitmap graphic, 80 x 15 x 4, image size 600	Chinese	China	0.37642045454545453
RT_BITMAP	0x20fd64	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x20fe1c	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_MENU	0x20ff60	0xb2	data	Chinese	China	0.7584269662921348
RT_MENU	0x210014	0x192	data	Chinese	China	0.599502487562189
RT_DIALOG	0x2101a8	0x104	data	Chinese	China	0.6307692307692307
RT_DIALOG	0x2102ac	0xe2	data	Chinese	China	0.6769911504424779
RT_DIALOG	0x210390	0x34	data	Chinese	China	0.8653846153846154
RT_STRING	0x2103c4	0x36	data	Chinese	China	0.48148148148148145
RT_STRING	0x2103fc	0x2a	data	Chinese	China	0.5476190476190477
RT_STRING	0x210428	0x42	data	Chinese	China	0.6818181818181818
RT_STRING	0x21046c	0x120	data	Chinese	China	0.65625
RT_STRING	0x21058c	0xbe	data	Chinese	China	0.5578947368421052
RT_STRING	0x21064c	0x64	data	Chinese	China	0.76
RT_STRING	0x2106b0	0x54	data	Chinese	China	0.5357142857142857
RT_STRING	0x210704	0x46	data	Chinese	China	0.7428571428571429
RT_STRING	0x21074c	0x3c	data	Chinese	China	0.6166666666666667
RT_STRING	0x210788	0x9e	data	Chinese	China	0.7151898734177216
RT_STRING	0x210828	0x4a	data	Chinese	China	0.7837837837837838
RT_STRING	0x210874	0x4e	data	Chinese	China	0.8461538461538461
RT_STRING	0x2108c4	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x2108f0	0x84	data	Chinese	China	0.9166666666666666
RT_STRING	0x210974	0x1cc	data	Chinese	China	0.7934782608695652
RT_STRING	0x210b40	0x14e	data	Chinese	China	0.5179640718562875
RT_STRING	0x210c90	0x10e	data	Chinese	China	0.7037037037037037
RT_STRING	0x210da0	0x50	data	Chinese	China	0.7125
RT_STRING	0x210df0	0x44	data	Chinese	China	0.6764705882352942
RT_STRING	0x210e34	0x68	data	Chinese	China	0.7019230769230769
RT_STRING	0x210e9c	0x1b2	data	Chinese	China	0.6474654377880185
RT_STRING	0x211050	0xf4	data	Chinese	China	0.6065573770491803
RT_STRING	0x211144	0x24	data	Chinese	China	0.4722222222222222
RT_STRING	0x211168	0x1a8	data	Chinese	China	0.6674528301886793
RT_ACCELERATOR	0x211310	0x58	data	Chinese	China	0.7727272727272727
RT_GROUP_CURSOR	0x211368	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	0.9705882352941176
RT_GROUP_CURSOR	0x21138c	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2113b0	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2113d4	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x2113f8	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_CURSOR	0x21141c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x211430	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x211444	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x211458	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x21146c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x211480	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x211494	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2114a8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2114bc	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2114d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2114e4	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x2114f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x21150c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_GROUP_CURSOR	0x211520	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.3
RT_VERSION	0x211534	0x2b4	data	Chinese	China	0.4884393063583815
None	0x2117e8	0x16	data	Chinese	China	1.3181818181818181

Imports

DLL	Import
KERNEL32.dll	AcquireSRWLockExclusive, CloseHandle, CompareStringW, CopyFileA, CopyFileW, CreateFileW, CreateProcessA, CreateThread, CreateToolhelp32Snapshot, DecodePointer, DeleteCriticalSection, DeleteFileA, DeleteFileW, DuplicateHandle, EncodePointer, EnterCriticalSection, EnumSystemLocalesW, ExitProcess, ExitThread, FileTimeToLocalFileTime, FileTimeToSystemTime, FindClose, FindFirstFileExW, FindFirstFileW, FindNextFileW, FindResourceExW, FindResourceW, FlushFileBuffers, FormatMessageW, FreeEnvironmentStringsW, FreeLibrary, FreeLibraryAndExitThread, FreeResource, GetACP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetConsoleCP, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetEnvironmentStringsW, GetFileAttributesA, GetFileAttributesExW, GetFileAttributesW, GetFileSize, GetFileSizeEx, GetFileTime, GetFileType, GetFullPathNameW, GetLastError, GetLocaleInfoW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetNumberOfConsoleInputEvents, GetOEMCP, GetPrivateProfileIntW, GetPrivateProfileStringW, GetProcAddress, GetProcessHeap, GetProfileIntW, GetStartupInfoW, GetStdHandle, GetStringTypeW, GetSystemDefaultUILanguage, GetSystemDirectoryW, GetSystemInfo, GetSystemTimeAsFileTime, GetTempFileNameW, GetTempPathA, GetTempPathW, GetTickCount64, GetTimeZoneInformation, GetUserDefaultLCID, GetUserDefaultUILanguage, GetVersionExW, GetVolumeInformationW, GetWindowsDirectoryW, GlobalAddAtomW, GlobalAlloc, GlobalDeleteAtom, GlobalFindAtomW, GlobalFlags, GlobalFree, GlobalGetAtomNameW, GlobalHandle, GlobalLock, GlobalReAlloc, GlobalSize, GlobalUnlock, HeapAlloc, HeapDestroy, HeapFree, HeapQueryInformation, HeapReAlloc, HeapSize, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeCriticalSectionEx, InitializeSListHead, InterlockedFlushSList, IsDebuggerPresent, IsProcessorFeaturePresent, IsValidCodePage, IsValidLocale, LCMapStringEx, LCMapStringW, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadLibraryW, LoadResource, LocalAlloc, LocalFree, LocalReAlloc, LockFile, LockResource, MulDiv, MultiByteToWideChar, OpenProcess, OpenThread, OutputDebugStringA, OutputDebugStringW, PeekConsoleInputA, Process32FirstW, Process32NextW, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReadConsoleInputW, ReadConsoleW, ReadFile, ReleaseSRWLockExclusive, ResumeThread, RtlUnwind, SearchPathW, SetConsoleMode, SetEndOfFile, SetEnvironmentVariableW, SetFilePointer, SetFilePointerEx, SetLastError, SetStdHandle, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, SleepConditionVariableSRW, SuspendThread, SystemTimeToTzSpecificLocalTime, TerminateProcess, Thread32First, Thread32Next, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, UnlockFile, VerSetConditionMask, VerifyVersionInfoW, VirtualAlloc, VirtualProtect, VirtualQuery, WaitForSingleObject, WakeAllConditionVariable, WideCharToMultiByte, WinExec, WriteConsoleW, WriteFile, WritePrivateProfileStringW, lstrcmpA, lstrcmpW, lstrcmpiW, lstrcpyW
USER32.dll	AdjustWindowRectEx, AppendMenuW, BeginDeferWindowPos, BeginPaint, BringWindowToTop, CallNextHookEx, CallWindowProcW, CharUpperBuffW, CharUpperW, CheckDlgButton, CheckMenuItem, ClientToScreen, CloseClipboard, CopyAcceleratorTableW, CopyIcon, CopyImage, CopyRect, CreateAcceleratorTableW, CreateDialogIndirectParamW, CreateMenu, CreatePopupMenu, CreateWindowExW, DefFrameProcW, DefMDIChildProcW, DefWindowProcW, DeferWindowPos, DeleteMenu, DestroyAcceleratorTable, DestroyCursor, DestroyIcon, DestroyMenu, DestroyWindow, DispatchMessageW, DrawEdge, DrawFocusRect, DrawFrameControl, DrawIcon, DrawIconEx, DrawMenuBar, DrawStateW, DrawTextExW, DrawTextW, EmptyClipboard, EnableMenuItem, EnableScrollBar, EnableWindow, EndDeferWindowPos, EndDialog, EndPaint, EnumDisplayMonitors, EqualRect, FillRect, FrameRect, GetActiveWindow, GetAsyncKeyState, GetCapture, GetClassInfoExW, GetClassInfoW, GetClassLongW, GetClassNameW, GetClientRect, GetComboBoxInfo, GetCursorPos, GetDC, GetDCEx, GetDesktopWindow, GetDlgCtrlID, GetDlgItem, GetDoubleClickTime, GetFocus, GetForegroundWindow, GetIconInfo, GetKeyNameTextW, GetKeyState, GetKeyboardLayout, GetKeyboardState, GetLastActivePopup, GetMenu, GetMenuCheckMarkDimensions, GetMenuDefaultItem, GetMenuItemCount, GetMenuItemID, GetMenuItemInfoW, GetMenuState, GetMenuStringW, GetMessagePos, GetMessageTime, GetMessageW, GetMonitorInfoW, GetNextDlgGroupItem, GetNextDlgTabItem, GetParent, GetPropW, GetScrollInfo, GetScrollPos, GetScrollRange, GetSubMenu, GetSysColor, GetSysColorBrush, GetSystemMenu, GetSystemMetrics, GetTopWindow, GetUpdateRect, GetWindow, GetWindowDC, GetWindowLongW, GetWindowPlacement, GetWindowRect, GetWindowRgn, GetWindowTextLengthW, GetWindowTextW, GetWindowThreadProcessId, GrayStringW, HideCaret, InflateRect, InsertMenuItemW, InsertMenuW, IntersectRect, InvalidateRect, InvertRect, IsCharLowerW, IsChild, IsClipboardFormatAvailable, IsDialogMessageW, IsIconic, IsMenu, IsRectEmpty, IsWindow, IsWindowEnabled, IsWindowVisible, IsZoomed, KillTimer, LoadAcceleratorsW, LoadBitmapW, LoadCursorW, LoadIconW, LoadImageW, LoadMenuW, LockWindowUpdate, MapDialogRect, MapVirtualKeyExW, MapVirtualKeyW, MapWindowPoints, MessageBeep, MessageBoxW, ModifyMenuW, MonitorFromPoint, MonitorFromWindow, MoveWindow, NotifyWinEvent, OffsetRect, OpenClipboard, PeekMessageW, PostMessageW, PostQuitMessage, PostThreadMessageW, PtInRect, RealChildWindowFromPoint, RedrawWindow, RegisterClassW, RegisterClipboardFormatW, RegisterWindowMessageW, ReleaseCapture, ReleaseDC, RemoveMenu, RemovePropW, ReuseDDElParam, ScreenToClient, ScrollWindow, SendDlgItemMessageA, SendMessageW, SetActiveWindow, SetCapture, SetClassLongW, SetClipboardData, SetCursor, SetCursorPos, SetFocus, SetForegroundWindow, SetLayeredWindowAttributes, SetMenu, SetMenuDefaultItem, SetMenuItemBitmaps, SetMenuItemInfoW, SetParent, SetPropW, SetRect, SetRectEmpty, SetScrollInfo, SetScrollPos, SetScrollRange, SetTimer, SetWindowLongW, SetWindowPlacement, SetWindowPos, SetWindowRgn, SetWindowTextW, SetWindowsHookExW, ShowOwnedPopups, ShowScrollBar, ShowWindow, SubtractRect, SystemParametersInfoW, TabbedTextOutW, ToUnicodeEx, TrackMouseEvent, TrackPopupMenu, TranslateAcceleratorW, TranslateMDISysAccel, TranslateMessage, UnhookWindowsHookEx, UnionRect, UnpackDDElParam, UnregisterClassW, UpdateLayeredWindow, UpdateWindow, ValidateRect, WaitMessage, WinHelpW, WindowFromPoint
GDI32.dll	BitBlt, CombineRgn, CopyMetaFileW, CreateBitmap, CreateCompatibleBitmap, CreateCompatibleDC, CreateDCW, CreateDIBSection, CreateDIBitmap, CreateEllipticRgn, CreateFontIndirectW, CreateFontW, CreateHatchBrush, CreatePalette, CreatePatternBrush, CreatePen, CreatePolygonRgn, CreateRectRgn, CreateRectRgnIndirect, CreateRoundRectRgn, CreateSolidBrush, DPtoLP, DeleteDC, DeleteObject, Ellipse, EnumFontFamiliesExW, EnumFontFamiliesW, Escape, ExcludeClipRect, ExtFloodFill, ExtSelectClipRgn, ExtTextOutW, FillRgn, FrameRgn, GetBkColor, GetBoundsRect, GetCharWidthW, GetClipBox, GetDeviceCaps, GetLayout, GetNearestPaletteIndex, GetObjectType, GetObjectW, GetPaletteEntries, GetPixel, GetRgnBox, GetStockObject, GetSystemPaletteEntries, GetTextCharsetInfo, GetTextColor, GetTextExtentPoint32W, GetTextFaceW, GetTextMetricsW, GetViewportExtEx, GetViewportOrgEx, GetWindowExtEx, GetWindowOrgEx, IntersectClipRect, LPtoDP, LineTo, MoveToEx, OffsetRgn, OffsetViewportOrgEx, OffsetWindowOrgEx, PatBlt, Polygon, Polyline, PtInRegion, PtVisible, RealizePalette, RectVisible, Rectangle, RestoreDC, RoundRect, SaveDC, ScaleViewportExtEx, ScaleWindowExtEx, SelectClipRgn, SelectObject, SelectPalette, SetBkColor, SetBkMode, SetDIBColorTable, SetLayout, SetMapMode, SetPaletteEntries, SetPixel, SetPixelV, SetPolyFillMode, SetROP2, SetRectRgn, SetTextAlign, SetTextColor, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, StretchBlt, StretchDIBits, TextOutW
ADVAPI32.dll	CryptAcquireContextW, CryptCreateHash, CryptDecrypt, CryptDestroyHash, CryptDestroyKey, CryptGetHashParam, CryptHashData, CryptImportKey, CryptReleaseContext, CryptSetKeyParam, RegCloseKey, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyExW, RegEnumKeyW, RegEnumValueW, RegOpenKeyExW, RegQueryValueExW, RegQueryValueW, RegSetValueExW
SHELL32.dll	DragFinish, DragQueryFileW, SHAppBarMessage, SHBrowseForFolderW, SHGetDesktopFolder, SHGetFileInfoW, SHGetFolderPathA, SHGetPathFromIDListW, SHGetSpecialFolderLocation, ShellExecuteW
ole32.dll	CoCreateGuid, CoCreateInstance, CoDisconnectObject, CoInitialize, CoInitializeEx, CoLockObjectExternal, CoTaskMemAlloc, CoTaskMemFree, CoUninitialize, CreateStreamOnHGlobal, DoDragDrop, IsAccelerator, OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleDuplicateData, OleGetClipboard, OleLockRunning, OleTranslateAccelerator, RegisterDragDrop, ReleaseStgMedium, RevokeDragDrop
gdiplus.dll	GdipAlloc, GdipBitmapLockBits, GdipBitmapUnlockBits, GdipCloneImage, GdipCreateBitmapFromHBITMAP, GdipCreateBitmapFromScan0, GdipCreateBitmapFromStream, GdipCreateFromHDC, GdipDeleteGraphics, GdipDisposeImage, GdipDrawImageI, GdipDrawImageRectI, GdipFree, GdipGetImageGraphicsContext, GdipGetImageHeight, GdipGetImagePalette, GdipGetImagePaletteSize, GdipGetImagePixelFormat, GdipGetImageWidth, GdipSetInterpolationMode, GdiplusShutdown, GdiplusStartup
CRYPT32.dll	CryptStringToBinaryA
WS2_32.dll	WSACleanup, WSAStartup, closesocket, connect, freeaddrinfo, getaddrinfo, recv, socket
UxTheme.dll	CloseThemeData, DrawThemeBackground, DrawThemeParentBackground, DrawThemeText, GetCurrentThemeName, GetThemeColor, GetThemePartSize, GetThemeSysColor, GetWindowTheme, IsAppThemed, IsThemeBackgroundPartiallyTransparent, OpenThemeData
OLEAUT32.dll	LoadTypeLib, SysAllocString, SysAllocStringLen, SysFreeString, SysStringLen, SystemTimeToVariantTime, VarBstrFromDate, VariantChangeType, VariantClear, VariantCopy, VariantInit, VariantTimeToSystemTime
SHLWAPI.dll	PathFindExtensionW, PathFindFileNameW, PathIsUNCW, PathRemoveFileSpecW, PathStripToRootW, StrFormatKBSizeW
WINSPOOL.DRV	ClosePrinter, DocumentPropertiesW, OpenPrinterW
OLEACC.dll	AccessibleObjectFromWindow, CreateStdAccessibleObject, LresultFromObject
MSIMG32.dll	AlphaBlend, TransparentBlt
IMM32.dll	ImmGetContext, ImmGetOpenStatus, ImmReleaseContext
WINMM.dll	PlaySoundW

Exports

Name	Ordinal	Address
SteamAPI_Init	1	0x1002a760

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 18:13:58.212939024 CET	1.1.1.1	192.168.2.9	0x7b90	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 18:13:58.212939024 CET	1.1.1.1	192.168.2.9	0x7b90	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	12:14:01
Start date:	17/12/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\nsdksetup.dll"
Imagebase:	0x780000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:14:01
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:14:01
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:14:01
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\nsdksetup.dll,SteamAPI_Init
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:14:01
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",#1
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:14:04
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\nsdksetup.dll",SteamAPI_Init
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:15:11
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:15:11
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /B /c "C:\Users\user\AppData\Local\Temp\\monitor.bat"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Analysis Process: conhost.exePID: 8104, Parent PID: 8084

General

Target ID:	12
Start time:	12:15:11
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	12:15:11
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:15:11
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "IMAGENAME eq rundll32.exe"
Imagebase:	0x310000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:15:11
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "rundll32.exe"
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:15:11
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "IMAGENAME eq rundll32.exe"
Imagebase:	0x310000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:15:11
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "rundll32.exe"
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:15:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 30 /nobreak
Imagebase:	0x8e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:15:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 30 /nobreak
Imagebase:	0x8e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:15:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "IMAGENAME eq rundll32.exe"
Imagebase:	0x310000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:15:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "rundll32.exe"
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:15:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "IMAGENAME eq rundll32.exe"
Imagebase:	0x310000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:15:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "rundll32.exe"
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:15:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe"
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:15:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 30 /nobreak
Imagebase:	0x8e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:15:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe"
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: timeout.exePID: 6536, Parent PID: 8084

General

Target ID:	27
Start time:	12:15:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 30 /nobreak
Imagebase:	0x8e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:16:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "IMAGENAME eq rundll32.exe"
Imagebase:	0x310000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:16:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "rundll32.exe"
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:16:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "IMAGENAME eq rundll32.exe"
Imagebase:	0x310000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:16:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "rundll32.exe"
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:16:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe"
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: timeout.exePID: 1524, Parent PID: 8092

General

Target ID:	34
Start time:	12:16:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 30 /nobreak
Imagebase:	0x8e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:16:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe"
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: timeout.exePID: 3236, Parent PID: 8084

General

Target ID:	36
Start time:	12:16:12
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 30 /nobreak
Imagebase:	0x8e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:16:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "IMAGENAME eq rundll32.exe"
Imagebase:	0x310000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:16:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "rundll32.exe"
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:16:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist /FI "IMAGENAME eq rundll32.exe"
Imagebase:	0x310000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	12:16:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "rundll32.exe"
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	12:16:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe"
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: timeout.exePID: 6896, Parent PID: 8084

General

Target ID:	42
Start time:	12:16:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 30 /nobreak
Imagebase:	0x8e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	12:16:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe"
Imagebase:	0x320000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: timeout.exePID: 4944, Parent PID: 8092

General

Target ID:	44
Start time:	12:16:42
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 30 /nobreak
Imagebase:	0x8e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	1534
Total number of Limit Nodes:	49

Executed Functions

Function 6D038080 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 274
networkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 6D0380AF
getaddrinfo.WS2_32 ref: 6D0381A9
WSACleanup.WS2_32 ref: 6D0381D3
socket.WS2_32 ref: 6D03827F
WSACleanup.WS2_32 ref: 6D03829A
connect.WS2_32 ref: 6D0382EB
closesocket.WS2_32 ref: 6D03830F
freeaddrinfo.WS2_32 ref: 6D038361
WSACleanup.WS2_32 ref: 6D038384
recv.WS2_32 ref: 6D0383EC
closesocket.WS2_32 ref: 6D0384EB
WSACleanup.WS2_32 ref: 6D0384F4
VirtualAlloc.KERNEL32 ref: 6D03857E

Strings

@, xrefs: 6D038576
, xrefs: 6D0380CB

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Cleanup$closesocket$AllocStartupVirtualconnectfreeaddrinfogetaddrinforecvsocket
String ID: $@
API String ID: 1138076629-1077428164
Opcode ID: 7d25c8bc42e3ff83314e87224f0177a3459532ae77ac8c0fdb5699ae745a34ee
Instruction ID: ccb2de90c526114c848e65d96e7d6b6a9bcd8fdc9075ecdac8650644cf8ba4d1
Opcode Fuzzy Hash: 7d25c8bc42e3ff83314e87224f0177a3459532ae77ac8c0fdb5699ae745a34ee
Instruction Fuzzy Hash: C7D106B49082298FDB14DF68D9887AEBBF1BB4A314F4185E9D5A8D7340DB349A84CF41

Function 6D03A5E0 Relevance: 12.1, APIs: 8, Instructions: 108
threadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?), ref: 6D03A5FA
CreateToolhelp32Snapshot.KERNEL32 ref: 6D03A617
Thread32First.KERNEL32 ref: 6D03A656
GetCurrentThreadId.KERNEL32 ref: 6D03A697
OpenThread.KERNEL32 ref: 6D03A6D1
Wow64SuspendThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03A6E9
Thread32Next.KERNEL32 ref: 6D03A711
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D03A745

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Thread$CurrentThread32$CloseCreateFirstHandleNextOpenProcessSnapshotSuspendToolhelp32Wow64
String ID:
API String ID: 117601545-0
Opcode ID: 74057fd4db325af6857787e44c3fc0af93009902709159b92f8ccbd74d50769e
Instruction ID: cc46f90bdef406b5a41079c50077d3e563963e2e1998fc195de00316498e3fe8
Opcode Fuzzy Hash: 74057fd4db325af6857787e44c3fc0af93009902709159b92f8ccbd74d50769e
Instruction Fuzzy Hash: 6841CDB4E0821ADFDF04EFA8D584AADBBF1FB09300F11856AE855E7350E734A940CB52

Function 6D0495C5 Relevance: 6.1, APIs: 4, Instructions: 121
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0495CF

Part of subcall function 6D0583E0: __EH_prolog3.LIBCMT ref: 6D0583E7

GetCurrentThread.KERNEL32 ref: 6D04962E
GetCurrentThreadId.KERNEL32 ref: 6D049637
GetVersionExW.KERNEL32 ref: 6D0496D3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CurrentThread$H_prolog3H_prolog3_Version
String ID:
API String ID: 786120064-0
Opcode ID: f4994bc9680ccb54cad0a0d8114c636fbe69f9f5c00c43e11ec9180e1fcd8838
Instruction ID: a5210ba352bdcab68e9f64333f9f2155d2e2b9f5aa7888fa25a283986b442b4d
Opcode Fuzzy Hash: f4994bc9680ccb54cad0a0d8114c636fbe69f9f5c00c43e11ec9180e1fcd8838
Instruction Fuzzy Hash: 0D51E2B4904B05CFE7218F2A9A84B9AFBF1BB49714F51897ED5AE87700DB70A840CF40

Function 6D05E9FA Relevance: 54.5, APIs: 26, Strings: 5, Instructions: 278
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteObject.GDI32(00000000), ref: 6D05EA0C
DeleteObject.GDI32(00000000), ref: 6D05EA2A
DeleteObject.GDI32(00000000), ref: 6D05EA48
DeleteObject.GDI32(00000000), ref: 6D05EA66
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 6D05EA9E
lstrcpyW.KERNEL32(?,?), ref: 6D05EAF3
EnumFontFamiliesW.GDI32(?,00000000,6D05F57F,Segoe UI), ref: 6D05EB1A
lstrcpyW.KERNEL32(?,Segoe UI), ref: 6D05EB2D
EnumFontFamiliesW.GDI32(?,00000000,6D05F57F,Tahoma), ref: 6D05EB4B
lstrcpyW.KERNEL32(?,MS Sans Serif), ref: 6D05EB65
CreateFontIndirectW.GDI32(?), ref: 6D05EB6F
CreateFontIndirectW.GDI32(?), ref: 6D05EBB7
CreateFontIndirectW.GDI32(?), ref: 6D05EBF6
CreateFontIndirectW.GDI32(?), ref: 6D05EC22
CreateFontIndirectW.GDI32(?), ref: 6D05EC43
GetSystemMetrics.USER32(00000048), ref: 6D05EC62
lstrcpyW.KERNEL32(?,Marlett), ref: 6D05EC75
CreateFontIndirectW.GDI32(?), ref: 6D05EC7F
GetStockObject.GDI32(00000011), ref: 6D05ECAB
GetObjectW.GDI32(00000000,0000005C,?), ref: 6D05ECC6
lstrcpyW.KERNEL32(?,Arial), ref: 6D05ED07
CreateFontIndirectW.GDI32(?), ref: 6D05ED11
CreateFontIndirectW.GDI32(?), ref: 6D05ED2A
GetObjectW.GDI32(?,0000005C,?), ref: 6D05ED48
CreateFontIndirectW.GDI32(?), ref: 6D05ED56
CreateFontIndirectW.GDI32(?), ref: 6D05ED77

Part of subcall function 6D05F3C4: __EH_prolog3_GS.LIBCMT ref: 6D05F3CB
Part of subcall function 6D05F3C4: GetTextMetricsW.GDI32(?,?), ref: 6D05F400
Part of subcall function 6D05F3C4: GetTextMetricsW.GDI32(?,?), ref: 6D05F440

Strings

Segoe UI, xrefs: 6D05EB08, 6D05EB24
Tahoma, xrefs: 6D05EB39, 6D05EB58
Marlett, xrefs: 6D05EC6F
Arial, xrefs: 6D05ECF7
MS Sans Serif, xrefs: 6D05EB5F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Font$CreateIndirect$Object$lstrcpy$Delete$MetricsText$EnumFamilies$CharsetH_prolog3_InfoStockSystem
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 511603829-1395034203
Opcode ID: 171cc460c52e47fdd4a87e04cc13ac211045ef5f7b24b952c0d7205d847ef3a5
Instruction ID: 8ac5fed0cdecf705fa4e46fa5fadd4e9944fdb4e0d75faea56ee027528b677b3
Opcode Fuzzy Hash: 171cc460c52e47fdd4a87e04cc13ac211045ef5f7b24b952c0d7205d847ef3a5
Instruction Fuzzy Hash: 33C16971904749DBEF11DBB0D988BEEBBF9AF09304F00806AE65AE7241EBB49544CF50

Function 6D032110 Relevance: 16.7, APIs: 3, Strings: 6, Instructions: 927
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D0320A0: GetModuleFileNameA.KERNEL32 ref: 6D0320D3

Part of subcall function 6D031F60: SHGetFolderPathA.SHELL32 ref: 6D031FBB

Sleep.KERNEL32 ref: 6D032638
WinExec.KERNEL32 ref: 6D0330DB
Sleep.KERNEL32 ref: 6D0330EB

Part of subcall function 6D032040: DeleteFileA.KERNEL32(?,?,?,?,6D033107), ref: 6D032055

Strings

cmd.exe /C , xrefs: 6D032F98
cmd.exe /C , xrefs: 6D032D86
L, xrefs: 6D032686
X, xrefs: 6D032678
#, xrefs: 6D032B58
M, xrefs: 6D03267F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: FileSleep$DeleteExecFolderModuleNamePath
String ID: #$L$M$X$cmd.exe /C $cmd.exe /C
API String ID: 1259611965-3173768389
Opcode ID: 11464564006b40b4e2ccaad511a19543f6b7e933b689f979dfcccfcfa627c990
Instruction ID: 880ea3aeedd682960dbd5e68beac5dccd60a1f81cbaf875951fe37dcb2935c68
Opcode Fuzzy Hash: 11464564006b40b4e2ccaad511a19543f6b7e933b689f979dfcccfcfa627c990
Instruction Fuzzy Hash: 53A23A75D082698AEB25DF64DC54BDCBBB0BF15304F0282EAC45967391EB705B88CF92

Function 6D0653DD Relevance: 15.1, APIs: 10, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6D054910,?,6D049485,?,6D053DD0), ref: 6D0653EE
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,?,?,?,?,?,6D054910,?,6D049485,?,6D053DD0), ref: 6D065460
GlobalHandle.KERNEL32(6D011B41), ref: 6D06546A
GlobalUnlock.KERNEL32(00000000), ref: 6D06547C
GlobalReAlloc.KERNEL32(?,00000000), ref: 6D065497
GlobalLock.KERNEL32(00000000), ref: 6D0654A2
LeaveCriticalSection.KERNEL32(?), ref: 6D0654EF
GlobalHandle.KERNEL32(6D011B41), ref: 6D065503
GlobalLock.KERNEL32(00000000), ref: 6D06550E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6D054910,?,6D049485,?,6D053DD0,FDA68A44), ref: 6D06551D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 18f87b79cbe3f317deffd4c41bd6988c978cf0405877bfd1c33c03756a12085d
Instruction ID: 1287ce928f98bd07d5e14f6728e78de473ab7ebb64bb5c57a8840126e76d29fe
Opcode Fuzzy Hash: 18f87b79cbe3f317deffd4c41bd6988c978cf0405877bfd1c33c03756a12085d
Instruction Fuzzy Hash: E041D375600656EFEB14CF68D88DB69BBF9FF41309F1081A9E851D7141EB70E950CBA0

Function 6D1A8D6E Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D1A9173: CreateFileW.KERNEL32(6D02A690,00000000,?,6D1A8E17,?,?,00000000,?,6D1A8E17,6D02A690,0000000C), ref: 6D1A9190

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1A8E82
__dosmaperr.LIBCMT ref: 6D1A8E89
GetFileType.KERNEL32(00000000), ref: 6D1A8E95
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D1A8E9F
__dosmaperr.LIBCMT ref: 6D1A8EA8
CloseHandle.KERNEL32(00000000), ref: 6D1A8EC8
CloseHandle.KERNEL32(6D19FE6C), ref: 6D1A9015
GetLastError.KERNEL32 ref: 6D1A9047
__dosmaperr.LIBCMT ref: 6D1A904E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: ec690f2dffbab2ebe7e21342e1bcff3a47ad032d89390d56f90756793eb1c475
Instruction ID: f31bd837a14979c6dc85015656c3443d37eacd65bd55c7f4e56ab800720ca064
Opcode Fuzzy Hash: ec690f2dffbab2ebe7e21342e1bcff3a47ad032d89390d56f90756793eb1c475
Instruction Fuzzy Hash: 04A16736A181959FCF09CF68DC51BAE3BB1EB06324F190149E911EF395CBB58842CB81

Function 6D03A760 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 216
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6D03A5E0: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?), ref: 6D03A5FA
Part of subcall function 6D03A5E0: CreateToolhelp32Snapshot.KERNEL32 ref: 6D03A617

Part of subcall function 6D03A140: GetModuleFileNameA.KERNEL32 ref: 6D03A19C

CreateThread.KERNEL32 ref: 6D03A923
CreateThread.KERNEL32 ref: 6D03A95F
WaitForSingleObject.KERNEL32 ref: 6D03A98C

Part of subcall function 6D03A320: GetModuleFileNameA.KERNEL32 ref: 6D03A37C

Part of subcall function 6D03A0D0: GetModuleFileNameA.KERNEL32 ref: 6D03A108

Part of subcall function 6D03A4F0: GetModuleHandleA.KERNEL32 ref: 6D03A536

Part of subcall function 6D024950: GetTempPathA.KERNELBASE ref: 6D0249BB

Part of subcall function 6D0394D0: GetModuleHandleA.KERNEL32 ref: 6D0394DF
Part of subcall function 6D0394D0: FindResourceW.KERNEL32 ref: 6D03953E
Part of subcall function 6D0394D0: LoadResource.KERNEL32 ref: 6D039561
Part of subcall function 6D0394D0: SizeofResource.KERNEL32 ref: 6D03957A
Part of subcall function 6D0394D0: LockResource.KERNEL32 ref: 6D039592

CreateThread.KERNEL32 ref: 6D03AAFD

Part of subcall function 6D038080: WSAStartup.WS2_32 ref: 6D0380AF
Part of subcall function 6D038080: getaddrinfo.WS2_32 ref: 6D0381A9
Part of subcall function 6D038080: WSACleanup.WS2_32 ref: 6D0381D3
Part of subcall function 6D038080: freeaddrinfo.WS2_32 ref: 6D038361
Part of subcall function 6D038080: WSACleanup.WS2_32 ref: 6D038384

Strings

IOVAS, xrefs: 6D03A7CA
steam_api.dll, xrefs: 6D03AA42

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Module$CreateResource$FileNameThread$CleanupHandle$CurrentFindLoadLockObjectPathProcessSingleSizeofSnapshotStartupTempToolhelp32Waitfreeaddrinfogetaddrinfo
String ID: IOVAS$steam_api.dll
API String ID: 1760606021-233352217
Opcode ID: 46f050a870fd98052d055f216ea382e2fc7b5baf189a58676202d296f62dab7b
Instruction ID: 3baebf0beff7d95e8a71829797e720cfb08d7a5c197c2641ab74c32a0cd24393
Opcode Fuzzy Hash: 46f050a870fd98052d055f216ea382e2fc7b5baf189a58676202d296f62dab7b
Instruction Fuzzy Hash: 98A139B09083298FEB14DF64D859BAEBBB0FF05304F42849DD5599B390DB749A48CF92

Function 6D19B9AD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,FDA68A44,?,6D19BABC,?,?,00000000), ref: 6D19BA6E

Strings

api-ms-, xrefs: 6D19BA04
ext-ms-, xrefs: 6D19BA18

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 7008a6748f12d082ac3516c2f78df793206078e70ec8190f531f81eb8c297ffb
Instruction ID: 5021cec6b3cbb15336fb2f8bd3e0a7809f9860eb895af6c3cd40ac70e07312f6
Opcode Fuzzy Hash: 7008a6748f12d082ac3516c2f78df793206078e70ec8190f531f81eb8c297ffb
Instruction Fuzzy Hash: D7212732A01212FBCB128A65DDC4B6E37B9AB53764F114111E912AB288DBF0ED01C6E0

Function 6D0C1022 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 6D0C1029

Part of subcall function 6D0634A0: EnterCriticalSection.KERNEL32(6D2183D0,?,?,0000007C,?,6D04F858,00000001), ref: 6D0634D1
Part of subcall function 6D0634A0: InitializeCriticalSection.KERNEL32(00000000,?,6D04F858,00000001), ref: 6D0634E7
Part of subcall function 6D0634A0: LeaveCriticalSection.KERNEL32(6D2183D0,?,6D04F858,00000001), ref: 6D0634F5
Part of subcall function 6D0634A0: EnterCriticalSection.KERNEL32(00000000,?,0000007C,?,6D04F858,00000001), ref: 6D063502

GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 6D0C107C
GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 6D0C1092

Strings

windows, xrefs: 6D0C1076, 6D0C107B, 6D0C108C
DragMinDist, xrefs: 6D0C1071
DragDelay, xrefs: 6D0C1087

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: e7c1443aa74a04829a8473bbdf068fcbdb8eb87ca3254becc96324c8c5bf7edc
Instruction ID: 4152985bc10812c3c7241fe2f5c6ded9ff8e837729bcf2d6c0b8ebf0e02ab354
Opcode Fuzzy Hash: e7c1443aa74a04829a8473bbdf068fcbdb8eb87ca3254becc96324c8c5bf7edc
Instruction Fuzzy Hash: 930171B0D447008FEB50DF758A49B1A7AF0BB09708F40492EE259D7644D7F8AA00CF56

Function 6D024950 Relevance: 9.6, APIs: 6, Instructions: 609
fileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNELBASE ref: 6D0249BB
CopyFileA.KERNEL32 ref: 6D024FA3
CopyFileA.KERNEL32 ref: 6D02509E
CreateProcessA.KERNEL32 ref: 6D0252ED

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CopyFile$CreatePathProcessTemp
String ID:
API String ID: 568041017-0
Opcode ID: 3675f152a17db664aee064ae2cd046ed276e2c2976614f86b1aed740b736603b
Instruction ID: e1e1cf4edc8c37291e7956c1cb84302f32a39e4cdaeda978b443d7e0c50f18db
Opcode Fuzzy Hash: 3675f152a17db664aee064ae2cd046ed276e2c2976614f86b1aed740b736603b
Instruction Fuzzy Hash: 2C526DB411AB00CFE355DF68D84879ABBF0BF59308F82881DD59B8B364DB70A548CB56

Function 6D182088 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6D1820C5
dllmain_crt_dispatch.LIBCMT ref: 6D1820DC
dllmain_raw.LIBCMT ref: 6D182124
dllmain_crt_dispatch.LIBCMT ref: 6D182137
dllmain_raw.LIBCMT ref: 6D18214A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 939220bfee3ab9c5c1dac4741de15f7fa5e0a04f1824704d64d9913c7ab3ba33
Instruction ID: d844a0613862e632ef217e8d20b9b009bdfcc1a39f4a2a0e5cd746c6523ad4d7
Opcode Fuzzy Hash: 939220bfee3ab9c5c1dac4741de15f7fa5e0a04f1824704d64d9913c7ab3ba33
Instruction Fuzzy Hash: 7721A0B190825AAEDB33CF54CC40B7F3A79EB91B95F124015FA2467219C7B18D02CFA0

Function 6D05A7B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Shell32,00000000,?,6D03CECA), ref: 6D05A7BC
GetProcAddress.KERNEL32(00000000,SetCurrentProcessExplicitAppUserModelID), ref: 6D05A7CD

Strings

SetCurrentProcessExplicitAppUserModelID, xrefs: 6D05A7C7
Shell32, xrefs: 6D05A7B5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetCurrentProcessExplicitAppUserModelID$Shell32
API String ID: 1646373207-2658420654
Opcode ID: 90356a3017a270f7b031b00869ca0a8d071d645eca0dbb601d7eae06e0468ea3
Instruction ID: c0ab12c4596d752557301187668fd63b753166ec3a706ffd3f5001d107d8a6f5
Opcode Fuzzy Hash: 90356a3017a270f7b031b00869ca0a8d071d645eca0dbb601d7eae06e0468ea3
Instruction Fuzzy Hash: D4E04F3170065A67DB145B75AC5CF6B7FFDDAC56A1300442AF915C3204DFA0E815C6E4

Function 6D0299B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D0299ED

Part of subcall function 6D019C10: std::_Lockit::_Lockit.LIBCPMT ref: 6D019C3C
Part of subcall function 6D019C10: std::_Lockit::~_Lockit.LIBCPMT ref: 6D019C82

std::_Lockit::~_Lockit.LIBCPMT ref: 6D029AE9

Strings

`^!m, xrefs: 6D0299FD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: `^!m
API String ID: 593203224-3285984163
Opcode ID: 22520a0f8b87183fee5734fcaf33603763e4fce472e9614186831fe766aa29f7
Instruction ID: 47f453167318a107337b9b31ad1666e095f4dd00f2a89fdf7afcb0970b9e6c72
Opcode Fuzzy Hash: 22520a0f8b87183fee5734fcaf33603763e4fce472e9614186831fe766aa29f7
Instruction Fuzzy Hash: 3441E574E55218DFDB05DFA8E981BDDBBF0BB09314F108169E912A7350D730A904CFA1

Function 6D18F9D6 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,6D18FA98,6D1946D4,6D1946D4,?,00000002,FDA68A44,6D1946D4,00000002), ref: 6D18F9E7
TerminateProcess.KERNEL32(00000000,?,6D18FA98,6D1946D4,6D1946D4,?,00000002,FDA68A44,6D1946D4,00000002), ref: 6D18F9EE
ExitProcess.KERNEL32 ref: 6D18FA00

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1cbd7ebb8c22e47c5718df8a1fc39c71eba453360382912fb94571ba844a9d37
Instruction ID: aafd2751ea3af094ad482bc72c97e7a34fcb23aababba9a60175f41b5d14e7d9
Opcode Fuzzy Hash: 1cbd7ebb8c22e47c5718df8a1fc39c71eba453360382912fb94571ba844a9d37
Instruction Fuzzy Hash: C7D09E32804109BBCF016F61E84CA997FBAEF41649B515110B96956025CFB19996EF80

Function 6D031F60 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32 ref: 6D031FBB

Strings

Error retrieving folder path, xrefs: 6D031FE6

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: FolderPath
String ID: Error retrieving folder path
API String ID: 1514166925-3197305068
Opcode ID: 5a69d394ef2b8f40e4ff6dbc3bc34a255adc4361917e405a460cd288b284b63a
Instruction ID: 056f47a426943695d15f0acf72e67f00e75b8d04d383b3e9aa9431deb6805587
Opcode Fuzzy Hash: 5a69d394ef2b8f40e4ff6dbc3bc34a255adc4361917e405a460cd288b284b63a
Instruction Fuzzy Hash: 5621D8B0D0420ADFDF00EFA8D5957AEBBF4FB49304F518829D454A7344E774AA48CB92

Function 6D1A1A3A Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1A1DE4: GetConsoleOutputCP.KERNEL32(FDA68A44,00000000,00000000,?), ref: 6D1A1E47

WriteFile.KERNEL32(?,6D19FE6C,00000000,6D1AA567,00000000,6D19FE6C,00000000,00000000,?,6D1AA567,00000000,00000000,6D1AA4A4,6D19FE6C,00000000,?), ref: 6D1A1BBF
GetLastError.KERNEL32(?,6D1AA567,00000000,00000000,6D1AA4A4,6D19FE6C,00000000,?,6D1A9408,00000000,6D19FE6C), ref: 6D1A1BC9

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 2207eb659941c484f799fad136cf50fe1ce49fd73e046d1b68f37f9609ba5877
Instruction ID: 8a8aaa038cf0fedb1fa1505143e7037ba72767dfaae5ea33cd9f9480dce363de
Opcode Fuzzy Hash: 2207eb659941c484f799fad136cf50fe1ce49fd73e046d1b68f37f9609ba5877
Instruction Fuzzy Hash: F561C5B9D0815AAFDF02CFA8C844EEE7FBABF19318F094145E914A7249D3B1D985CB50

Function 6D181E55 Relevance: 3.1, APIs: 2, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6D181EA2

Part of subcall function 6D18224E: InitializeSListHead.KERNEL32(6D21A018,6D181EAC,6D20F630,00000010,6D182045,?,00000000,?,00000007,6D20F650,00000010,6D182058,?,?,6D1820E1,?), ref: 6D182253

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6D181F0C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 2a53d6eb4527fb81f008de325464c13f92a55cea078c88e66d4e9aecd7ec4a54
Instruction ID: 627dc2ad4ae4612ffcab6deba172c9e1446be90e700396d06e123ef01db5baa0
Opcode Fuzzy Hash: 2a53d6eb4527fb81f008de325464c13f92a55cea078c88e66d4e9aecd7ec4a54
Instruction Fuzzy Hash: EC21873368C3079EEB01DBA0C8017AE33B1AB1236DF014069DAB6671CBDBF14085CE65

Function 6D1A2213 Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,6D1A1BA5,?,6D1A9408,6D19FE6C,00000000,6D19FE6C,00000000), ref: 6D1A22AF
GetLastError.KERNEL32(?,6D1A1BA5,?,6D1A9408,6D19FE6C,00000000,6D19FE6C,00000000,00000000,?,6D1AA567,00000000,00000000,6D1AA4A4,6D19FE6C,00000000), ref: 6D1A22D5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: bde22b5bc26de42714ce8291d4440423e3a4ea80e9ca353312770f0347fbee08
Instruction ID: 54905c6d199594c9fc575b73fd166f9b0922f8ef01dbc01590046d7d0f69f45d
Opcode Fuzzy Hash: bde22b5bc26de42714ce8291d4440423e3a4ea80e9ca353312770f0347fbee08
Instruction Fuzzy Hash: 9F21B435A002199BDF25CF2ACC80AD9B7F9FB49305F1441AAEA05D7215D770DD46CF61

Function 6D181F5C Relevance: 3.1, APIs: 2, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6D181FA3
___scrt_uninitialize_crt.LIBCMT ref: 6D181FBD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 34eed84a944cc62a67a65cd564d038e89407b0b70281a7e58fa31d7448443adc
Instruction ID: f12efb240f5f64d32680fd5cf75b49d8502874fbc7dce9b347a880c2dc117352
Opcode Fuzzy Hash: 34eed84a944cc62a67a65cd564d038e89407b0b70281a7e58fa31d7448443adc
Instruction Fuzzy Hash: 29215E3395C24ADBEB12CFF8C90576E77B0FB16719F01C41AE625A2196CBF58101DE91

Function 6D05C4EE Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

_Yarn.LIBCPMT ref: 6D05C50E
_Yarn.LIBCPMT ref: 6D05C532

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Yarn
String ID:
API String ID: 1767336200-0
Opcode ID: ebc84a77225d02f0b46fdea9ef63414e610a49f863d6efdf5b9d701be7604b03
Instruction ID: 63703b353b88436164c720b29aafb3e4a39a24cf67379f15fd91e1b61814bd65
Opcode Fuzzy Hash: ebc84a77225d02f0b46fdea9ef63414e610a49f863d6efdf5b9d701be7604b03
Instruction Fuzzy Hash: 09E06D723482046BFB0896A6AC51BBA37E8CF005A5F11002DEE1EDA5C4EF50FE4489A6

Function 6D1A1710 Relevance: 2.6, APIs: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,?,6D1A16FF,6D1A8F61,?,00000000,00000000), ref: 6D1A1766
GetLastError.KERNEL32(?,00000000,?,6D1A16FF,6D1A8F61,?,00000000,00000000), ref: 6D1A1770

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: c3f7b4b3321eed45fbef2802f3f95027c5355f0ad382b030717437da40fe9956
Instruction ID: 96c7d573442781f0198742fa6e3cfc79e545b7efb235a9cc2a4c02da1df12519
Opcode Fuzzy Hash: c3f7b4b3321eed45fbef2802f3f95027c5355f0ad382b030717437da40fe9956
Instruction Fuzzy Hash: 56114C37B0C1102BD70142F4D845B7D77A98BB3778F2E1219EA248A1C9DFF1D5C18280

Function 6D05E09B Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D05E0A2

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: c9cccfea8611fc8eb908a8eaf41c9cd9dada2b2aa723e949467587bbcd481e62
Instruction ID: 7c204698390cce8de1834b157bbd9e403aa7ea0b0af30ea0f9d9c8d71212bc64
Opcode Fuzzy Hash: c9cccfea8611fc8eb908a8eaf41c9cd9dada2b2aa723e949467587bbcd481e62
Instruction Fuzzy Hash: 2951CCB0946F458FD3A9CF3A85417C6FAE0BF89304F108A2E91AED7264EB746184CF55

Function 6D01A050 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D01A094

Part of subcall function 6D05C4EE: _Yarn.LIBCPMT ref: 6D05C50E
Part of subcall function 6D05C4EE: _Yarn.LIBCPMT ref: 6D05C532

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Yarn$LockitLockit::_std::_
String ID:
API String ID: 360232963-0
Opcode ID: 32eb6f495f291da991f36e650d322b638b9cc8a991d47e447e855cc6a8a6fc08
Instruction ID: c20c7ff17c484129c861ac34311c8214d4506e3251f261f69f236b4bd9798886
Opcode Fuzzy Hash: 32eb6f495f291da991f36e650d322b638b9cc8a991d47e447e855cc6a8a6fc08
Instruction Fuzzy Hash: 01313CB0D08208CBDB08DFA8D941BEDBBB4FF49328F55412DD5066B340D7359555CBA5

Function 6D19FE22 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 6D19FE67

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: dca18796417370d0246b85439aee11170561ed5f581a8c41017e34eef11642e8
Instruction ID: c79505cd8825094a8ace48b021aa39f8bb0fbbcd916a4e7523c375e41f5565e7
Opcode Fuzzy Hash: dca18796417370d0246b85439aee11170561ed5f581a8c41017e34eef11642e8
Instruction Fuzzy Hash: 31118C75A0820AAFCB05CF58E944E9B3BF8EF48304F064059F914EB302D770E911CBA4

Function 6D19BA78 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696a1ead2963538fcb0becf89c689ba362256283d8f35724494d4cbd44c39231
Instruction ID: f7b6a0bacda288c22666227f919d708879de30ac4a873920cab5349006ef6eac
Opcode Fuzzy Hash: 696a1ead2963538fcb0becf89c689ba362256283d8f35724494d4cbd44c39231
Instruction Fuzzy Hash: D70192332142269B9F028E6EDE85A6737B6FBC67247118128FA209B18CDFB1D811C790

Function 6D199441 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,6D19D3B2,?,?,6D19D3B2,00000220,?,00000000,?), ref: 6D199473

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 38f1984d8548e550305c7037009c27942c24dbdba502eac8aa2d7e5f5e2d2865
Instruction ID: b47869917f07a64ee2fcf47ed983c3a48e62cd75119a703cb62c3ab23353a7cf
Opcode Fuzzy Hash: 38f1984d8548e550305c7037009c27942c24dbdba502eac8aa2d7e5f5e2d2865
Instruction Fuzzy Hash: 49E02B315846165FFB031AA99E20F6B365CDF537B0F129050EE599F08EDFE0C40082E1

Function 6D1A9173 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(6D02A690,00000000,?,6D1A8E17,?,?,00000000,?,6D1A8E17,6D02A690,0000000C), ref: 6D1A9190

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bfe02c9c7e011a3202818f99f3b57e9efbaded405b5576b43ba6edc4425964fc
Instruction ID: ba91b46ea059fc12402a0a152b8be3d568668222196a7872b6c73e1c05034803
Opcode Fuzzy Hash: bfe02c9c7e011a3202818f99f3b57e9efbaded405b5576b43ba6edc4425964fc
Instruction Fuzzy Hash: FDD06C3200010DBBDF028E84ED46EDA3BAAFB48714F014100BA5856020C772E861EB90

Function 6D04329A Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 6D0432A9

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: b4600b4a56383359e9c13bf41a26da4f28763d17a88e945f859b0d9edec1af79
Instruction ID: 23f6cea7fa4f30f2fe68e7bd08e093d4c22a76b8085eb96da8967da8bfb1f637
Opcode Fuzzy Hash: b4600b4a56383359e9c13bf41a26da4f28763d17a88e945f859b0d9edec1af79
Instruction Fuzzy Hash: F8B092B08C5101EBEE006670970CB1A39A5AB8530AF10E8A4E10582005DBBA80859580

Function 6D015460 Relevance: 1.3, APIs: 1, Instructions: 86sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 6D015519

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 051dd255fc3c3566970eeaa459b2ffede09fda5c6212ee84660779293d153e6e
Instruction ID: c3ade5dd0f9645cf1a49b7cee3e3dc133334b217d0af1893389c8608ce9faed3
Opcode Fuzzy Hash: 051dd255fc3c3566970eeaa459b2ffede09fda5c6212ee84660779293d153e6e
Instruction Fuzzy Hash: 563165B4A1C3488FEB059FE8DC097ADBBB1BB0A308F428029D5159F354DB34D901CB92

Function 6D039650 Relevance: 1.3, APIs: 1, Instructions: 14sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 6D039669

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cc86dc26bbdfdfab02d32aa1360babb3e11dfc44fb433e62917876182eba78f4
Instruction ID: 0fbe5d4b2acac34c62e1fdf1fe0bd2db7d30006b525ed9d3eb12492fa3bc7353
Opcode Fuzzy Hash: cc86dc26bbdfdfab02d32aa1360babb3e11dfc44fb433e62917876182eba78f4
Instruction Fuzzy Hash: 60D09E75D00208AFC740EFBCE54558DBFF4AB44210F004075E984D7304E7749698DB96

Non-executed Functions

Function 6D07B58F Relevance: 33.8, APIs: 22, Instructions: 845timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D07B596

Part of subcall function 6D0C7234: __EH_prolog3_catch.LIBCMT ref: 6D0C723B

IsWindow.USER32(00000000), ref: 6D07B69D
GetCursorPos.USER32(?), ref: 6D07B6BB
ScreenToClient.USER32(?,?), ref: 6D07B6C8
GetParent.USER32(?), ref: 6D07B795
SetTimer.USER32(?,0000EC18,FFFFFFFE), ref: 6D07B7F3
InvalidateRect.USER32(?,?,00000001), ref: 6D07B802
UpdateWindow.USER32(?), ref: 6D07B80B
GetParent.USER32(?), ref: 6D07B8FC

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ParentWindow$ClientCursorH_prolog3H_prolog3_catchInvalidateRectScreenTimerUpdate
String ID:
API String ID: 3771550435-0
Opcode ID: 6ac740bcfa4c404d938cd27e297e45aeb56d2f655735ea21b9ad22857b61d813
Instruction ID: ea410cc20c8dccd0bf56e3ba6aa9133c1c02ec3a473ca54d1b4d260ca0c41537
Opcode Fuzzy Hash: 6ac740bcfa4c404d938cd27e297e45aeb56d2f655735ea21b9ad22857b61d813
Instruction Fuzzy Hash: F1629C71A0420ADFEF11CF69C884BAE7BF5FF49714F118169E925AF290DB709841CBA4

Function 6D07A181 Relevance: 32.0, APIs: 15, Strings: 3, Instructions: 539windowtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D07A18B
GetParent.USER32(?), ref: 6D07A207
SendMessageW.USER32(?,00000117,?,?), ref: 6D07A2B0
GetMenuItemCount.USER32(?), ref: 6D07A2BF
GetMenuItemInfoW.USER32(00000000,00000000,00000001,?), ref: 6D07A3A5
GetMenuState.USER32(00000000,00000000,00000400), ref: 6D07A3C6
CharUpperW.USER32(?,00000026,00000000), ref: 6D07A53A
GetMenuDefaultItem.USER32(?,00000000,00000001), ref: 6D07A75E
__EH_prolog3.LIBCMT ref: 6D07A786
CreatePopupMenu.USER32 ref: 6D07A79C
AppendMenuW.USER32(00000000,?,?,-00000010), ref: 6D07A86C
AppendMenuW.USER32(00000000,00000000,?,?), ref: 6D07A88E
SetMenuDefaultItem.USER32(00000000,?,00000000,00000000), ref: 6D07A8B7
KillTimer.USER32(6D1BEE04,0000EC17,?,?,?,?,?,?,?,?,00000000,00000000,?,?,00000000), ref: 6D07A8F9
SetTimer.USER32(6D1BEE04,0000EC17,?,00000000), ref: 6D07A946

Strings

0, xrefs: 6D07A388
@, xrefs: 6D07A702
7, xrefs: 6D07A392

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$Item$AppendDefaultTimer$CharCountCreateH_prolog3H_prolog3_InfoKillMessageParentPopupSendStateUpper
String ID: 0$7$@
API String ID: 2255036064-3997377745
Opcode ID: 79570bf470c56f692658f09db7f7104539603b014e6362e321537a6b266b16bb
Instruction ID: 2c6e948f3a4228d732b2788364a7049c83608f35672fd50c81f27386f5812c70
Opcode Fuzzy Hash: 79570bf470c56f692658f09db7f7104539603b014e6362e321537a6b266b16bb
Instruction Fuzzy Hash: D9228E31A0421A9BEF25CF64CC94BEDB7B5BF49314F1081A9E91DAB280DB74EA41CF54

Function 6D0722EB Relevance: 27.7, APIs: 18, Instructions: 729windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0722F2
GetClientRect.USER32(?,?), ref: 6D0723A6

Part of subcall function 6D043E99: __EH_prolog3.LIBCMT ref: 6D043EA0
Part of subcall function 6D043E99: GetDC.USER32(00000000), ref: 6D043ECC

GetFocus.USER32 ref: 6D072612
NotifyWinEvent.USER32(00008005,?,000000FC,00000000), ref: 6D072646
InvalidateRect.USER32(?,?,00000001,?), ref: 6D072818
InflateRect.USER32(?,00000000,?), ref: 6D07285E
RedrawWindow.USER32(?,?,00000000,00000401), ref: 6D072871
InvalidateRect.USER32(?,?,00000001,?), ref: 6D072904
InflateRect.USER32(?,00000000,?), ref: 6D07294A
RedrawWindow.USER32(?,?,00000000,00000401), ref: 6D07295E
NotifyWinEvent.USER32(00008005,?,000000FC,00000001), ref: 6D072A44
InvalidateRect.USER32(?,?,00000001,?), ref: 6D072AB5
InflateRect.USER32(?,00000000,?), ref: 6D072AFB
RedrawWindow.USER32(?,?,00000000,00000401), ref: 6D072B0E
InvalidateRect.USER32(?,?,00000001,?), ref: 6D072B80
InflateRect.USER32(?,00000000,?), ref: 6D072BC6
RedrawWindow.USER32(?,?,00000000,00000401), ref: 6D072BD9
UpdateWindow.USER32(?), ref: 6D072BE2

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Window$InflateInvalidateRedraw$EventNotify$ClientFocusH_prolog3H_prolog3_Update
String ID:
API String ID: 387073690-0
Opcode ID: ab5ca24075be972069aa83b5b9265ce44890a8bc8cec6aef77b9a08f649fbf9f
Instruction ID: 3fbb8c538fb561524ef0782a33f5c63d9f68b7eb099a2a7ed345832805e493a2
Opcode Fuzzy Hash: ab5ca24075be972069aa83b5b9265ce44890a8bc8cec6aef77b9a08f649fbf9f
Instruction Fuzzy Hash: 41528E31E0021AAFEF24DFB4C894BBDBBF5BF49314F114169E925AB250DB30A951CB94

Function 6D06BDBD Relevance: 24.3, APIs: 16, Instructions: 285windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000467,00000467,00000000,00000000), ref: 6D06BEDD
GetDlgItem.USER32(?,00003020), ref: 6D06BF2D
GetDlgItem.USER32(?,00003020), ref: 6D06BF58
GetWindowRect.USER32(00000000,?), ref: 6D06BF6C
MapDialogRect.USER32(?,?), ref: 6D06BF8F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000016), ref: 6D06BFB9
GetDlgItem.USER32(?,00000001), ref: 6D06BFCA
GetWindowRect.USER32(00000000,?), ref: 6D06BFDC
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015,?), ref: 6D06C000
GetWindowRect.USER32(?,?), ref: 6D06C015
GetWindowRect.USER32(?,?), ref: 6D06C073
GetDlgItem.USER32(?,00000001), ref: 6D06C085
GetWindowRect.USER32(00000000,?), ref: 6D06C094
GetDlgItem.USER32(?,00000001), ref: 6D06C0BD
ShowWindow.USER32(00000000,00000000), ref: 6D06C0CC
EnableWindow.USER32(00000000,00000000), ref: 6D06C0D5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Rect$Item$DialogEnableMessageSendShow
String ID:
API String ID: 966972710-0
Opcode ID: 7eaa6059e539062d26b06063d1e50ade8fed8f91cfd9bc9cf24452875aa0155a
Instruction ID: e3e91ac5399f01456658e91a0d2f3377f4fda74b3ea558569fb054ef8f148647
Opcode Fuzzy Hash: 7eaa6059e539062d26b06063d1e50ade8fed8f91cfd9bc9cf24452875aa0155a
Instruction Fuzzy Hash: 4EA16E71A0064AAFEB10CFA5C988BBFBBFAFF49304F104529F615A7150DB70A950DB61

Function 6D0787A4 Relevance: 21.3, APIs: 14, Instructions: 309windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6D078839
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 6D078857
ReleaseCapture.USER32 ref: 6D07885D
SetCapture.USER32(?), ref: 6D078870
ReleaseCapture.USER32 ref: 6D0788FD
SetCapture.USER32(?), ref: 6D078910
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 6D078A04
UpdateWindow.USER32(?), ref: 6D078A90
SendMessageW.USER32(?,00000111,00000000,00000000), ref: 6D078ADF
IsWindow.USER32(?), ref: 6D078AEB
IsIconic.USER32(?), ref: 6D078AF6
IsZoomed.USER32(?), ref: 6D078B01
IsWindow.USER32(?), ref: 6D078B1F
UpdateWindow.USER32(?), ref: 6D078B7B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Capture$MessageReleaseSendUpdate$EmptyIconicRectRedrawZoomed
String ID:
API String ID: 2500574155-0
Opcode ID: 1dde6b0eafbd5a28978b899f5e28d16b428361c2907d1cdf1543869401a08cc5
Instruction ID: 6dc47d18b23230abdfd3a04518a613183272a8860acc0fd80bd6cf8e9efb50c5
Opcode Fuzzy Hash: 1dde6b0eafbd5a28978b899f5e28d16b428361c2907d1cdf1543869401a08cc5
Instruction Fuzzy Hash: 36C17C31A00615EFDF159F64C898BAE3BB6FF49314F054179ED2AAF291CB70A901CB94

Function 6D06C1C4 Relevance: 13.6, APIs: 9, Instructions: 77windowkeyboardCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?,?), ref: 6D06C1E2
GlobalLock.KERNEL32(00000000), ref: 6D06C1EF
SendMessageW.USER32(?,00000476,00000000,00000000), ref: 6D06C20A
GlobalUnlock.KERNEL32(00000000), ref: 6D06C215
RemovePropW.USER32(?), ref: 6D06C224
GlobalFree.KERNEL32(00000000), ref: 6D06C22F
GlobalUnlock.KERNEL32(00000000), ref: 6D06C251
GetAsyncKeyState.USER32(00000011), ref: 6D06C262
SendMessageW.USER32(?,00000475,00000000,?), ref: 6D06C28A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Global$MessagePropSendUnlock$AsyncFreeLockRemoveState
String ID:
API String ID: 723318029-0
Opcode ID: 9eb38439752b2b92b8ad166e7318f1dfbe6e0571748c3da685ddfc5e10d9badf
Instruction ID: b11f7a21d8c61de0650d45e05c38e6fad69d34d414c4247b52ce5995cfb2cf33
Opcode Fuzzy Hash: 9eb38439752b2b92b8ad166e7318f1dfbe6e0571748c3da685ddfc5e10d9badf
Instruction Fuzzy Hash: 78219F31344383ABEF145FA1EC88B263FFABF4A745F088029EA5592150DBB1D450DBA8

Function 6D0644F7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 189keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 6D04AD68: GetParent.USER32(?), ref: 6D04AD72

ScreenToClient.USER32(?,?), ref: 6D064584
GetKeyState.USER32(00000001), ref: 6D0645F5
GetKeyState.USER32(00000001), ref: 6D064650
IsWindow.USER32(?), ref: 6D064711

Strings

0, xrefs: 6D06459C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: State$ClientParentScreenWindow
String ID: 0
API String ID: 1527269598-4108050209
Opcode ID: e39d8c5c596cb9d5de88e20361412eaba8c14e84f29754e6d94b9aa157c628c2
Instruction ID: 59088a25566352b30cf3a52458ee76f0a251d31bfc899ad787f47b258d7a69dc
Opcode Fuzzy Hash: e39d8c5c596cb9d5de88e20361412eaba8c14e84f29754e6d94b9aa157c628c2
Instruction Fuzzy Hash: 5761B334B08259EBEF01DF64D8A8BAD7BB5BF4D354F004129FA11A7291EB70D801CBA1

Function 6D0660D1 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6D04A4BC,6D049545,00000003,?,00000004,6D049545), ref: 6D0660E3
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 6D0660F3
EncodePointer.KERNEL32(00000000,?,6D04A4BC,6D049545,00000003,?,00000004,6D049545), ref: 6D0660FC
DecodePointer.KERNEL32(00000000,?,?,6D04A4BC,6D049545,00000003,?,00000004,6D049545), ref: 6D06610A
GetLocaleInfoW.KERNEL32(00000000,00000004,?,00000003,?,6D04A4BC,6D049545,00000003,?,00000004,6D049545), ref: 6D066141

Strings

GetLocaleInfoEx, xrefs: 6D0660ED
kernel32.dll, xrefs: 6D0660DE

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleInfoLocaleModuleProc
String ID: GetLocaleInfoEx$kernel32.dll
API String ID: 1461536855-1547310189
Opcode ID: 7011dee1cba8e966eca1423756472c54670d05bab98240ff09eb277479f7c0ac
Instruction ID: fa2d847ecb84c425ffe39d00020b57b221cfe1e2bc5a57eed44e9a878a3e3c87
Opcode Fuzzy Hash: 7011dee1cba8e966eca1423756472c54670d05bab98240ff09eb277479f7c0ac
Instruction Fuzzy Hash: F3014B3550025AABEF025F60EC08BAE7FFAFB0A3517444554FA1496211DB71C960EBA0

Function 6D0C41AD Relevance: 12.1, APIs: 8, Instructions: 135clipboardwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6D0C41B4

Part of subcall function 6D043F78: __EH_prolog3.LIBCMT ref: 6D043F7F
Part of subcall function 6D043F78: GetWindowDC.USER32(00000000,00000004,6D05E51A,00000000,?,?,?,6D218020,00000000), ref: 6D043FAB

CreateCompatibleDC.GDI32(00000000), ref: 6D0C41DA
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6D0C4200

Part of subcall function 6D043D66: SelectObject.GDI32(6D04F80B,?), ref: 6D043D6F

FillRect.USER32(?,?,00000000), ref: 6D0C4252
OpenClipboard.USER32(?), ref: 6D0C42AC
EmptyClipboard.USER32 ref: 6D0C42EC
SetClipboardData.USER32(00000002,00000000), ref: 6D0C4310
CloseClipboard.USER32 ref: 6D0C432A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Clipboard$CompatibleCreate$BitmapCloseDataEmptyFillH_prolog3H_prolog3_catch_ObjectOpenRectSelectWindow
String ID:
API String ID: 2940850299-0
Opcode ID: 549407fc832576eb4c2fe5643247c5c6e549b2743bb82e02eacb81519699c4f8
Instruction ID: 1bbbfd19932d62d70592de36c821907e537efaa5006033f19aacc00c8e13ec5c
Opcode Fuzzy Hash: 549407fc832576eb4c2fe5643247c5c6e549b2743bb82e02eacb81519699c4f8
Instruction Fuzzy Hash: 19419C31D08219EBEB04DBE5ED48FDEBBB9BF48304F018129F615A3190DB709A04CBA1

Function 6D0882AF Relevance: 10.6, APIs: 7, Instructions: 138fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0882B9
PathIsUNCW.SHLWAPI(?,?,?,?,6D0BA132,00000024,?,?,?), ref: 6D088369
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,6D0BA132,00000024,?,?,?), ref: 6D08838D
GetFullPathNameW.KERNEL32(?,00000104,?,?,00000268,6D08812B,?,?,00000000,?,6D0BA132,00000024,?,?,?), ref: 6D0882EC

Part of subcall function 6D08826D: GetLastError.KERNEL32(?,?,?,6D08839E,?,?,?,6D0BA132,00000024,?,?,?), ref: 6D088279

Part of subcall function 6D0881A2: PathStripToRootW.SHLWAPI(00000000,?,?,6D0BA132,00000024,?,?,?), ref: 6D0881D6

CharUpperW.USER32(?,?,6D0BA132,00000024,?,?,?), ref: 6D0883BB
FindFirstFileW.KERNEL32(?,?,?,6D0BA132,00000024,?,?,?), ref: 6D0883D3
FindClose.KERNEL32(00000000,?,6D0BA132,00000024,?,?,?), ref: 6D0883DF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Path$Find$CharCloseErrorFileFirstFullH_prolog3_InformationLastNameRootStripUpperVolume
String ID:
API String ID: 2323451338-0
Opcode ID: fb0d995def8d7926e0c56eeedc697d0d5c48d3c93a48207f59038d87f319abad
Instruction ID: 7eb31532b2d9ea008315b5325f0a6388e4c63e5e4cb1b995c22a554cddfeba2f
Opcode Fuzzy Hash: fb0d995def8d7926e0c56eeedc697d0d5c48d3c93a48207f59038d87f319abad
Instruction Fuzzy Hash: 30419F71908116ABFF14EB24DC88FBE77BCFF05314F014699A519A2251EB75AE45CA20

Function 6D1A69F2 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6D1A6C09

Strings

1#SNAN, xrefs: 6D1A6AFE
1#QNAN, xrefs: 6D1A6B05
1#INF, xrefs: 6D1A6B28
1#IND, xrefs: 6D1A6AF7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 3059494ed389fed78c7e375362c2fe176c9f0f6ab44d9ddd75f5806879a1bf13
Instruction ID: aaf197d08695b00d83588112e9de36f49019f4d2ae89818af48356cdfff7e2ee
Opcode Fuzzy Hash: 3059494ed389fed78c7e375362c2fe176c9f0f6ab44d9ddd75f5806879a1bf13
Instruction Fuzzy Hash: 21D24875E086298BDB65CE28CC407EAB7B5FB55304F1941EAD40DE7248E7B4AE81CF81

Function 6D0200A0 Relevance: 9.5, APIs: 6, Instructions: 508encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 6D02012A
CryptCreateHash.ADVAPI32 ref: 6D0201D4

Part of subcall function 6D1822E1: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,6D0164B3,?,?,6D016384,?,?), ref: 6D182342

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Crypt$AcquireContextCreateExceptionHashRaise
String ID:
API String ID: 333276693-0
Opcode ID: 1c8dc5f3cc7ea2e7777824011d9395300779de972868420586c3fd68943ace0e
Instruction ID: b01bcfa208f63c4014b3abf42d86a56fb961c2b73b061e5ff1bb02ad61086223
Opcode Fuzzy Hash: 1c8dc5f3cc7ea2e7777824011d9395300779de972868420586c3fd68943ace0e
Instruction Fuzzy Hash: A0321EB49093188FDB14DF68D99579DBBF0BF49304F0185A9D809AB354DB70AE88CF92

Function 6D05908D Relevance: 9.2, APIs: 6, Instructions: 229windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 6D0590DB
EqualRect.USER32(?,00000000), ref: 6D0590F9

Part of subcall function 6D05BF18: SetWindowPos.USER32(?,00000115,00000000,00000000,00000002,00000002,00000000,?,?,6D0595AB,00000000,00000002,00000002,00000000,00000000,00000115), ref: 6D05BF40

IsWindowVisible.USER32(?), ref: 6D0591B4
CopyRect.USER32(?,?), ref: 6D0591F4
GetParent.USER32(?), ref: 6D0592D6
SetParent.USER32(?,?), ref: 6D0592EC

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: RectWindow$Parent$CopyEqualVisible
String ID:
API String ID: 3103310903-0
Opcode ID: 8d0dbd715608bbc40433ef19b234bf596dc563994ab30a13955381bca6d53820
Instruction ID: 895a3c53377843b4b3b8297c96e1cde59d7431f06ca20e3505467e03dd4ca135
Opcode Fuzzy Hash: 8d0dbd715608bbc40433ef19b234bf596dc563994ab30a13955381bca6d53820
Instruction Fuzzy Hash: 1E81B2B1A44619ABEF14CF34DD89BBAB7B9BF48304F1142A9ED1AD7180DB34A950CF50

Function 6D1A61EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,6D1A5BBB,00000002,00000000,?,?,?,6D1A5BBB,?,00000000), ref: 6D1A6283
GetLocaleInfoW.KERNEL32(?,20001004,6D1A5BBB,00000002,00000000,?,?,?,6D1A5BBB,?,00000000), ref: 6D1A62AC
GetACP.KERNEL32(?,?,6D1A5BBB,?,00000000), ref: 6D1A62C1

Strings

ACP, xrefs: 6D1A6208
OCP, xrefs: 6D1A623E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 99e6ad8cff32848811ac990b8edb9703568b8ce6908be91eb0ff5f60be6fa1a0
Instruction ID: 45b3d68b63c0cfcaeeab41732844b7b6708ca9b9eec36a28ee33b12160daf0b2
Opcode Fuzzy Hash: 99e6ad8cff32848811ac990b8edb9703568b8ce6908be91eb0ff5f60be6fa1a0
Instruction Fuzzy Hash: 4021256A64490AA6E7118F9CC904BA773B7FB50B60B4A8426E909D720CE7F2DD41C3C0

Function 6D021100 Relevance: 7.9, APIs: 5, Instructions: 405encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 6D01FDE0: CryptStringToBinaryA.CRYPT32 ref: 6D01FE60
Part of subcall function 6D01FDE0: CryptStringToBinaryA.CRYPT32 ref: 6D01FF07

CryptAcquireContextW.ADVAPI32 ref: 6D021349
CryptImportKey.ADVAPI32 ref: 6D021417
CryptSetKeyParam.ADVAPI32 ref: 6D0214A2
CryptSetKeyParam.ADVAPI32 ref: 6D021549

Part of subcall function 6D1822E1: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,6D0164B3,?,?,6D016384,?,?), ref: 6D182342

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Crypt$BinaryParamString$AcquireContextExceptionImportRaise
String ID:
API String ID: 2873263705-0
Opcode ID: 6d780268b994eefa1e8c937089273bc4034e963b12c24f22527e242dc0d123d3
Instruction ID: c5259b682221585da29e96c61f2eae60ac98e64848eed3431f209fe6360edf33
Opcode Fuzzy Hash: 6d780268b994eefa1e8c937089273bc4034e963b12c24f22527e242dc0d123d3
Instruction Fuzzy Hash: CE125CB0909318CFEB14DF68D99579DBBF0BF49304F0184A9D849A7390DB709A88CF92

Function 6D04476E Relevance: 7.8, APIs: 5, Instructions: 266COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D044791
InflateRect.USER32(?,?,?), ref: 6D0447AD
BeginDeferWindowPos.USER32(?), ref: 6D044821
InvalidateRect.USER32(?,00000000,00000001,00000018,00000008,00000000,0000EA20), ref: 6D044890
EndDeferWindowPos.USER32(00000000), ref: 6D044A8E

Part of subcall function 6D05BD37: GetDlgItem.USER32(?,?), ref: 6D05BD48

Part of subcall function 6D04648B: GetClientRect.USER32(?,?), ref: 6D0464AD
Part of subcall function 6D04648B: GetParent.USER32(?), ref: 6D0464C6
Part of subcall function 6D04648B: GetClientRect.USER32(?,?), ref: 6D0464F5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Client$DeferWindow$BeginInflateInvalidateItemParent
String ID:
API String ID: 939197390-0
Opcode ID: 6a2f7729990c195a4cc52d99bd697fc45b86f6decc897a491be43da5d5cd0f91
Instruction ID: c32f35d4187b70b7db8ee496ef2915bf9d42daedc13dc34f2d2da04d1be8b919
Opcode Fuzzy Hash: 6a2f7729990c195a4cc52d99bd697fc45b86f6decc897a491be43da5d5cd0f91
Instruction Fuzzy Hash: D0B1E471E0064AEFEB05CFA4C884FADFBB6FF48304F158129E519A7250D771A961CB91

Function 6D1A5A85 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 6D1A5B8D
IsValidCodePage.KERNEL32(00000000), ref: 6D1A5BCB
IsValidLocale.KERNEL32(?,00000001), ref: 6D1A5BDE
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 6D1A5C26
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 6D1A5C41

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: eda16b11861e1f4d31f3b618effe755f8a7c25b3ecb4bee91ee1babb98fd0262
Instruction ID: 71078b6c3225f26cd14efdf684e54e82cc5a1dd580add9d7cb2409d05ad4b42f
Opcode Fuzzy Hash: eda16b11861e1f4d31f3b618effe755f8a7c25b3ecb4bee91ee1babb98fd0262
Instruction Fuzzy Hash: 74518075A08206AFFF00DFA5DC84ABE77B9BF15705F09446AE510EB198E7F09604CB60

Function 6D04849D Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 6D0487A4

Part of subcall function 6D05BF18: SetWindowPos.USER32(?,00000115,00000000,00000000,00000002,00000002,00000000,?,?,6D0595AB,00000000,00000002,00000002,00000000,00000000,00000115), ref: 6D05BF40

SetRectEmpty.USER32(?), ref: 6D048832

Strings

@, xrefs: 6D0485FC

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: RectWindow$Empty
String ID: @
API String ID: 650961088-2766056989
Opcode ID: 625f2fa74085fb49c302f23be01e7fd0fbd66a60e684c261e5f4f83ace9d2f0d
Instruction ID: 5a9c4eb85498d9fa3c7f0e04befe93cf6c371cce13af56ef4e913b853a89cca1
Opcode Fuzzy Hash: 625f2fa74085fb49c302f23be01e7fd0fbd66a60e684c261e5f4f83ace9d2f0d
Instruction Fuzzy Hash: 1CE10571E00219DFEB09CFA8D995BAEBBF5EF49314F15852AE815B7340DB30A941CB90

Function 6D05C225 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 6D011ED0: GetLastError.KERNEL32 ref: 6D011F1F

IsDebuggerPresent.KERNEL32(?,?,?,6D03FA13), ref: 6D05C258
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,6D03FA13), ref: 6D05C267

Strings

MZx, xrefs: 6D05C22D
ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6D05C262

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule$MZx
API String ID: 389471666-1466369552
Opcode ID: 42143ba19a4e78e6f98bb2e988a3e92b3051fa2e802df1c794b1400e07834f59
Instruction ID: 7c6b1800619b5d5889e90a294164b8360fd50fca2ce23d4b9c7b46b0d2201290
Opcode Fuzzy Hash: 42143ba19a4e78e6f98bb2e988a3e92b3051fa2e802df1c794b1400e07834f59
Instruction Fuzzy Hash: A5E06D702087418FE7218FA5E9487127BF4AB05744F04891DE895C7204DBB5E444CBA2

Function 6D189E80 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d489d342d0daa139baacbea097abd1b40779f22726dfd59dc6bebb79c20b2f
Instruction ID: ea9dba3ecea4d436fe2a200ba042cdaebff18cde92b8240e99e6e8aae09d6194
Opcode Fuzzy Hash: f0d489d342d0daa139baacbea097abd1b40779f22726dfd59dc6bebb79c20b2f
Instruction Fuzzy Hash: 20024E71E0121A9BDB14CFA8C890AAEFBF1FF48314F258269D515E7385D771A941CF90

Function 6D19F23C Relevance: 6.2, APIs: 4, Instructions: 205COMMONLIBRARYCODE

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6D19F32C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3602dea193b35670c4b93e2fe763a9518eb76484e22a9c2ea1bdfa28d0906899
Instruction ID: 5c7b7248f19be8fa567ba3216d280a31c1090f9f6f8fa13335e8b508a1f1da1b
Opcode Fuzzy Hash: 3602dea193b35670c4b93e2fe763a9518eb76484e22a9c2ea1bdfa28d0906899
Instruction Fuzzy Hash: 797112759081697FDF119F68CC88BBABBB8AB09208F1441DAF06C9B119DB758E858F50

Function 6D06305D Relevance: 6.1, APIs: 4, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6D06306C
IsIconic.USER32(?), ref: 6D063095
GetParent.USER32(?), ref: 6D0630A2
__EH_prolog3.LIBCMT ref: 6D0630CD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Parent$H_prolog3Iconic
String ID:
API String ID: 881905488-0
Opcode ID: 4ab43983a296aa81e511ece0ce08364808b0daf1c2e2a944a60e3d614cd55d43
Instruction ID: da84079eb114e474de709dfcca27e29b812d5a5f9a7f43fce2ee14fa0033fe41
Opcode Fuzzy Hash: 4ab43983a296aa81e511ece0ce08364808b0daf1c2e2a944a60e3d614cd55d43
Instruction Fuzzy Hash: B721B036604246ABFF025F60DC08BAEB7B6FF49354F098425FE0697250DB71D824DBA1

Function 6D05D776 Relevance: 6.1, APIs: 4, Instructions: 70COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00000001), ref: 6D05D782
IsDebuggerPresent.KERNEL32 ref: 6D05D84E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6D05D867
UnhandledExceptionFilter.KERNEL32(?), ref: 6D05D871

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e17d6778b8c9b75780acd3a44b9d90868734b3767562db390773584a80eab135
Instruction ID: 438e0b53cd127a1fba0556d4affb3d40292dc94709d2f5891d5967841b5d9d9e
Opcode Fuzzy Hash: e17d6778b8c9b75780acd3a44b9d90868734b3767562db390773584a80eab135
Instruction Fuzzy Hash: CD310775D0521D9ADF20DFA0D9897CDBBF8AF08304F1041AAE50CAB240EB709A859F55

Function 6D04D23E Relevance: 6.0, APIs: 4, Instructions: 38keyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

GetKeyState.USER32(00000010), ref: 6D04D25B
GetKeyState.USER32(00000011), ref: 6D04D268
GetKeyState.USER32(00000012), ref: 6D04D275
SendMessageW.USER32(?,00000111,0000E146,00000000), ref: 6D04D28F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: 89b62c79798e6fe0dbfeed39360cfa27590b8593db806ff55da0b1386cbab218
Instruction ID: 0b90a86152c90f981a28bd21aee69ef1956ce0821e9b0e9d13a9f6e8372c5561
Opcode Fuzzy Hash: 89b62c79798e6fe0dbfeed39360cfa27590b8593db806ff55da0b1386cbab218
Instruction Fuzzy Hash: 0BF0B475388346A7FB202A306E54FAA16B66FF5B95F014874E606EB0C4CFD0C4115570

Function 6D01FDE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32 ref: 6D01FE60
CryptStringToBinaryA.CRYPT32 ref: 6D01FF07

Part of subcall function 6D1822E1: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,?,?,?,6D0164B3,?,?,6D016384,?,?), ref: 6D182342

Strings

Failed to calculate base64 decoded size., xrefs: 6D01FE75

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: BinaryCryptString$ExceptionRaise
String ID: Failed to calculate base64 decoded size.
API String ID: 754323452-3365390155
Opcode ID: 0aa9d286398562411a21cb08f359c3615f3d60013ff78d3e51b8b7847fcf1cb4
Instruction ID: 4aeaea2823de08166d784c0a819c3f779371373836d08b17607557c2f9671478
Opcode Fuzzy Hash: 0aa9d286398562411a21cb08f359c3615f3d60013ff78d3e51b8b7847fcf1cb4
Instruction Fuzzy Hash: EC41F8B59083098FEB04EFA8D95479EBBF4BF49308F01852DE859A7380D7749949CF92

Function 6D041008 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,?,6D04A6EA,00000000,6D202418,00000010,6D060524,comctl32.dll,?), ref: 6D04101C
GetLastError.KERNEL32(?,?,?,6D04A6EA,00000000,6D202418,00000010,6D060524,comctl32.dll,?), ref: 6D041053

Part of subcall function 6D04122A: GetModuleFileNameW.KERNEL32(?,?,00000105,?,6D04A6EA,00000000,6D202418,00000010,6D060524,comctl32.dll,?), ref: 6D0412DA
Part of subcall function 6D04122A: SetLastError.KERNEL32(0000006F,?,6D04A6EA,00000000,6D202418,00000010,6D060524,comctl32.dll,?), ref: 6D0412EE

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 6D041017

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$DebugFileModuleNameOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 3265401609-2690750368
Opcode ID: 1a61a3d6645d14c12af8035e7ba9ac787f66448938cfc26b5118ae2e2633477f
Instruction ID: f8246a854fd0f4e601c7a97b60612a8db43f29da4df06e4ee61867bc6b8456ce
Opcode Fuzzy Hash: 1a61a3d6645d14c12af8035e7ba9ac787f66448938cfc26b5118ae2e2633477f
Instruction Fuzzy Hash: 9EF08C312091A7C6BB1446A8DE88FBE33E5AA0B746311C23AEB21C2044DBB0D870C6D3

Function 6D1A5D71 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1A5DC5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1A5E0F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1A5ED5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 0acf3661871fd9f5f00bd8a6302b46fbbeec2c4a7d09da3fbfff7e6795f09f17
Instruction ID: eee7b2fe66cdcb12ceab45259228b49112d981936914daacbfabf2198eacf3f7
Opcode Fuzzy Hash: 0acf3661871fd9f5f00bd8a6302b46fbbeec2c4a7d09da3fbfff7e6795f09f17
Instruction Fuzzy Hash: D3619D756582079FEB188F28CC81BBAB7B8FF14305F1840B9EA15C6588E7B4D991CB50

Function 6D191F18 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6D192010
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6D19201A
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 6D192027

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: be4817879d0cb99da19e2e605eb199414dc6220a8e9bbf0e7007e39723b2fadd
Instruction ID: 572dcf166d8f4251a18d592fed24df261450b1ec2f482ada8ae5c6a93e5ece51
Opcode Fuzzy Hash: be4817879d0cb99da19e2e605eb199414dc6220a8e9bbf0e7007e39723b2fadd
Instruction Fuzzy Hash: 3731E47490122DABCB21DF64D9887DCBBB8BF08714F5081EAE51CA7250EB749B85CF54

Function 6D04AF5B Relevance: 4.5, APIs: 3, Instructions: 33COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,000000F0), ref: 6D04AF7B
LoadResource.KERNEL32(?,00000000), ref: 6D04AF87
LockResource.KERNEL32(00000000), ref: 6D04AF92

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLock
String ID:
API String ID: 2752051264-0
Opcode ID: eed9454bb4ea4bddc70cacc1aeac3732cf94894f85d5227fa78c267df548a853
Instruction ID: abd385988d499015080e02176e4cc374585a1e6e9f40caab686ee54674a327b2
Opcode Fuzzy Hash: eed9454bb4ea4bddc70cacc1aeac3732cf94894f85d5227fa78c267df548a853
Instruction Fuzzy Hash: D4E03075205315AFFB011AA6EC84F7B76ADFF45AA57118039FA05D7100CB60980196B0

Function 6D04DC7F Relevance: 3.4, APIs: 2, Instructions: 404COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D04DC89

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 805e100a186cc451d9d88bff1cb3d466fe7895140766b4c5aabc05f269c34e57
Instruction ID: c01bbdc2df02fc901bdc35efe1726dbd38d729acbeed05a64a8e846461f25b78
Opcode Fuzzy Hash: 805e100a186cc451d9d88bff1cb3d466fe7895140766b4c5aabc05f269c34e57
Instruction Fuzzy Hash: BEE17A70A0420ADFEB05DF64C844FBE7BB5BF89314F11C469E925AB290DB35E941CBA0

Function 6D192EE2 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,6D01549C,6D01549C,?,6D0155CB,?,6D01549C), ref: 6D192EF7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D192F16

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: d3c232835b2a31b2c1f2069bba54d555e4d8524ee9dd05f000cc88824935589e
Instruction ID: f24d36f6972074aea6056e0408bb42e7bc9a3761b2bcca45dd5e8f38c32d5687
Opcode Fuzzy Hash: d3c232835b2a31b2c1f2069bba54d555e4d8524ee9dd05f000cc88824935589e
Instruction Fuzzy Hash: AFF02DB1A00115BB9B24CF6DC80499EBEE9EFC77707614259F819D7348D6B0CD01C790

Function 6D05AD46 Relevance: 3.0, APIs: 2, Instructions: 33comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 6D05AD72
CoCreateInstance.OLE32(6D1BFD50,00000000,00000001,6D1BFBF8,?), ref: 6D05AD94

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CreateInitializeInstance
String ID:
API String ID: 3519745914-0
Opcode ID: 98e8c95cd2e924a72219e8eeedd76979f42d180ca0d0aa4181e3e2290d9db387
Instruction ID: c33ada16c46e72d4f194f92008f923f41f4f28551f5ac5e341cb227e3ba90804
Opcode Fuzzy Hash: 98e8c95cd2e924a72219e8eeedd76979f42d180ca0d0aa4181e3e2290d9db387
Instruction Fuzzy Hash: 73F08232A04702DFF760AE6499C4FA3B3F9EB41356F20443EF92691100C7B1A8548B31

Function 6D1906A6 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6D190601,?,?,00000008,?,?,6D1A9B0B,00000000), ref: 6D1908D3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6366bafbe23df3089d3cf93973ffe9c79e6b9b6839568b9afb9fe006c3cae22a
Instruction ID: a3921a59387bc3746e0a46af85f9c4be778badaa3d92fdb52c7d7ca42da57321
Opcode Fuzzy Hash: 6366bafbe23df3089d3cf93973ffe9c79e6b9b6839568b9afb9fe006c3cae22a
Instruction Fuzzy Hash: FAB16A31620609DFE705CF29C486B657BE0FF45364F268658E8E9CF2A5C3B5E982CB40

Function 6D05D435 Relevance: 1.7, APIs: 1, Instructions: 242COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6D05D44B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 74a8a2c85d00f5c06e32941b0cd6eb7c893bd955748f57850d8bde6b41412798
Instruction ID: 27fd1776bbdb821a6b93bebc497e238b157ffe7fb02491ca31d4bde57aed16f6
Opcode Fuzzy Hash: 74a8a2c85d00f5c06e32941b0cd6eb7c893bd955748f57850d8bde6b41412798
Instruction Fuzzy Hash: D2A14C71D1060ACFDB04CF56C9867AABBF1FB89328F14C12AE925A7354D735A950CF60

Function 6D03B860 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 6D03B8AB

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 60bc19865b67e39496854310c233e761fafba6df01ce8812c61faeaf2927e1db
Instruction ID: 3d1877dc094e4b585d060b293a1ef4e9f5638d212ddcfff3d320c952ed1a6189
Opcode Fuzzy Hash: 60bc19865b67e39496854310c233e761fafba6df01ce8812c61faeaf2927e1db
Instruction Fuzzy Hash: 6491B2B4E14A5A8FDB04CFA8C8806DDBBF1BF49324F11862AE865E7390D734A941CF55

Function 6D19F18B Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D19C758: HeapAlloc.KERNEL32(00000008,6D196272,?,?,6D1996E0,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6D196272,?,6D0154A7), ref: 6D19C799

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6D19F32C
FindNextFileW.KERNEL32(00000000,?), ref: 6D19F420
FindClose.KERNEL32(00000000), ref: 6D19F45F
FindClose.KERNEL32(00000000), ref: 6D19F492

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 3bcb2b5fde61404c8a5a7226c68706d28a8ed87fb4fdc71ce1c508e3f78db70a
Instruction ID: cebfe319df40bad58dbfdfbd5dbc6452701fb825b0f6c0ef8349a02f73768387
Opcode Fuzzy Hash: 3bcb2b5fde61404c8a5a7226c68706d28a8ed87fb4fdc71ce1c508e3f78db70a
Instruction Fuzzy Hash: 66514879908119BFDB008E68DC84BFE77B9DF95308F1041A9F8389B208DBB0DD418B61

Function 6D186651 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 6D1867C1

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: a69bcc3cea0cec6cfc0c518e4398f008d92170756a9e55e96edf86794f99b40d
Instruction ID: 4719a8c32e890e2cb612a5c44afa582fa858c763ef85addb639523e3ad2cbabe
Opcode Fuzzy Hash: a69bcc3cea0cec6cfc0c518e4398f008d92170756a9e55e96edf86794f99b40d
Instruction Fuzzy Hash: 8DC1E030A2464F8FCB11CE68C590ABABBB1BF22304F10461DC5A69769BC7F1A945CFD1

Function 6D1A6023 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1A6077

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6fe447767e2074fdbe2ff2461d0ca34c0a053c232fc39efd7bf4983d7bc21fd9
Instruction ID: a0bd7c25c0c53be70182e02ca9c9bb0a8a1a31aee87de80191638ea6358f09a3
Opcode Fuzzy Hash: 6fe447767e2074fdbe2ff2461d0ca34c0a053c232fc39efd7bf4983d7bc21fd9
Instruction Fuzzy Hash: 62210A7551862A9BDF188F58DD41EBA37B8EF55304F05407EEE01C7148EBB4D944CB90

Function 6D1A6143 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6D1A6197

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: bb97fce29c0552b0801fc0d46893fb49f579fe273a145b86d02fea978ad3df77
Instruction ID: 854e6f0083cd150cabb6419238568060992c7ac3e7dd301ea6837c7525294103
Opcode Fuzzy Hash: bb97fce29c0552b0801fc0d46893fb49f579fe273a145b86d02fea978ad3df77
Instruction Fuzzy Hash: 5311257661460BAFDB049B28DC55EBA77FCEF45318B15407EEA01D7148EBB8E904C790

Function 6D1A5CD6 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

EnumSystemLocalesW.KERNEL32(6D1A5D71,00000001,00000000,?,-00000050,?,6D1A5B61,00000000,-00000002,00000000,?,00000055,?), ref: 6D1A5D48

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 05a9de21138358ff190e179fc49d9e8e93ba221dfd0b5cf69828c8c7c0fb5139
Instruction ID: ba541db31b92bcd8269035b8c71a750313abccd49569cc610a81eead994ed756
Opcode Fuzzy Hash: 05a9de21138358ff190e179fc49d9e8e93ba221dfd0b5cf69828c8c7c0fb5139
Instruction Fuzzy Hash: CC110C3B2087055FEB189F39D8946BAB7A2FF80368B19452DE94787B44D3B17543C740

Function 6D1A62F0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6D1A60CD,00000000,00000000,?), ref: 6D1A631C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 83070673c24871f001faae113cf2b70fce237f67904b5506db1c7cb92c16256d
Instruction ID: 337a41f326b07d04f8bda848c2beee3aa1208c31d9b6d4b9fdcc8263506a2b75
Opcode Fuzzy Hash: 83070673c24871f001faae113cf2b70fce237f67904b5506db1c7cb92c16256d
Instruction Fuzzy Hash: 5901D63A61451BAFDB189A298815BBB3768EF40758F094828DD1AA3184EBF0ED42D6D0

Function 6D1A5FC4 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

EnumSystemLocalesW.KERNEL32(6D1A6023,00000001,?,?,-00000050,?,6D1A5B29,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 6D1A600E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: bc0dabf463e60c53de0587d37e4ae5d078ea21bcbc9a531521d7e5e4e75e59cb
Instruction ID: bb4407981f00f844d50a69d9362e82d2d24cbf43096a4a3ea7405cdc7ae12e45
Opcode Fuzzy Hash: bc0dabf463e60c53de0587d37e4ae5d078ea21bcbc9a531521d7e5e4e75e59cb
Instruction Fuzzy Hash: BDF0F63A2087095FD7145F799880B7A7BA1EF8136CF19442CEA468B684C7F19842D690

Function 6D19BC5B Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D1925AC: EnterCriticalSection.KERNEL32(?,?,6D199B4C,?,6D20FB68,00000008,6D199A3E,?,?,?), ref: 6D1925BB

EnumSystemLocalesW.KERNEL32(6D19BC4E,00000001,6D20FC48,0000000C,6D19B538,-00000050), ref: 6D19BC93

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2104c9dae68ad8062079df1dddd0ccb08026efa4aeb152e5a96c5c35dd8bd8cf
Instruction ID: 81ba8bc3a7ae93ee0cca3bb9abdc615690980a462c1d724157dc1ec9804e60d3
Opcode Fuzzy Hash: 2104c9dae68ad8062079df1dddd0ccb08026efa4aeb152e5a96c5c35dd8bd8cf
Instruction Fuzzy Hash: FEF06D32A04204DFEB04CF98E946BAE77F0EB4572AF00812AF611DB290CBB95905DF54

Function 6D1A60F8 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

EnumSystemLocalesW.KERNEL32(6D1A6143,00000001,?,?,?,6D1A5B83,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 6D1A612F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 771987b748d4fe320041fc493f239fc2913c4fbf481e779f0350354fc0a8850b
Instruction ID: 538b1b896ae6c2af56f87672603b37ada665455c3df90f9050c4be02fce672e9
Opcode Fuzzy Hash: 771987b748d4fe320041fc493f239fc2913c4fbf481e779f0350354fc0a8850b
Instruction Fuzzy Hash: 86F0E57A7042095BCB049F3AD858BAA7FA5EFC1764B0B4058EA0A8B646C7B19942C7D0

Function 6D19B63C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,6D19B21E,?,20001004,00000000,00000002,?,?,6D19A130), ref: 6D19B670

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f29a9ec1429de16368973841552ef89633ebc1770cc3eb01efc8da40880c10f2
Instruction ID: 65e969e9ef88a3a4b0ee5c54c9732cd2a20b541f81dda38428bb95c38626f0b9
Opcode Fuzzy Hash: f29a9ec1429de16368973841552ef89633ebc1770cc3eb01efc8da40880c10f2
Instruction Fuzzy Hash: 36E04F3290421CFBCF122F60DD88F9E3E66FF457A0F018010FD1569268DBB19920AAD4

Function 6D04E94E Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 6D04E95A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 8be465044ae5863c2817074785265389f56224a7616fbcee8f47e7b5fc6c731b
Instruction ID: 065aeefddbf99b3117fc16bc7d9ae15f16b7d5f5b3a0070c56b0a4b85ce0696a
Opcode Fuzzy Hash: 8be465044ae5863c2817074785265389f56224a7616fbcee8f47e7b5fc6c731b
Instruction Fuzzy Hash: D6D0C931114661CBE751AA25B444FD673F6BB49725B05442AD096924A0D7E09880C640

Function 6D03ED00 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

", xrefs: 6D03EF13

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: f399ed6b82a344862666a45faa62b68e6bdc9fb0767ab4bf9aa01c292b296a30
Instruction ID: 5ab5d31019adbc1f2be7b3f7a6e20b30cff53c618e2cdbbaf99f58ec0a41d654
Opcode Fuzzy Hash: f399ed6b82a344862666a45faa62b68e6bdc9fb0767ab4bf9aa01c292b296a30
Instruction Fuzzy Hash: D67114B5D146698FEB00CFA9D4907EEBBF1AB4A324F214319E524AB3D0C3765944CF51

Function 6D03F0B0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

", xrefs: 6D03F1FE

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 2578aa3f92b4914e6a86cc9e21f821e32f91fb7b8163e9217615e6bb844b0485
Instruction ID: 8eba5fb1243fea667b0e46f2158690dcdd7e86333b6960d0426a58cdd5a5a8ef
Opcode Fuzzy Hash: 2578aa3f92b4914e6a86cc9e21f821e32f91fb7b8163e9217615e6bb844b0485
Instruction Fuzzy Hash: 374103B8C04269DFDF01CFA8C480BDEBBF5AB1A314F129156D824AB381C3795A46DF61

Function 6D011ED0 Relevance: 1.3, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 6D0114F0: InitializeCriticalSectionEx.KERNEL32 ref: 6D011525

GetLastError.KERNEL32 ref: 6D011F1F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CriticalErrorInitializeLastSection
String ID:
API String ID: 3413597225-0
Opcode ID: 9a3632b079cd1628406061427a474e2fb90f7beb1198d1c0c8ac5ca88444ff1b
Instruction ID: 1bf4076baa47421de305ace2904a811c2e6340a567723f7878e1b3fa3e09cac7
Opcode Fuzzy Hash: 9a3632b079cd1628406061427a474e2fb90f7beb1198d1c0c8ac5ca88444ff1b
Instruction Fuzzy Hash: 28312A71E152198BDB48DEBDD8817AEBBF2AB49330F248329E435E33D0D37989008B55

Function 6D0126C0 Relevance: 1.3, APIs: 1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID:
API String ID: 1466638765-0
Opcode ID: 6489918d726270b03b5e6d75417ac41fa35b59703c5178434b8053ea8d5a8180
Instruction ID: c153f94b40ca2c977a7c5ce8a8d243231b730cd69cd7b71c12d6b137a0db4d51
Opcode Fuzzy Hash: 6489918d726270b03b5e6d75417ac41fa35b59703c5178434b8053ea8d5a8180
Instruction Fuzzy Hash: 22313E75908285CFDB10EFB4C98ABAEBBF4FB0A304F5185AAC96193340EB359645CB41

Function 6D0345C0 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f731e3e69cf1dfe31eec3208c5d93ea16ca429d595295fe87b231241b5550db
Instruction ID: 6c112766b16132699bd92992b3f4e00d35e8ca705a10daa218c3dd1b58158665
Opcode Fuzzy Hash: 7f731e3e69cf1dfe31eec3208c5d93ea16ca429d595295fe87b231241b5550db
Instruction Fuzzy Hash: A832B37561D3918FD375CF28C481BDEBBE1AB8A320F058A1EE9E887391D7319941CB52

Function 6D034F70 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f3283a13c91223d8480f2da5767a9528dfb1b588ba972e35b591618e197db3a
Instruction ID: 208f3d406849d2bc32dd0077d758f97b27976c3e86b38a3a035a7bfa0261f301
Opcode Fuzzy Hash: 5f3283a13c91223d8480f2da5767a9528dfb1b588ba972e35b591618e197db3a
Instruction Fuzzy Hash: F1F1F57961D3818FD364CF28C490B9EBBE1BB89324F058A1EE8E9D7391D7309944CB12

Function 6D01F470 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b7017870a6e5705d5740fea9f4902fb1e4e37df06231f09d432a959930a3e7
Instruction ID: 21e9c9032412649cde40985c6e87779b02e622c604b3731a4b2664f913784ba4
Opcode Fuzzy Hash: 40b7017870a6e5705d5740fea9f4902fb1e4e37df06231f09d432a959930a3e7
Instruction Fuzzy Hash: 10711F75E082899FDB05CFECC8506DDBFF1AF1A320F144299E864EB391D2359A45CB25

Function 6D18A804 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1304ecbd74e704af21282b56ce8b6b07498cda9d2fdce7d0abbc3aa9e7c44aaa
Instruction ID: 312313cbeb57578b54a2399960b9d8a191a99d1a1797932ac8b227f0160d1bad
Opcode Fuzzy Hash: 1304ecbd74e704af21282b56ce8b6b07498cda9d2fdce7d0abbc3aa9e7c44aaa
Instruction Fuzzy Hash: 4C51A172E0011AEFDF04CF99C850AEEBBB2FF89304F1A8459E554AB245D774AA41CF90

Function 6D182BE0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4e71f3251469067bc51d2b86b9abdf67d9e251ab1de668c7f7f02f93bb5f047d
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6F1138F720018347D313CB2DF8B46B6B795EBE6325729836AC1624B65ED3E391459D00

Function 6D05FA2F Relevance: 45.9, APIs: 25, Strings: 1, Instructions: 428windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D05FA39

Part of subcall function 6D040987: __EH_prolog3.LIBCMT ref: 6D04098E

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 6D05FAB1
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 6D05FAE4
CopyRect.USER32(?,?), ref: 6D05FB0B
GetObjectW.GDI32(?,00000018,?), ref: 6D05FB38
GetSystemMetrics.USER32(00000032), ref: 6D05FB55
GetSystemMetrics.USER32(00000031), ref: 6D05FB60
GetSysColor.USER32(00000004), ref: 6D05FBA0
CreateCompatibleDC.GDI32(00000000), ref: 6D05FBBA
CopyRect.USER32(?,?), ref: 6D05FC0E
GetSysColor.USER32(0000000D), ref: 6D05FC1F
GetSysColor.USER32(00000010), ref: 6D05FC3F
GetSysColor.USER32(00000014), ref: 6D05FC49
GetSysColor.USER32(0000000D), ref: 6D05FC7F
GetSysColor.USER32(00000007), ref: 6D05FDF4
ExtTextOutW.GDI32(00000001,?,?,00000002,00000000,?,?,00000000), ref: 6D05FE39
CreateCompatibleDC.GDI32(00000000), ref: 6D05FE9E
InflateRect.USER32(00000000,000000FF,000000FF), ref: 6D05FEC7
BitBlt.GDI32(00000003,00000000,?,?,?,?,00000000,00000000,00CC0020), ref: 6D05FEE6

Strings

@, xrefs: 6D05FA9E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Color$Rect$CompatibleCopyCreateInfoItemMenuMetricsSystem$H_prolog3H_prolog3_InflateObjectText
String ID: @
API String ID: 364174344-2766056989
Opcode ID: cf447105af60e6fa509743b920ca63f3bb35c5264fec91a836d6829b29ec663f
Instruction ID: d83ef41055f03b5691757892f2919afa855538c78bc79f4cc032b52253bb67f0
Opcode Fuzzy Hash: cf447105af60e6fa509743b920ca63f3bb35c5264fec91a836d6829b29ec663f
Instruction Fuzzy Hash: 5DF16A31A00219DFEF05CFA4CD89BADBBBAFF49304F144169EA15AB291CB74A915CF50

Function 6D0C2373 Relevance: 44.1, APIs: 24, Strings: 1, Instructions: 327fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0C237D
GetModuleFileNameW.KERNEL32(00000000,?,00000104,6D1F7AC4,00000000,6D1F7E9C,00000000,6D1F5294,00000000,?,?,00000A88,6D0C4829,?,00000000,00000038), ref: 6D0C241C
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,6D1F5294,00000000,?,?,00000A88,6D0C4829,?,00000000,00000038), ref: 6D0C24CF

Strings

, xrefs: 6D0C27BA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: File$CreateH_prolog3_ModuleName
String ID:
API String ID: 3408945735-3916222277
Opcode ID: d32d9365494ee4968d74b211de5ee61fb81d2b377aadab0cc7b8e4cf5946a97b
Instruction ID: bca35bb281b14eee3c9cd6a9a1a0b3c8868dc98da7161bee4710a0628d35ac04
Opcode Fuzzy Hash: d32d9365494ee4968d74b211de5ee61fb81d2b377aadab0cc7b8e4cf5946a97b
Instruction Fuzzy Hash: DCC18072A00215AFEF219F64DC84FAE77B9FF4A314F0041A5F909A6550DBB09E84DF62

Function 6D04050D Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 43registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatW.USER32(Native), ref: 6D1816F6
RegisterClipboardFormatW.USER32(OwnerLink), ref: 6D181703
RegisterClipboardFormatW.USER32(ObjectLink), ref: 6D181711
RegisterClipboardFormatW.USER32(Embedded Object), ref: 6D18171F
RegisterClipboardFormatW.USER32(Embed Source), ref: 6D18172D
RegisterClipboardFormatW.USER32(Link Source), ref: 6D18173B
RegisterClipboardFormatW.USER32(Object Descriptor), ref: 6D181749
RegisterClipboardFormatW.USER32(Link Source Descriptor), ref: 6D181757
RegisterClipboardFormatW.USER32(FileName), ref: 6D181765
RegisterClipboardFormatW.USER32(FileNameW), ref: 6D181773
RegisterClipboardFormatW.USER32(Rich Text Format), ref: 6D181781
RegisterClipboardFormatW.USER32(RichEdit Text and Objects), ref: 6D18178F

Strings

OwnerLink, xrefs: 6D1816FC
Rich Text Format, xrefs: 6D181779
Object Descriptor, xrefs: 6D181741
ObjectLink, xrefs: 6D181709
FileName, xrefs: 6D18175D
RichEdit Text and Objects, xrefs: 6D181787
Link Source Descriptor, xrefs: 6D18174F
Embedded Object, xrefs: 6D181717
FileNameW, xrefs: 6D18176B
Link Source, xrefs: 6D181733
Embed Source, xrefs: 6D181725
Native, xrefs: 6D1816EF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
API String ID: 1228543026-2889995556
Opcode ID: 14390eb8caed158c65398a64e5d945f9e0f15b9d9e58b1ab4ce06aab62338b12
Instruction ID: 6f6adbc58c309ccf8ae34219adefbfc045ed02b9104d972478daac7385cfcde1
Opcode Fuzzy Hash: 14390eb8caed158c65398a64e5d945f9e0f15b9d9e58b1ab4ce06aab62338b12
Instruction Fuzzy Hash: AC1159B18057809FCB209FF5F55C7257AF2BA8A20231A491EE196C6619DBF49042EF45

Function 6D07DF44 Relevance: 40.8, APIs: 27, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 6D05BBEC: GetWindowLongW.USER32(?,000000EC), ref: 6D05BBF9

GetClientRect.USER32(00000000,?), ref: 6D07DFAF
CopyRect.USER32(?,?), ref: 6D07DFDC

Part of subcall function 6D044090: ScreenToClient.USER32(?,6D0594E1), ref: 6D04409F
Part of subcall function 6D044090: ScreenToClient.USER32(?,6D0594E9), ref: 6D0440AC

IntersectRect.USER32(?,?,?), ref: 6D07E02F
SetRectEmpty.USER32(?), ref: 6D07E03D
IntersectRect.USER32(?,?,?), ref: 6D07E066
SetRectEmpty.USER32(?), ref: 6D07E074
IsRectEmpty.USER32(?), ref: 6D07E07E
IsRectEmpty.USER32(?), ref: 6D07E08C
GetWindowRect.USER32(00000000,?), ref: 6D07E0AE
GetWindowRect.USER32(00000000,?), ref: 6D07E0D1
UnionRect.USER32(?,?,?), ref: 6D07E0ED
EqualRect.USER32(?,?), ref: 6D07E0FB
GetWindowRect.USER32(00000000,?), ref: 6D07E18F
IsRectEmpty.USER32(?), ref: 6D07E1F0
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 6D07E20C
RedrawWindow.USER32(00000000,?,00000000,00000185), ref: 6D07E220
IsRectEmpty.USER32(?), ref: 6D07E234
EqualRect.USER32(?,?), ref: 6D07E246
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 6D07E262
RedrawWindow.USER32(00000000,?,00000000,00000185), ref: 6D07E276
UpdateWindow.USER32(00000000), ref: 6D07E285
IsRectEmpty.USER32(?), ref: 6D07E2CD
InvalidateRect.USER32(00000000,?,00000001), ref: 6D07E2E0
IsRectEmpty.USER32(?), ref: 6D07E2EA
EqualRect.USER32(?,?), ref: 6D07E2FC
InvalidateRect.USER32(00000000,?,00000001), ref: 6D07E30F
UpdateWindow.USER32(00000000), ref: 6D07E318

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Window$Empty$ClientEqual$IntersectInvalidatePointsRedrawScreenUpdate$CopyLongUnion
String ID:
API String ID: 4119827998-0
Opcode ID: 2a11369c3370d369315ed73d1b5f9734fb2a0321f17530a94a7b5a6efbadd99f
Instruction ID: b0c3dd2f4133aba4a71302392da668543c9af322ffc102650ffac670ed863133
Opcode Fuzzy Hash: 2a11369c3370d369315ed73d1b5f9734fb2a0321f17530a94a7b5a6efbadd99f
Instruction Fuzzy Hash: 8DD1EA7290020AAFEF11CFA4D988BDEB7FABF49304F104165E909EB151DB71AA85DF50

Function 6D0C36A7 Relevance: 34.7, APIs: 23, Instructions: 236windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0C36B1
CopyImage.USER32(?,00000000,00000000,00000000,00002000), ref: 6D0C36E7

Part of subcall function 6D0C4C94: __EH_prolog3_GS.LIBCMT ref: 6D0C4C9E
Part of subcall function 6D0C4C94: GetObjectW.GDI32(?,00000018,?), ref: 6D0C4CC3
Part of subcall function 6D0C4C94: GetObjectW.GDI32(?,00000054,?), ref: 6D0C4D08

GetObjectW.GDI32(?,00000018,?), ref: 6D0C3721
DeleteObject.GDI32(?), ref: 6D0C37A6
CreateCompatibleDC.GDI32(00000000), ref: 6D0C37D4
GetObjectW.GDI32(?,00000018,?), ref: 6D0C37F0
GetObjectW.GDI32(?,00000018,?), ref: 6D0C383A
SelectObject.GDI32(?,?), ref: 6D0C385D
SelectObject.GDI32(?,?), ref: 6D0C3894
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6D0C38BA
SelectObject.GDI32(?,00000000), ref: 6D0C38D5
CreateCompatibleDC.GDI32(?), ref: 6D0C3905
SelectObject.GDI32(?,?), ref: 6D0C3923
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6D0C3962
SelectObject.GDI32(?,?), ref: 6D0C3977
BitBlt.GDI32(?,?,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6D0C39AD
SelectObject.GDI32(?,?), ref: 6D0C39BF
SelectObject.GDI32(?,00000000), ref: 6D0C39D0
DeleteObject.GDI32(?), ref: 6D0C39E1
DeleteObject.GDI32(?), ref: 6D0C3A29
SelectObject.GDI32(?,?), ref: 6D0C3A41
SelectObject.GDI32(?,00000000), ref: 6D0C3A52
DeleteObject.GDI32(?), ref: 6D0C3A5E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Select$Delete$CompatibleCreate$H_prolog3_$BitmapCopyImage
String ID:
API String ID: 1780083495-0
Opcode ID: 14be642836f2dbbb3b381ff71296b574465f4c3303ebcf3c3952ba20f4eca558
Instruction ID: 0f923f92d8d85be1a352374addc5f4cf23ead8113959ad642902f925d94fde25
Opcode Fuzzy Hash: 14be642836f2dbbb3b381ff71296b574465f4c3303ebcf3c3952ba20f4eca558
Instruction Fuzzy Hash: 27A13870950629EFEB229F65DC84BEDBBF9FF0D301F004195E518A2250DB709A90DFA1

Function 6D042EB4 Relevance: 30.3, APIs: 20, Instructions: 265windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D042EBB
CreateCompatibleDC.GDI32(00000000), ref: 6D042F10
CreateCompatibleDC.GDI32(00000000), ref: 6D042F28
CreateCompatibleDC.GDI32(00000000), ref: 6D042F40
GetObjectW.GDI32(00000004,00000018,?), ref: 6D042F60
CreateBitmap.GDI32(?,?,?,?,00000000), ref: 6D042F86
CreateBitmap.GDI32(00000008,00000008,00000001,00000001,6D1BDA50), ref: 6D042FA9
CreatePatternBrush.GDI32(?), ref: 6D042FBB
DeleteObject.GDI32(?), ref: 6D042FEA
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 6D042FFB
GetPixel.GDI32(?,00000000,00000000), ref: 6D043043
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6D043069
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00EE0086), ref: 6D043091
FillRect.USER32(?,?,?), ref: 6D0430F3

Part of subcall function 6D044140: __EH_prolog3.LIBCMT ref: 6D044147

BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 6D043121
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,008800C6), ref: 6D04313C
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 6D043153
DeleteDC.GDI32(00000000), ref: 6D0431C0
DeleteDC.GDI32(00000000), ref: 6D0431DC
DeleteDC.GDI32(00000000), ref: 6D0431FB

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Create$Delete$BitmapCompatible$Object$BrushFillH_prolog3H_prolog3_PatternPixelRect
String ID:
API String ID: 308707564-0
Opcode ID: 06f7d75f7d6e96d942719c0cb55d5401d8f0eb432a28ef51c9fdf0913ea6fe4a
Instruction ID: 3031581a8cd16d84b89b7c67f74cf34bb3b4907317f767ccd3b84709db585bcc
Opcode Fuzzy Hash: 06f7d75f7d6e96d942719c0cb55d5401d8f0eb432a28ef51c9fdf0913ea6fe4a
Instruction Fuzzy Hash: 14B1DEB1C44209EFEF119FA5DD84EAEBBBABF08344F109029F615B7260DB715911DB60

Function 6D0C4367 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0C4371
CreateCompatibleDC.GDI32(00000000), ref: 6D0C43B9
GetObjectW.GDI32(?,00000018,?), ref: 6D0C43DA
SelectObject.GDI32(?,?), ref: 6D0C4415
CreateCompatibleDC.GDI32(?), ref: 6D0C4442
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 6D0C44AA
SelectObject.GDI32(?,00000000), ref: 6D0C44C1
SelectObject.GDI32(?,00000000), ref: 6D0C44D3
SelectObject.GDI32(?,00000000), ref: 6D0C44EA
DeleteObject.GDI32(?), ref: 6D0C44F6

Strings

, xrefs: 6D0C4535
(, xrefs: 6D0C4480

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Select$Create$Compatible$DeleteH_prolog3_Section
String ID: $(
API String ID: 1429849173-55695022
Opcode ID: c81ece3ccc1b3f4f11609a798041bb5f3dacf34d6c646c6a01f1bc5a0a3d3096
Instruction ID: 5b1c59d8a8c43563e26f23bd23b7b2161c64e120162f8d818200b11910295500
Opcode Fuzzy Hash: c81ece3ccc1b3f4f11609a798041bb5f3dacf34d6c646c6a01f1bc5a0a3d3096
Instruction Fuzzy Hash: 5AB14D30944269DFEF21CF65DC84BAEBBB5BF4A300F0081EAE549A7151DB709A84DF61

Function 6D04BD73 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 179windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

GetParent.USER32(?), ref: 6D04BDB4
SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 6D04BDD6
GetWindowRect.USER32(?,?), ref: 6D04BDFA
GetWindowLongW.USER32(00000000,000000F0), ref: 6D04BE1A
MonitorFromWindow.USER32(00000000,00000001), ref: 6D04BE53
GetMonitorInfoW.USER32(00000000), ref: 6D04BE5A
CopyRect.USER32(?,?), ref: 6D04BE68
GetWindowRect.USER32(00000000,?), ref: 6D04BE75
MonitorFromWindow.USER32(00000000,00000002), ref: 6D04BE82
GetMonitorInfoW.USER32(00000000), ref: 6D04BE89
CopyRect.USER32(?,?), ref: 6D04BE97
GetParent.USER32(?), ref: 6D04BEA1
GetClientRect.USER32(00000000,?), ref: 6D04BEAE
GetClientRect.USER32(00000000,?), ref: 6D04BEB9
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 6D04BEC7

Strings

(, xrefs: 6D04BE35

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Rect$Monitor$ClientCopyFromInfoLongParent$MessagePointsSend
String ID: (
API String ID: 3610148278-3887548279
Opcode ID: 39879463682c623a10eb5dd87c6fe020f5425b347027ef1f5ceed1aecdf96c0b
Instruction ID: 9dfaa119404ee1f5eee967ba14bdc48acaf4b7d14a74a39b8dc6e6387f0a89d1
Opcode Fuzzy Hash: 39879463682c623a10eb5dd87c6fe020f5425b347027ef1f5ceed1aecdf96c0b
Instruction Fuzzy Hash: DF616D7690460ADFDF01CFA8D988FEEB7BAFF89304F158224E515A7280DB70A955CB50

Function 6D0AFCAE Relevance: 29.0, APIs: 19, Instructions: 474windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0AFCB8
IsWindow.USER32(?), ref: 6D0AFD4F
GetMenuItemCount.USER32(00000001), ref: 6D0AFEF4
AppendMenuW.USER32(00000001,00000000,00000000,?), ref: 6D0AFF25
SendMessageW.USER32(?,0000040C,00000000,00000000), ref: 6D0AFFAB
SendMessageW.USER32(?,0000041C,00000000,?), ref: 6D0AFFEC
GetMenuItemCount.USER32(00000001), ref: 6D0B005F
AppendMenuW.USER32(00000001,00000800,00000000,00000000), ref: 6D0B0075
AppendMenuW.USER32(00000001,00000000,00000000,?), ref: 6D0B0090
GetMenuItemCount.USER32(00000001), ref: 6D0B00FF
AppendMenuW.USER32(00000001,00000800,00000000,00000000), ref: 6D0B0115
AppendMenuW.USER32(00000001,00000000,00000000,?), ref: 6D0B012F
AppendMenuW.USER32(00000001,00000800,00000000,00000000), ref: 6D0AFF0A

Part of subcall function 6D05BCD3: GetDlgCtrlID.USER32(?), ref: 6D05BCDE

AppendMenuW.USER32(00000002,00000000,00000000,?), ref: 6D0B0219
GetWindow.USER32(?,00000005), ref: 6D0B0249
AppendMenuW.USER32(00000003,00000000,00000000,?), ref: 6D0B02C4
GetMenuItemCount.USER32(?), ref: 6D0B0308
AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 6D0B031E
AppendMenuW.USER32(?,00000000,00000000,?), ref: 6D0B0335

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$Append$CountItem$MessageSendWindow$CtrlH_prolog3_
String ID:
API String ID: 465015882-0
Opcode ID: 5f7152486f21dfd9a9d02fdc2732a4dab6ef2c29e98eff8fd1f9e9671ddc62cc
Instruction ID: 37b52dbc2c67fc9abb9d313339bfa5cf6364ca3492976924bbb23dc559e14636
Opcode Fuzzy Hash: 5f7152486f21dfd9a9d02fdc2732a4dab6ef2c29e98eff8fd1f9e9671ddc62cc
Instruction Fuzzy Hash: 5802AE35A0821ADFEF158B60CD58BAD7BBABF49304F158098E909AB391DF71AD41CF50

Function 6D060A75 Relevance: 28.7, APIs: 19, Instructions: 239windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D060A7C
CreateRectRgnIndirect.GDI32(?), ref: 6D060AB4
CopyRect.USER32(?,?), ref: 6D060AC8
InflateRect.USER32(?,?,?), ref: 6D060ADE
IntersectRect.USER32(?,?,?), ref: 6D060AEA
CreateRectRgnIndirect.GDI32(?), ref: 6D060AF4
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6D060B09
CombineRgn.GDI32(?,?,?,00000003), ref: 6D060B23
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6D060B6A
SetRectRgn.GDI32(?,?,00000004,?,?), ref: 6D060B87
CopyRect.USER32(?,?), ref: 6D060B92
InflateRect.USER32(?,?,?), ref: 6D060BA8
IntersectRect.USER32(?,?,?), ref: 6D060BB4
SetRectRgn.GDI32(?,?,?,?,?), ref: 6D060BC9
CombineRgn.GDI32(?,?,?,00000003), ref: 6D060BDA
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6D060BEE
CombineRgn.GDI32(?,?,?,00000003), ref: 6D060C08

Part of subcall function 6D0609D1: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 6D060A18
Part of subcall function 6D0609D1: CreatePatternBrush.GDI32(00000000), ref: 6D060A25
Part of subcall function 6D0609D1: DeleteObject.GDI32(00000000), ref: 6D060A31

PatBlt.GDI32(00000004,?,?,?,?,005A0049), ref: 6D060C66

Part of subcall function 6D0435C3: SelectObject.GDI32(?,00000000), ref: 6D0435E3
Part of subcall function 6D0435C3: SelectObject.GDI32(?,00000000), ref: 6D0435F9

Part of subcall function 6D043A1A: SelectClipRgn.GDI32(?,00000000), ref: 6D043A3A
Part of subcall function 6D043A1A: SelectClipRgn.GDI32(?,00000000), ref: 6D043A50

PatBlt.GDI32(00000004,?,?,?,?,005A0049), ref: 6D060CC9

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Create$Select$CombineObject$ClipCopyIndirectInflateIntersect$BitmapBrushDeleteH_prolog3_Pattern
String ID:
API String ID: 770706554-0
Opcode ID: ca4eb53a1273480d9d73bdb1b704a1819e63ce864618883335abbc6078c06dc8
Instruction ID: 21a66c38e9cd8795452bed7f3d348cdfc61a27d677bb6acc58bc16a032e7e7d2
Opcode Fuzzy Hash: ca4eb53a1273480d9d73bdb1b704a1819e63ce864618883335abbc6078c06dc8
Instruction Fuzzy Hash: B891F4B1904219AFDF05DFE4D984EEEBBBAFF48304B014519FA06E3240DB74A910DB60

Function 6D04F05F Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 178COMMON

Download Yara Rule

Strings

#32768, xrefs: 6D04F1C7, 6D04F1CD, 6D04F206
AfxOldWndProc423, xrefs: 6D04F237, 6D04F248, 6D04F254, 6D04F264
,}!m, xrefs: 6D04F0A5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID: #32768$,}!m$AfxOldWndProc423
API String ID: 0-2807663439
Opcode ID: 3943a892cfd4c37b1b73f876722338ced291e30aee4f58038a1f16e6980a29af
Instruction ID: 50e2febe685f4fb152f2c190ff8db06f520049ec5e9b1578f5af3057cef5a535
Opcode Fuzzy Hash: 3943a892cfd4c37b1b73f876722338ced291e30aee4f58038a1f16e6980a29af
Instruction Fuzzy Hash: 8D51F335904119EBEF119F61ED88FBE3FF8AF45714F0080A5F915A7285DB709A40DBA1

Function 6D0A6A4A Relevance: 27.3, APIs: 18, Instructions: 337windowtimeCOMMON

Download Yara Rule

APIs

InflateRect.USER32(?,00000004,00000004), ref: 6D0A6AA3
InvalidateRect.USER32(?,?,00000001), ref: 6D0A6AB5
UpdateWindow.USER32(?), ref: 6D0A6ABE
GetMessageW.USER32(?,00000000,0000000F,0000000F), ref: 6D0A6AFF
DispatchMessageW.USER32(?), ref: 6D0A6B11
PeekMessageW.USER32(?,00000000,0000000F,0000000F,00000000), ref: 6D0A6B21
GetCapture.USER32 ref: 6D0A6B2B
SetCapture.USER32(?), ref: 6D0A6B3C
GetCapture.USER32 ref: 6D0A6B48
GetWindowRect.USER32(?,?), ref: 6D0A6B70
SetCursorPos.USER32(?,?), ref: 6D0A6B97
GetCapture.USER32 ref: 6D0A6B9D
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 6D0A6BB6
DispatchMessageW.USER32(?), ref: 6D0A6BE0
ReleaseCapture.USER32 ref: 6D0A6C20
IsWindow.USER32(?), ref: 6D0A6C29
SendMessageW.USER32(8589084D,00000010,00000000,00000000), ref: 6D0A6C42
SetTimer.USER32(?,0000EC05,00000000), ref: 6D0AA6FC

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Message$Capture$RectWindow$Dispatch$CursorInflateInvalidatePeekReleaseSendTimerUpdate
String ID:
API String ID: 3094444671-0
Opcode ID: 319a174dda741797316062e7462b1b32a597d17e79993decb2b4c860250d62ee
Instruction ID: 5f02e51aa9add0e7b397ca5d61aced1113f0ce0b4e31488a205439c4aa4de38c
Opcode Fuzzy Hash: 319a174dda741797316062e7462b1b32a597d17e79993decb2b4c860250d62ee
Instruction Fuzzy Hash: 37B1B775B04616ABEF04DBA8DC88BBE7BB9FF46354F554029F911A7281DF70A900CB90

Function 6D0C3E5D Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0C3E67
GetObjectW.GDI32(00000000,00000018,?), ref: 6D0C3EA5
CreateCompatibleDC.GDI32(00000000), ref: 6D0C3EE4
SelectObject.GDI32(?,00000000), ref: 6D0C3F07
GetObjectW.GDI32(?,00000054,?), ref: 6D0C3F54
CreateDIBSection.GDI32(?,?), ref: 6D0C3FB6
CreateCompatibleDC.GDI32(?), ref: 6D0C3FF0
SelectObject.GDI32(?,00000000), ref: 6D0C4009

Strings

(, xrefs: 6D0C3F9F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Create$CompatibleSelect$H_prolog3_Section
String ID: (
API String ID: 1338481308-3887548279
Opcode ID: 40fa1af677911f2370c1da8ac85f370b8012ddb65d17c0e2c26cdbd635e4da42
Instruction ID: fda3d98f666eb39b8daa84e8a32fa26efe83ccb301896b3877820edc09e0b39f
Opcode Fuzzy Hash: 40fa1af677911f2370c1da8ac85f370b8012ddb65d17c0e2c26cdbd635e4da42
Instruction Fuzzy Hash: 38A11574944719EFEB61CF24D880B9EBBF5BF09300F1085A9E94DA7251DB70AA85CF21

Function 6D12F516 Relevance: 24.4, APIs: 16, Instructions: 395COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D12F51D
GetCursorPos.USER32(?), ref: 6D12F5D6
IsRectEmpty.USER32(?), ref: 6D12F60A
IsRectEmpty.USER32(?), ref: 6D12F631
IsRectEmpty.USER32(?), ref: 6D12F653
GetWindowRect.USER32(?,?), ref: 6D12F681
GetWindowRect.USER32(?,?), ref: 6D12F6B1
PtInRect.USER32(?,?,?), ref: 6D12F6FE
OffsetRect.USER32(?,?,00000000), ref: 6D12F716

Part of subcall function 6D130B02: __EH_prolog3.LIBCMT ref: 6D130B09
Part of subcall function 6D130B02: SetRectEmpty.USER32 ref: 6D130C09
Part of subcall function 6D130B02: SetRectEmpty.USER32(?), ref: 6D130C10

SetRectEmpty.USER32(?), ref: 6D12F739
OffsetRect.USER32(?,?,?), ref: 6D12F8CA
IsRectEmpty.USER32(?), ref: 6D12F8EA
IsRectEmpty.USER32(?), ref: 6D12F91D
PtInRect.USER32(?,00000000,00000000), ref: 6D12F931
OffsetRect.USER32(?,?,?), ref: 6D12F95D
IsRectEmpty.USER32(?), ref: 6D12F97C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Empty$Offset$Window$CursorH_prolog3H_prolog3_
String ID:
API String ID: 359163869-0
Opcode ID: 4fb07c1b25ebc62a3f23922f7ccdc4119fb6e1e316db03d0bf71b28c344773ba
Instruction ID: dc4eb8a9b4c5dcc29fe99e8a585cff7dd53177b9e8f4e92972fcce7767590684
Opcode Fuzzy Hash: 4fb07c1b25ebc62a3f23922f7ccdc4119fb6e1e316db03d0bf71b28c344773ba
Instruction Fuzzy Hash: 25E1A131A0020ADFDF05CFA5C984BAE7BBAFF48314F154169E925AF249DBB1D885CB50

Function 6D0C6270 Relevance: 24.2, APIs: 16, Instructions: 155windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0C6277
CreateCompatibleDC.GDI32(00000000), ref: 6D0C62A5
GetObjectW.GDI32(?,00000018,?), ref: 6D0C62BE
SelectObject.GDI32(?,?), ref: 6D0C62DA
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6D0C62FB
SelectObject.GDI32(?,00000000), ref: 6D0C630C
CreateCompatibleDC.GDI32(?), ref: 6D0C6326
SelectObject.GDI32(?,?), ref: 6D0C633B
SelectObject.GDI32(?,00000000), ref: 6D0C634C
DeleteObject.GDI32(?), ref: 6D0C6355
BitBlt.GDI32(?,00000000,00000000,000000FF,?,?,00000000,00000000,00CC0020), ref: 6D0C6375
GetPixel.GDI32(?,?,00000000), ref: 6D0C639B
SetPixel.GDI32(?,?,00000000,00000000), ref: 6D0C63E2
SelectObject.GDI32(?,?), ref: 6D0C6409
SelectObject.GDI32(?,00000000), ref: 6D0C6413
DeleteObject.GDI32(?), ref: 6D0C641B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeletePixel$BitmapH_prolog3
String ID:
API String ID: 3639146769-0
Opcode ID: 9ee9bd20f6b20c95397cf4f0f38af8b9d5c28a5214228382eeaed00f47c8e285
Instruction ID: af53f0a350917000fe7254ff60d94654e7e44568c8ec59cea5406244757d308c
Opcode Fuzzy Hash: 9ee9bd20f6b20c95397cf4f0f38af8b9d5c28a5214228382eeaed00f47c8e285
Instruction Fuzzy Hash: AD51357085421AEFEF228FA4EC88BEEBBB6FF09310F504025F511A2160CBB19951DB91

Function 6D064A9E Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 204timekeyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000001), ref: 6D064AA9
GetCursorPos.USER32(?), ref: 6D064ACE
ScreenToClient.USER32(?,?), ref: 6D064ADB
GetCapture.USER32 ref: 6D064B4D
ClientToScreen.USER32(?,?), ref: 6D064B90
WindowFromPoint.USER32(?,?), ref: 6D064B9C
IsChild.USER32(?,?), ref: 6D064BB4
KillTimer.USER32(?,0000EC0A), ref: 6D064BF4
KillTimer.USER32(?,0000EC09), ref: 6D064C1D

Part of subcall function 6D04ED60: GetForegroundWindow.USER32 ref: 6D04ED6D
Part of subcall function 6D04ED60: GetLastActivePopup.USER32(?), ref: 6D04ED7E

GetParent.USER32(?), ref: 6D064C74
IsAppThemed.UXTHEME ref: 6D064CCE
OpenThemeData.UXTHEME(?,REBAR), ref: 6D064CE0

Strings

REBAR, xrefs: 6D064CD8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClientKillScreenTimerWindow$ActiveCaptureChildCursorDataForegroundFromLastOpenParentPointPopupStateThemeThemed
String ID: REBAR
API String ID: 214255902-925029515
Opcode ID: e10cdf92847755763f916fa81b461b89680c8686e9ecfa105223b706c04aa708
Instruction ID: 99de56f0cc24ed466e19cff8eafd57d8228e71fa08e58a6978fd6e9c9bab2493
Opcode Fuzzy Hash: e10cdf92847755763f916fa81b461b89680c8686e9ecfa105223b706c04aa708
Instruction Fuzzy Hash: 8661D331B08206AFEB059FA4C994B7E7BFABF49354B104169E912D7390EB70DD01CB60

Function 6D06614A Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 172libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?), ref: 6D06617D
GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 6D06618D
EncodePointer.KERNEL32(00000000,?,?), ref: 6D066196
DecodePointer.KERNEL32(00000000,?,?), ref: 6D0661A4
GetUserDefaultUILanguage.KERNEL32(?,?), ref: 6D0661CB
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6D0661DB
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6D06620F
GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6D066242
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6D066252
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6D06628F
___crtDownlevelLCIDToLocaleName.LIBCPMT ref: 6D0662CA

Strings

GetThreadPreferredUILanguages, xrefs: 6D066187
kernel32.dll, xrefs: 6D066178

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: DownlevelLocaleName___crt$DefaultLanguagePointer$AddressDecodeEncodeHandleModuleProcSystemUser
String ID: GetThreadPreferredUILanguages$kernel32.dll
API String ID: 404278886-1646127487
Opcode ID: 3aa71e48c439b4340ae412e8475ab59985e39b5a76d4e90199248db8a1a14a6a
Instruction ID: abc13f9d81836cd6c8039bbc6d2a1bd7ecddac92928330f6f2243bb3b5d90c78
Opcode Fuzzy Hash: 3aa71e48c439b4340ae412e8475ab59985e39b5a76d4e90199248db8a1a14a6a
Instruction Fuzzy Hash: 6E511A71D0421AAFDB04DFA4C984EBFB7BDEF49304F450165E605E7241DB74AA05CBA1

Function 6D05380D Relevance: 22.9, APIs: 15, Instructions: 351windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 6D0539E7

Part of subcall function 6D05BF75: ShowWindow.USER32(?,00000000,?,?,6D05975A,00000000), ref: 6D05BF86

Part of subcall function 6D053773: GetDesktopWindow.USER32 ref: 6D05377C
Part of subcall function 6D053773: GetWindow.USER32(00000000), ref: 6D053783
Part of subcall function 6D053773: GetWindowLongW.USER32(00000000,000000F0), ref: 6D0537B1
Part of subcall function 6D053773: ShowWindow.USER32(00000000,00000000), ref: 6D0537CC
Part of subcall function 6D053773: GetWindow.USER32(00000000,00000002), ref: 6D0537FA

GetDlgItem.USER32(?,?), ref: 6D053AA4
ShowWindow.USER32(00000000,00000000,?,?,?), ref: 6D053AB2
GetMenu.USER32(?), ref: 6D053AC4
InvalidateRect.USER32(?,00000000,00000001), ref: 6D053AE0
GetDlgItem.USER32(?,0000E900), ref: 6D053B2C
SetWindowLongW.USER32(00000000,000000F4,0000EA21), ref: 6D053B40
GetDlgItem.USER32(?,0000EA21), ref: 6D053B5C
GetDlgItem.USER32(?,0000E900), ref: 6D053B72
SetWindowLongW.USER32(00000000,000000F4,0000EA21), ref: 6D053B84
SetWindowLongW.USER32(?,000000F4,0000E900), ref: 6D053B90
InvalidateRect.USER32(?,00000000,00000001), ref: 6D053BA3
SetMenu.USER32(?,00000000), ref: 6D053BBA
GetDlgItem.USER32(?,?), ref: 6D053C17
ShowWindow.USER32(?,00000005), ref: 6D053C25

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Item$LongShow$InvalidateMenuRect$CtrlDesktop
String ID:
API String ID: 2951210208-0
Opcode ID: 5111012a23d6a8899618efd57983cf04af1431b4d39b6c323932aba278c63235
Instruction ID: 35a0b29caab35e8cf5bb4df2915a7091a188faaef7992f124a0e565126c72378
Opcode Fuzzy Hash: 5111012a23d6a8899618efd57983cf04af1431b4d39b6c323932aba278c63235
Instruction Fuzzy Hash: 4CD17F35B04616EBEF05DF64C988BADBBB5FF49710F004569ED25AB390DB70A920CB90

Function 6D054BC8 Relevance: 22.8, APIs: 15, Instructions: 313windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 6D0601E7: GetFocus.USER32 ref: 6D0601EB
Part of subcall function 6D0601E7: GetParent.USER32(00000000), ref: 6D06020C
Part of subcall function 6D0601E7: GetWindowLongW.USER32(00000000,000000F0), ref: 6D06022B
Part of subcall function 6D0601E7: GetParent.USER32(00000000), ref: 6D060239
Part of subcall function 6D0601E7: GetDesktopWindow.USER32 ref: 6D060241
Part of subcall function 6D0601E7: SendMessageW.USER32(00000000,0000014F,00000000,00000000), ref: 6D060255

GetMenu.USER32(?), ref: 6D054C49
GetMenuItemCount.USER32(?), ref: 6D054C87
GetSubMenu.USER32(?,00000000), ref: 6D054C9D
GetMenuItemCount.USER32(?), ref: 6D054CC2
GetMenuItemID.USER32(?,00000000), ref: 6D054CDC
GetSubMenu.USER32(?,?), ref: 6D054CF8
GetMenuItemID.USER32(?,00000000), ref: 6D054D10
GetMenuItemCount.USER32(?), ref: 6D054D31
GetMenuItemID.USER32(?,?), ref: 6D054D67
SendMessageW.USER32(?,00000362,-0000E001,00000000), ref: 6D054E23
UpdateWindow.USER32(?), ref: 6D054E44
GetKeyState.USER32(00000079), ref: 6D054E62
GetKeyState.USER32(00000012), ref: 6D054E73
GetParent.USER32(?), ref: 6D054F35
PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 6D054F4F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$Item$CountMessageParentWindow$SendState$DesktopFocusLongPostUpdate
String ID:
API String ID: 1315724587-0
Opcode ID: 9ee495ea8587c927e22074e0fd2782b5f0ca70213e1c72a60a811aaff07dc971
Instruction ID: 36dc6bd9931bb108d314acf4bd794684f82bdf4efec2a4282506c79456798b3a
Opcode Fuzzy Hash: 9ee495ea8587c927e22074e0fd2782b5f0ca70213e1c72a60a811aaff07dc971
Instruction Fuzzy Hash: 6DC17C74A0420AEBEB059F65CA84BEDBBF5FF49354F008169ED25A7250DB70D870DB60

Function 6D07F275 Relevance: 22.8, APIs: 15, Instructions: 254timeCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D07F2AF
InflateRect.USER32(?,00000000,00000000), ref: 6D07F2E9
SetRectEmpty.USER32(?), ref: 6D07F38D
SetRectEmpty.USER32(?), ref: 6D07F39A
GetSystemMetrics.USER32(00000002), ref: 6D07F3BF
KillTimer.USER32(?,0000EC16,?,00000000,00000000), ref: 6D07F46F
EqualRect.USER32(?,?), ref: 6D07F48C
EqualRect.USER32(?,?), ref: 6D07F4A1
EqualRect.USER32(?,?), ref: 6D07F510
InvalidateRect.USER32(?,?,00000001,?,00000000,00000000), ref: 6D07F525
InvalidateRect.USER32(?,?,00000001,?,00000000,00000000), ref: 6D07F536
EqualRect.USER32(?,?), ref: 6D07F549
InvalidateRect.USER32(?,?,00000001,?,00000000,00000000), ref: 6D07F55B
InvalidateRect.USER32(?,?,00000001,?,00000000,00000000), ref: 6D07F56C
UpdateWindow.USER32(?), ref: 6D07F57D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$EqualInvalidate$Empty$ClientInflateKillMetricsSystemTimerUpdateWindow
String ID:
API String ID: 2140115980-0
Opcode ID: f74892ff3bbd5b3e1b41064a21c65482ab1a2b443b577a8c40bd64783e48adb1
Instruction ID: 338b64d3b53c5e4bbafb7839b0ac4c3ced5bd2f476b4edee54e3ace4381a06cc
Opcode Fuzzy Hash: f74892ff3bbd5b3e1b41064a21c65482ab1a2b443b577a8c40bd64783e48adb1
Instruction Fuzzy Hash: DAA13A7290011A9FDF11CF68D988BEE7BB9BF4A340F0441B5ED19AF205DB70A945DB60

Function 6D042BFF Relevance: 22.7, APIs: 15, Instructions: 212windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D042C06
GetSysColor.USER32(00000014), ref: 6D042C3D

Part of subcall function 6D043347: __EH_prolog3.LIBCMT ref: 6D04334E
Part of subcall function 6D043347: CreateSolidBrush.GDI32(6D04F80B), ref: 6D043369

GetSysColor.USER32(00000010), ref: 6D042C52
CreateCompatibleDC.GDI32(00000000), ref: 6D042C66
CreateCompatibleDC.GDI32(00000000), ref: 6D042C7E
GetObjectW.GDI32(10C2C95B,00000018,?), ref: 6D042CA1
CreateBitmap.GDI32(?,?,?,?,00000000), ref: 6D042CC2
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 6D042CE3

Part of subcall function 6D043D66: SelectObject.GDI32(6D04F80B,?), ref: 6D043D6F

GetPixel.GDI32(?,00000000,00000000), ref: 6D042D2B

Part of subcall function 6D043676: SetBkColor.GDI32(?,6D04F80B), ref: 6D04368B
Part of subcall function 6D043676: SetBkColor.GDI32(?,6D04F80B), ref: 6D04369D

BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6D042D54
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,001100A6), ref: 6D042D7E
BitBlt.GDI32(?,00000001,00000001,?,?,?,00000000,00000000,00E20746), ref: 6D042DE9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00E20746), ref: 6D042E12
DeleteDC.GDI32(00000000), ref: 6D042E87
DeleteDC.GDI32(00000000), ref: 6D042EA6

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Create$Color$BitmapCompatibleDeleteH_prolog3Object$BrushPixelSelectSolid
String ID:
API String ID: 2254850417-0
Opcode ID: 2ced1c223e570578bf997103afc6c8b1da78503a029b2e79ddda2a8717281f9b
Instruction ID: aef1ed98f770c7db1ec15e4a26a992c478fee3e5f02dd935ba64c5d37c37146f
Opcode Fuzzy Hash: 2ced1c223e570578bf997103afc6c8b1da78503a029b2e79ddda2a8717281f9b
Instruction Fuzzy Hash: D4810671944209EBEF119FE1DD85FEEBFBAAF18304F108029F611B61A0DBB15A51DB60

Function 6D059854 Relevance: 21.4, APIs: 14, Instructions: 439COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 6D05988D
GetClientRect.USER32(?,?), ref: 6D0598D8
BeginDeferWindowPos.USER32(?), ref: 6D059903
GetWindowRect.USER32(?,?), ref: 6D0599E9
OffsetRect.USER32(?,?,00000000), ref: 6D059A20
OffsetRect.USER32(?,?,00000000), ref: 6D059A56
OffsetRect.USER32(?,00000002,00000000), ref: 6D059A80
EqualRect.USER32(?,?), ref: 6D059A8E
OffsetRect.USER32(?,00000000,?), ref: 6D059B5B
OffsetRect.USER32(?,00000000,00000002), ref: 6D059B93
OffsetRect.USER32(?,00000000,00000002), ref: 6D059BB9
EqualRect.USER32(?,?), ref: 6D059BF0
EndDeferWindowPos.USER32(00000000), ref: 6D059D06
SetRectEmpty.USER32(?), ref: 6D059D17

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Offset$Window$DeferEmptyEqual$BeginClient
String ID:
API String ID: 3160784657-0
Opcode ID: adb240a5aab1c8f5fe8bbdfdf1ad15b640aaa89b621c6630138d20179a37f46a
Instruction ID: 46f2605a83284973afeea7e8ba8b8bb3e845a7bb237b0126803b67969b1c4d78
Opcode Fuzzy Hash: adb240a5aab1c8f5fe8bbdfdf1ad15b640aaa89b621c6630138d20179a37f46a
Instruction Fuzzy Hash: 7F022B71E0021ADFEF04CFA8DA84BAEBBF6FF49304F144169E915AB241DB70A955CB50

Function 6D07EE2B Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 347windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D07EE35
GetClientRect.USER32(?,?), ref: 6D07EE53
CreateCompatibleDC.GDI32(00000000), ref: 6D07EE8C
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6D07EEE1
CreateDIBSection.GDI32(?,?), ref: 6D07EF53
CreateDIBSection.GDI32(?,00000028,00000000,?,00000000,00000000), ref: 6D07EF8C
CreateDIBSection.GDI32(?,00000028,00000000,?,00000000,00000000), ref: 6D07EFBF
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6D07F027
GetWindowRect.USER32(?,?), ref: 6D07F096
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 6D07F1E6

Strings

(, xrefs: 6D07EF2F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Create$Section$CompatibleRect$BitmapClientH_prolog3_Window
String ID: (
API String ID: 2918208214-3887548279
Opcode ID: a58cbd81bb6d742c49435dd9b85fbb183c36b0c20d1a6be3756d1c8789a5e985
Instruction ID: b9d63189b9e002b37408bdca084bebebfc826adbdd66c5a01f1ff6d928369277
Opcode Fuzzy Hash: a58cbd81bb6d742c49435dd9b85fbb183c36b0c20d1a6be3756d1c8789a5e985
Instruction Fuzzy Hash: B0D11C71A0461ADFEF25CFA8C984AEDBBB9FF08304F114129E519AB211DB30AD51CF54

Function 6D079473 Relevance: 21.3, APIs: 14, Instructions: 317windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D07947A
MessageBeep.USER32(000000FF), ref: 6D079498
ScreenToClient.USER32(?,?), ref: 6D079515
UpdateWindow.USER32(?), ref: 6D079590
UpdateWindow.USER32(?), ref: 6D0795DE
GetFocus.USER32 ref: 6D079768
GetParent.USER32(?), ref: 6D079783
GetParent.USER32(?), ref: 6D0797B1
UpdateWindow.USER32(?), ref: 6D079845
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 6D079882

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: UpdateWindow$MessageParent$BeepClientFocusH_prolog3_ScreenSend
String ID:
API String ID: 841119998-0
Opcode ID: ddbe8d51db4e1f9206eac14b192af398f742ecbf1735103c07d38cca30962e27
Instruction ID: 56ddf46f24bab118acc0d8f42bb5b43f4a6cea731f7c4d402c572f9660a9f16e
Opcode Fuzzy Hash: ddbe8d51db4e1f9206eac14b192af398f742ecbf1735103c07d38cca30962e27
Instruction Fuzzy Hash: 83C1B135A0021AEFEF15DF74D888BAD7BB6FF49318F114269E925AB290DB309901CF54

Function 6D0BBA26 Relevance: 21.2, APIs: 1, Strings: 11, Instructions: 216COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0BBA2D

Part of subcall function 6D040987: __EH_prolog3.LIBCMT ref: 6D04098E

Part of subcall function 6D14B653: __EH_prolog3.LIBCMT ref: 6D14B65A

Strings

MFCPropertyGrid, xrefs: 6D0BBBE5
MFCButton, xrefs: 6D0BBA4C
MFCFontComboBox, xrefs: 6D0BBAFD
MFCMaskedEdit, xrefs: 6D0BBB71
MFCVSListBox, xrefs: 6D0BBC85
MFCMenuButton, xrefs: 6D0BBBAB
MFCEditBrowse, xrefs: 6D0BBAC3
MFCColorButton, xrefs: 6D0BBA89
MFCShellList, xrefs: 6D0BBC1F
MFCLink, xrefs: 6D0BBB37
MFCShellTree, xrefs: 6D0BBC52

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3
String ID: MFCButton$MFCColorButton$MFCEditBrowse$MFCFontComboBox$MFCLink$MFCMaskedEdit$MFCMenuButton$MFCPropertyGrid$MFCShellList$MFCShellTree$MFCVSListBox
API String ID: 431132790-2110171958
Opcode ID: 3da870f91668c7a2dcd464e59f8646a16b0342e09006b53482cd0c25dd6bd869
Instruction ID: 469c843a554743a8c2c7014749d4643be4725b4d862ccc3e31a4d3508b3ae2ac
Opcode Fuzzy Hash: 3da870f91668c7a2dcd464e59f8646a16b0342e09006b53482cd0c25dd6bd869
Instruction Fuzzy Hash: 2E61AE61D0C30ADAFF04DBF99955BBE67E4AF15218F11802A9220FB1C1EFB69E04C765

Function 6D0CCEAE Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 195COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0CCEB5

Part of subcall function 6D0BE360: __EH_prolog3.LIBCMT ref: 6D0BE367

GetWindowRect.USER32(?,?), ref: 6D0CCF9B

Part of subcall function 6D05BCD3: GetDlgCtrlID.USER32(?), ref: 6D05BCDE

Part of subcall function 6D0CEBBB: GetWindowRect.USER32(?,?), ref: 6D0CEBC9

Strings

MRUWidth, xrefs: 6D0CD0B1
RectRecentFloat, xrefs: 6D0CD015
%TsPane-%d, xrefs: 6D0CCF02
Panes, xrefs: 6D0CCEC2
RecentRowIndex, xrefs: 6D0CD074
%TsPane-%d%x, xrefs: 6D0CCF19
RectRecentDocked, xrefs: 6D0CD036
PinState, xrefs: 6D0CD0D1
RecentFrameAlignment, xrefs: 6D0CD054
IsFloating, xrefs: 6D0CD091

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3RectWindow$Ctrl
String ID: %TsPane-%d$%TsPane-%d%x$IsFloating$MRUWidth$Panes$PinState$RecentFrameAlignment$RecentRowIndex$RectRecentDocked$RectRecentFloat
API String ID: 2598721110-2628993547
Opcode ID: 76a569485b80bb0c40060bd9d850fa34c4bc2878435a0934ce681b8b359d23ce
Instruction ID: 4312151edaae94df060cba5e4d42668d4ff1a611d2be09151da36dea64ef245c
Opcode Fuzzy Hash: 76a569485b80bb0c40060bd9d850fa34c4bc2878435a0934ce681b8b359d23ce
Instruction Fuzzy Hash: 2C81103560011ADFDF04DFA5CC98ABD77B6BF89314F054468E926AB3A1DB71A802CF51

Function 6D08063F Relevance: 19.8, APIs: 13, Instructions: 273windowCOMMON

Download Yara Rule

APIs

GetMessageW.USER32(?,00000000,0000000F,0000000F), ref: 6D080672
DispatchMessageW.USER32(?), ref: 6D080680
PeekMessageW.USER32(?,00000000,0000000F,0000000F,00000000), ref: 6D08068E
GetCapture.USER32 ref: 6D080698
SetCapture.USER32(?), ref: 6D0806AC
GetWindowRect.USER32(?,?), ref: 6D0806C9
GetCapture.USER32 ref: 6D08073C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 6D080759
DispatchMessageW.USER32(?), ref: 6D08077F
GetScrollPos.USER32(00000000,00000002), ref: 6D08089C
RedrawWindow.USER32(?,00000000,00000000,00000581), ref: 6D0808B9
ReleaseCapture.USER32 ref: 6D08095B
IsWindow.USER32(?), ref: 6D080964

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Message$Capture$Window$Dispatch$PeekRectRedrawReleaseScroll
String ID:
API String ID: 1873598099-0
Opcode ID: 790700ff821b14420f8247909d9f1b32eadf1290c90f1be5e47504d3f47c69ab
Instruction ID: c64faa9d40291bd0e4342b0b618acb7fedf211c7e3e3a41912f5fdeab608b0ae
Opcode Fuzzy Hash: 790700ff821b14420f8247909d9f1b32eadf1290c90f1be5e47504d3f47c69ab
Instruction Fuzzy Hash: 8AA17C35A05215DFEF04CF65C898BEE7BB5BF89704F054179E916AB286CB709841CFA0

Function 6D04761D Relevance: 19.6, APIs: 13, Instructions: 146windowCOMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,?,6D03CBDF,00000000,00000000,?,?,?,6D03CBDF,?,?,?,?,6D03CA1A), ref: 6D04762C
LockResource.KERNEL32(00000000,?,6D03CBDF,?,?,?,?,6D03CA1A), ref: 6D04763B
GetSysColor.USER32 ref: 6D0476BF
GetSysColor.USER32 ref: 6D0476D2
GetSysColor.USER32 ref: 6D0476ED
GetDC.USER32(00000000), ref: 6D047723
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 6D047733
CreateCompatibleDC.GDI32(00000000), ref: 6D047741
SelectObject.GDI32(00000000,?), ref: 6D04774D
StretchDIBits.GDI32(00000000,00000000,00000000,6D03CBDF,?,00000000,00000000,6D03CBDF,?,?,00000000,00000000,00CC0020), ref: 6D047780
SelectObject.GDI32(00000000,00000000), ref: 6D047788
DeleteDC.GDI32(00000000), ref: 6D04778F
ReleaseDC.USER32(00000000,00000000), ref: 6D04779B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Color$CompatibleCreateObjectResourceSelect$BitmapBitsDeleteLoadLockReleaseStretch
String ID:
API String ID: 257281507-0
Opcode ID: bc7ad0f0dab44f0ffe0fa61c63e63d01ba14dda66c3be3b4a48c58f487bc618c
Instruction ID: 093dd61e9e87b2702206dea14174b1b6dc3f1353bd8245779ee4fccc46961451
Opcode Fuzzy Hash: bc7ad0f0dab44f0ffe0fa61c63e63d01ba14dda66c3be3b4a48c58f487bc618c
Instruction Fuzzy Hash: 16417E75A00115EFEB109F69D884FBEBBFAEFCA351B11C069F505A7240D7B09911DBA0

Function 6D05B302 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 171windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,?,00000403), ref: 6D05B332
GetFocus.USER32 ref: 6D05B34C
GetParent.USER32(?), ref: 6D05B357
SendMessageW.USER32(?,00000028,00000000,00000000), ref: 6D05B36C
CheckMenuItem.USER32(?,?,00000400), ref: 6D05B3BF
SendMessageW.USER32(?,00000087,00000000,00000000), ref: 6D05B3DA
SendMessageW.USER32(?,000000F1,?,00000000), ref: 6D05B3F7
SetMenuItemBitmaps.USER32(?,?,00000400,00000000,00000000), ref: 6D05B464
SetMenuItemInfoW.USER32(?,?,00000001,?), ref: 6D05B4B4

Strings

0, xrefs: 6D05B4A3
@, xrefs: 6D05B4AA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ItemMenu$MessageSend$BitmapsCheckEnableFocusInfoParent
String ID: 0$@
API String ID: 2977031974-1545510068
Opcode ID: 429c6f9fa5153f2206d379ca94482c1f38f869a6575f5044ee8015966609b4bb
Instruction ID: c6d922327fa234d3d58eda55507a0a2cfbae156e4c2c1318d3d15f0eed5adfe3
Opcode Fuzzy Hash: 429c6f9fa5153f2206d379ca94482c1f38f869a6575f5044ee8015966609b4bb
Instruction Fuzzy Hash: 6151CC31200206EFEB248F15D948F6ABBFAFF44705F108568FA19AB550DBB0F860CB91

Function 6D0CCCB1 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 164COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0CCCB8

Part of subcall function 6D0BE360: __EH_prolog3.LIBCMT ref: 6D0BE367

Part of subcall function 6D05BCD3: GetDlgCtrlID.USER32(?), ref: 6D05BCDE

Part of subcall function 6D0CA004: __EH_prolog3.LIBCMT ref: 6D0CA00B

Strings

MRUWidth, xrefs: 6D0CCE30
RectRecentFloat, xrefs: 6D0CCD8F
%TsPane-%d, xrefs: 6D0CCD08
Panes, xrefs: 6D0CCCC8
RecentRowIndex, xrefs: 6D0CCDF6
%TsPane-%d%x, xrefs: 6D0CCD1F
RectRecentDocked, xrefs: 6D0CCDAC
PinState, xrefs: 6D0CCE4D
RecentFrameAlignment, xrefs: 6D0CCDDE
IsFloating, xrefs: 6D0CCE13

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3$Ctrl
String ID: %TsPane-%d$%TsPane-%d%x$IsFloating$MRUWidth$Panes$PinState$RecentFrameAlignment$RecentRowIndex$RectRecentDocked$RectRecentFloat
API String ID: 3879667756-2628993547
Opcode ID: 0a0481e9953925605dcdb9b1db71ca2d8f308ab405bc6d3cbcef50918334677a
Instruction ID: 394e5c1f860194b641e8e31dc53cef829cd0319f2d51fee660a24f72c35c41a6
Opcode Fuzzy Hash: 0a0481e9953925605dcdb9b1db71ca2d8f308ab405bc6d3cbcef50918334677a
Instruction Fuzzy Hash: 3D51A275A0011AAFDF04DF60CC98AFE7BB5FF8A314B050059E926A7381DB35AD06CB91

Function 6D0770B7 Relevance: 18.4, APIs: 12, Instructions: 406timewindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0770BE
SetCursor.USER32(?,00000200,00000000), ref: 6D07715D

Part of subcall function 6D043E99: __EH_prolog3.LIBCMT ref: 6D043EA0
Part of subcall function 6D043E99: GetDC.USER32(00000000), ref: 6D043ECC

Part of subcall function 6D060A75: __EH_prolog3_GS.LIBCMT ref: 6D060A7C
Part of subcall function 6D060A75: CreateRectRgnIndirect.GDI32(?), ref: 6D060AB4
Part of subcall function 6D060A75: CopyRect.USER32(?,?), ref: 6D060AC8
Part of subcall function 6D060A75: InflateRect.USER32(?,?,?), ref: 6D060ADE
Part of subcall function 6D060A75: IntersectRect.USER32(?,?,?), ref: 6D060AEA
Part of subcall function 6D060A75: CreateRectRgnIndirect.GDI32(?), ref: 6D060AF4
Part of subcall function 6D060A75: CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6D060B09
Part of subcall function 6D060A75: CombineRgn.GDI32(?,?,?,00000003), ref: 6D060B23
Part of subcall function 6D060A75: CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 6D060B6A
Part of subcall function 6D060A75: SetRectRgn.GDI32(?,?,00000004,?,?), ref: 6D060B87
Part of subcall function 6D060A75: CopyRect.USER32(?,?), ref: 6D060B92

Part of subcall function 6D043EEE: ReleaseDC.USER32(?,00000000), ref: 6D043F22

GetFocus.USER32 ref: 6D0771F4
SetTimer.USER32(?,0000EC07,000001F4,00000000), ref: 6D0772E5
TrackMouseEvent.USER32(?,?,?,?,?,?,00000000), ref: 6D07731C
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 6D0773A2
InvalidateRect.USER32(?,?,00000001,?,?,?,?,?,?,00000000), ref: 6D0774DD
InflateRect.USER32(?,00000000,?), ref: 6D077523
RedrawWindow.USER32(?,?,00000000,00000401,?,?,?,?,?,00000000), ref: 6D077536
KillTimer.USER32(?,0000EC07,?,?,?,?,?,00000000), ref: 6D0775C5
SetTimer.USER32(?,0000EC07,000001F4,00000000), ref: 6D0775E3
UpdateWindow.USER32(?), ref: 6D07760C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Create$Timer$CopyH_prolog3_IndirectInflateWindow$CombineCursorEventFocusH_prolog3IntersectInvalidateKillMessageMouseRedrawReleaseSendTrackUpdate
String ID:
API String ID: 3035320136-0
Opcode ID: 2e45097cbe7ad5a10b2c12fd38a8adabc319e7179d87e8d1a8a3e9698b9ff8b0
Instruction ID: 61b4b5c5110e936e491e24837a7cc5e57f2b108eecc55b603a633630e581fed4
Opcode Fuzzy Hash: 2e45097cbe7ad5a10b2c12fd38a8adabc319e7179d87e8d1a8a3e9698b9ff8b0
Instruction Fuzzy Hash: 26F18F30A00617EFEB25CF64D894BBDBBB6FF85354F114229F9259B290DB70A851CB84

Function 6D0F6FD3 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0F6FDA
GetObjectW.GDI32(?,00000018,?), ref: 6D0F6FF1

Part of subcall function 6D0F6F30: CreateDIBSection.GDI32(00000000,00000028,00000000,000000F4,00000000,00000000), ref: 6D0F6FA7

CreateCompatibleDC.GDI32(00000000), ref: 6D0F7071
SelectObject.GDI32(?,?), ref: 6D0F7084
CreateCompatibleDC.GDI32(00000000), ref: 6D0F70A2
SelectObject.GDI32(?,?), ref: 6D0F70B7
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 6D0F70D6
SelectObject.GDI32(?,00000000), ref: 6D0F70E4
SelectObject.GDI32(?,00000000), ref: 6D0F70EE

Strings

, xrefs: 6D0F7043

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Select$Create$Compatible$H_prolog3Section
String ID:
API String ID: 2431383920-3916222277
Opcode ID: 25b93ed89bb76ee99efee66b061c1595f853d6450950a86740d9b26089d6e38c
Instruction ID: e4c890ac80b4148917d74a9e53e37b6d032a2771a7b99561b5f36f4be94eef88
Opcode Fuzzy Hash: 25b93ed89bb76ee99efee66b061c1595f853d6450950a86740d9b26089d6e38c
Instruction Fuzzy Hash: 3E417032D441199FEB11CFA4DC84BFEBBB9FF89304F218029E911A7250DBB1990ADB51

Function 6D04F542 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 118windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D04F54C
SendMessageW.USER32(?,00000000,00000000,00000080), ref: 6D04F593
SendMessageW.USER32(?,00000000,00000000,?), ref: 6D04F5BF
ValidateRect.USER32(?,00000000,?,?,?,?,?,?,?,?,?,?,000000AC), ref: 6D04F5D2

Part of subcall function 6D0659D9: GetClientRect.USER32(?,?), ref: 6D065A3D

GetClientRect.USER32(?,?), ref: 6D04F643
BeginPaint.USER32(?,?,?,?,?,?,?,?,?,?,?,?,000000AC), ref: 6D04F650
SendMessageW.USER32(?,00000000,00000000,?), ref: 6D04F686
SendMessageW.USER32(?,00000000,00000000), ref: 6D04F6A8
EndPaint.USER32(?,?,?,?,?,?,?,?,?,?,?,?,000000AC), ref: 6D04F6C0

Strings

W, xrefs: 6D04F605

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$Rect$ClientPaint$BeginH_prolog3_Validate
String ID: W
API String ID: 3883544035-655174618
Opcode ID: 1c924bed71777c676fc9c9671173a4ed67a0950abe4f98b83606cd556b39906b
Instruction ID: 91064d5c3e0c062586ab0c3231f40cbea210a25366a6ce73c39a313affe7c6ef
Opcode Fuzzy Hash: 1c924bed71777c676fc9c9671173a4ed67a0950abe4f98b83606cd556b39906b
Instruction Fuzzy Hash: AA418331904646DBEF119F60DC98FAEBABAFF88314F00852DE256A3560DF719950DF60

Function 6D05FF39 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D05FF40
GetObjectW.GDI32(?,00000018,?), ref: 6D05FF5D
GetSystemMetrics.USER32(00000032), ref: 6D05FF70
GetSystemMetrics.USER32(00000031), ref: 6D05FF7B
GetMenuItemInfoW.USER32(00000000,?,00000000,00000030), ref: 6D05FFBD
GetMenuItemInfoW.USER32(00000000,?,00000000,00000030), ref: 6D05FFE8
GetSystemMetrics.USER32(0000000F), ref: 6D060050
GetSystemMetrics.USER32(0000000F), ref: 6D06005C

Strings

@, xrefs: 6D05FFAD
0, xrefs: 6D05FFA3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MetricsSystem$InfoItemMenu$H_prolog3Object
String ID: 0$@
API String ID: 414968830-1545510068
Opcode ID: ae51c58af4580dab8da1be1748d513c79b792877be1b7e5ab2e9dfee52163728
Instruction ID: b59d10dd457a6928141172feeb5d7b93a04cf5ebb8607775d2c1ac2d293def4d
Opcode Fuzzy Hash: ae51c58af4580dab8da1be1748d513c79b792877be1b7e5ab2e9dfee52163728
Instruction Fuzzy Hash: BC417976944219ABEF10CFA0DC85FAEBBB9BF04704F154015EA05BB290DBB4AA14CB60

Function 6D065C5C Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 6D065C7C

Strings

DWriteCreateFactory, xrefs: 6D065CFE
D2D1.dll, xrefs: 6D065C89
D2D1CreateFactory, xrefs: 6D065CA3
DWrite.dll, xrefs: 6D065CE9
D2D1MakeRotateMatrix, xrefs: 6D065CDB

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Initialize
String ID: D2D1.dll$D2D1CreateFactory$D2D1MakeRotateMatrix$DWrite.dll$DWriteCreateFactory
API String ID: 2538663250-1403614551
Opcode ID: 9e3de0829ccc7f5b9974c741fee2f43473fb4f76f8ddb5e645b16e8ca99c9d01
Instruction ID: 26b4b3e989365e317666a3ea3781910605ef8dc4a7e119fbf8f5c029586d4380
Opcode Fuzzy Hash: 9e3de0829ccc7f5b9974c741fee2f43473fb4f76f8ddb5e645b16e8ca99c9d01
Instruction Fuzzy Hash: 9321E279644B86AFE7209F25DC8CF3776F9EB453A8F004939F452C2186EBB0D404CA20

Function 6D07E88B Relevance: 17.0, APIs: 11, Instructions: 497windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D07E892
GetClientRect.USER32(?,?), ref: 6D07E8B0
SetRectEmpty.USER32(?), ref: 6D07E904
MapWindowPoints.USER32(?,?,?,00000002), ref: 6D07E94F
MapWindowPoints.USER32(?,?,?,00000002), ref: 6D07E9D8
GetWindowRect.USER32(?,?), ref: 6D07E9FD
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 6D07EA29
OffsetRect.USER32(?,00000000,00000000), ref: 6D07EAD7
InflateRect.USER32(?,00000000,00000000), ref: 6D07EB35
IsRectEmpty.USER32(?), ref: 6D07EC33
IsRectEmpty.USER32(?), ref: 6D07EDC3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$EmptyWindow$Points$ClientH_prolog3_InflateOffset
String ID:
API String ID: 302641110-0
Opcode ID: 25906719508dbd48f9defd3bd600dd29b7853149d3a60c703915d6dcf9131f41
Instruction ID: 7810d7e0dce9acb088676b710db0ecb1e3e7045a0ba0b3aa2b151207f154dba1
Opcode Fuzzy Hash: 25906719508dbd48f9defd3bd600dd29b7853149d3a60c703915d6dcf9131f41
Instruction Fuzzy Hash: 03125B31E0161A9FEF15CFA4C848BEEBBB6FF49310F154129E916AF244DB71A905CB90

Function 6D07615E Relevance: 16.6, APIs: 11, Instructions: 149windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,0000420F,00000001), ref: 6D0761BC
EnableMenuItem.USER32(?,0000420E,00000001), ref: 6D0761D7
CheckMenuItem.USER32(?,00004214,00000008), ref: 6D07620B
CheckMenuItem.USER32(?,00004212,00000008), ref: 6D07621D
CheckMenuItem.USER32(?,00004213,00000008), ref: 6D076230
EnableMenuItem.USER32(?,00004212,00000001), ref: 6D076252
EnableMenuItem.USER32(?,00004212,00000001), ref: 6D076281
EnableMenuItem.USER32(?,00004213,00000001), ref: 6D076290
EnableMenuItem.USER32(?,00004214,00000001), ref: 6D07629F
EnableMenuItem.USER32(?,00004215,00000001), ref: 6D0762F1
CheckMenuItem.USER32(?,00004215,00000008), ref: 6D076309

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ItemMenu$Enable$Check
String ID:
API String ID: 1852492618-0
Opcode ID: f510be5488d70fc1f31250faaea5825a50ef571440cc29af27ae3e40fd5ae9fb
Instruction ID: 360f982496100e3d90657ee2862cbf77da2da82593bc1ff383bc019b74d25051
Opcode Fuzzy Hash: f510be5488d70fc1f31250faaea5825a50ef571440cc29af27ae3e40fd5ae9fb
Instruction Fuzzy Hash: BC518E31A80616EFEB61CF54C885B69BBB1FB05700F8481A5F916AB291D770E941CBD4

Function 6D068003 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 389windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D06800D
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 6D0681E5
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6D0683AD
InvalidateRect.USER32(?,00000000,00000001), ref: 6D0683D3
UpdateWindow.USER32(?), ref: 6D0683F5
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6D0684B2
InvalidateRect.USER32(?,00000000,00000001), ref: 6D0684D8
UpdateWindow.USER32(?), ref: 6D0684FA

Strings

:/\, xrefs: 6D06822A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$InvalidateRectUpdateWindow$H_prolog3_
String ID: :/\
API String ID: 2009545923-2793184486
Opcode ID: 848a1f521329b4e42d1ceb10400d93087b2b446a04b549537a88038618b3250f
Instruction ID: d883a5c4594a584e9fe5059b82e4149c608cbd7e7b067a0c74f40336a0158710
Opcode Fuzzy Hash: 848a1f521329b4e42d1ceb10400d93087b2b446a04b549537a88038618b3250f
Instruction Fuzzy Hash: FDF16A346042598FEB14EB24CD98BADB7B5BF89304F0141D8E616AB2A1DF74AE45CF50

Function 6D0BC84E Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D06581D: __EH_prolog3_catch.LIBCMT ref: 6D065824

GetModuleHandleW.KERNEL32(comctl32.dll,6D0BC9CD,?,00000000,?,?,6D06C8C4,?,?,?,0000001C,6D06B721,?,?), ref: 6D0BC881
GetUserDefaultUILanguage.KERNEL32(?,?,6D06C8C4,?,?,?,0000001C,6D06B721,?,?), ref: 6D0BC891
FindResourceExW.KERNEL32(00000000,00000005,000003EE,0000FC11,?,?,6D06C8C4,?,?,?,0000001C,6D06B721,?,?), ref: 6D0BC8CF
FindResourceW.KERNEL32(00000000,000003EE,00000005,?,?,6D06C8C4,?,?,?,0000001C,6D06B721,?,?), ref: 6D0BC8EE
LoadResource.KERNEL32(00000000,00000000,?,?,6D06C8C4,?,?,?,0000001C,6D06B721,?,?), ref: 6D0BC8FA

Part of subcall function 6D0BCA0B: GetDC.USER32(00000000), ref: 6D0BCA5E
Part of subcall function 6D0BCA0B: EnumFontFamiliesExW.GDI32(00000000,?,6D0BC9F5,?,00000000,?,?,?,?,?,00000000,00000000), ref: 6D0BCA79
Part of subcall function 6D0BCA0B: ReleaseDC.USER32(00000000,00000000), ref: 6D0BCA81

GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,0000001C,6D06B721,?,?), ref: 6D0BC92A
GlobalFree.KERNEL32(00000001), ref: 6D0BC9A2

Strings

comctl32.dll, xrefs: 6D0BC87C
MS UI Gothic, xrefs: 6D0BC8A8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Resource$FindGlobal$AllocDefaultEnumFamiliesFontFreeH_prolog3_catchHandleLanguageLoadModuleReleaseUser
String ID: MS UI Gothic$comctl32.dll
API String ID: 1488066090-3248924666
Opcode ID: 282290b5109d28cdad976c8252b0e335039b05c71e06a9bfcfa1a6092e22ce1d
Instruction ID: e25854ac2bdd3013f000c3c75bf831385c9ec6aba7d97a4a2fc36af21da04f0f
Opcode Fuzzy Hash: 282290b5109d28cdad976c8252b0e335039b05c71e06a9bfcfa1a6092e22ce1d
Instruction Fuzzy Hash: F041FF31608606ABF7045A38DC48B7B77EDDF46754F00802DFA65CB284EBB6D8408765

Function 6D05112A Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6D051131
GetPropW.USER32(?,AfxOldWndProc423), ref: 6D051148
CallWindowProcW.USER32(?,?,00000110,?,?), ref: 6D0511A8

Part of subcall function 6D050F46: GetWindowRect.USER32(?,6D0417CB), ref: 6D050F7F
Part of subcall function 6D050F46: GetWindow.USER32(?,00000004), ref: 6D050F9C

SetWindowLongW.USER32(?,000000FC,?), ref: 6D0511CB
RemovePropW.USER32(?,AfxOldWndProc423), ref: 6D0511D7
GlobalFindAtomW.KERNEL32(AfxOldWndProc423), ref: 6D0511E2
GlobalDeleteAtom.KERNEL32(?), ref: 6D0511EC

Part of subcall function 6D050F22: GetWindowRect.USER32(?,00000000), ref: 6D050F2F

CallWindowProcW.USER32(?,?,?,?,?), ref: 6D051234

Strings

AfxOldWndProc423, xrefs: 6D05113C, 6D0511D1, 6D0511DD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catch_LongRemove
String ID: AfxOldWndProc423
API String ID: 3351853316-1060338832
Opcode ID: 2635c013eb25f78f0b688a3c91d500b4c0f1f6ced95813c243bec1a954e511ac
Instruction ID: c984de3dce8d22ea0fbb46cd8c0887571304b13cb8afc74a58f93cf2b5ef5025
Opcode Fuzzy Hash: 2635c013eb25f78f0b688a3c91d500b4c0f1f6ced95813c243bec1a954e511ac
Instruction Fuzzy Hash: CC31AF72804208BBEF059FA5EE88FFF7EB9EF4A214B154519FA12A3141CB7499208721

Function 6D0490D4 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 6D0490E4
GetSystemMetrics.USER32(00000048), ref: 6D049106
CreateFontW.GDI32(00000000), ref: 6D04910D
SelectObject.GDI32(00000000,00000000), ref: 6D04911B
GetCharWidthW.GDI32(00000000,00000036,00000036,6D2108DC), ref: 6D04912D
SelectObject.GDI32(00000000,00000000), ref: 6D049139
DeleteObject.GDI32(00000000), ref: 6D049140
ReleaseDC.USER32(00000000,00000000), ref: 6D049149

Strings

Marlett, xrefs: 6D0490EA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Select$CharCreateDeleteFontMetricsReleaseSystemWidth
String ID: Marlett
API String ID: 1397664628-3688754224
Opcode ID: 2500bd2554e30b311d630137ee991ac8783f7ee6b84e55ef2dd39abb85160e96
Instruction ID: f7121f9e14634b40016e8ab30b6518743c342e40492eda5c5ee287e27db574a8
Opcode Fuzzy Hash: 2500bd2554e30b311d630137ee991ac8783f7ee6b84e55ef2dd39abb85160e96
Instruction Fuzzy Hash: CE014F35284681BBD7311A66BC8DF6B2EBEDBCBFA1F01811CF614A2181CBA54801E770

Function 6D050148 Relevance: 15.5, APIs: 10, Instructions: 482COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a56ca5ff47fab9a27c773037fa3d28c7c4ce20339774ac183c060b53ee587d
Instruction ID: 9c66c634bc64bd99f1999e1674dd3819e8941a0208eedcf7551ce98d5d5dce77
Opcode Fuzzy Hash: 80a56ca5ff47fab9a27c773037fa3d28c7c4ce20339774ac183c060b53ee587d
Instruction Fuzzy Hash: 5C02CE35A1461ADFDB01CFAACA84BAEB7B5FF4A318B508558ED11AB310D731AC51CB90

Function 6D0790CF Relevance: 15.2, APIs: 10, Instructions: 233COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0C9413

Part of subcall function 6D043F78: __EH_prolog3.LIBCMT ref: 6D043F7F
Part of subcall function 6D043F78: GetWindowDC.USER32(00000000,00000004,6D05E51A,00000000,?,?,?,6D218020,00000000), ref: 6D043FAB

GetClientRect.USER32(?,?), ref: 6D0C943D
GetWindowRect.USER32(?,?), ref: 6D0C9454

Part of subcall function 6D044090: ScreenToClient.USER32(?,6D0594E1), ref: 6D04409F
Part of subcall function 6D044090: ScreenToClient.USER32(?,6D0594E9), ref: 6D0440AC

OffsetRect.USER32(?,?,?), ref: 6D0C9476

Part of subcall function 6D043A5D: ExcludeClipRect.GDI32(?,?,?,?,?), ref: 6D043A94
Part of subcall function 6D043A5D: ExcludeClipRect.GDI32(00000000,?,?,?,?), ref: 6D043AB1

Part of subcall function 6D05BBEC: GetWindowLongW.USER32(?,000000EC), ref: 6D05BBF9

GetWindowRect.USER32(?,?), ref: 6D0C94CA
GetRgnBox.GDI32(?,?), ref: 6D0C94E5
OffsetRect.USER32(?,?,?), ref: 6D0C94FF
CreateRectRgnIndirect.GDI32(?), ref: 6D0C9519

Part of subcall function 6D043B1F: ExtSelectClipRgn.GDI32(?,00000000,?), ref: 6D043B42
Part of subcall function 6D043B1F: ExtSelectClipRgn.GDI32(?,00000000,?), ref: 6D043B5B

OffsetRgn.GDI32(?,?,?), ref: 6D0C9554
OffsetRect.USER32(?,?,?), ref: 6D0C9575

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$ClipOffsetWindow$Client$ExcludeScreenSelect$CreateH_prolog3H_prolog3_IndirectLong
String ID:
API String ID: 3148124242-0
Opcode ID: 62667cde0ddc347479b5befbe11b18a97b11290fcf39a49e7291fe4d5895d23f
Instruction ID: b99a01de8522ad2d0a9be479227fea3a166e70e7aba91bd891b6109a1a8b944c
Opcode Fuzzy Hash: 62667cde0ddc347479b5befbe11b18a97b11290fcf39a49e7291fe4d5895d23f
Instruction Fuzzy Hash: A1915B71D44219DFDF01DBA4D898FEEBBBAFF49308F154219E906AB250DB70A941CB50

Function 6D062A1E Relevance: 15.2, APIs: 10, Instructions: 212timeCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 6D062A3F
GetWindowRect.USER32(?,?), ref: 6D062A53
KillTimer.USER32(?,0000EC08), ref: 6D062AD8
ReleaseCapture.USER32 ref: 6D062ADE
SetCursor.USER32(00000000), ref: 6D062AE5
SetCursor.USER32(?), ref: 6D062B38
LoadCursorW.USER32(?,00000000), ref: 6D062B50
SetCursor.USER32(00000000), ref: 6D062B57
GetParent.USER32(?), ref: 6D062BF8
UpdateWindow.USER32(?), ref: 6D062C4F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Cursor$Window$CaptureKillLoadParentRectReleaseTimerUpdate
String ID:
API String ID: 2135910768-0
Opcode ID: 11fb0aee3830e655c5f18e466907746af95883207754804d1af9aa57e6ed7430
Instruction ID: 2ccbf3b4a88a8c9ea50c2929420addf610118187dc5cecade1bab90d67e3124b
Opcode Fuzzy Hash: 11fb0aee3830e655c5f18e466907746af95883207754804d1af9aa57e6ed7430
Instruction Fuzzy Hash: 9A71C531E04256EFEF258F74C884BBEB7B6FF49310F558565E905A3280CB74A941CBA0

Function 6D0C4C94 Relevance: 15.2, APIs: 10, Instructions: 200COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0C4C9E
GetObjectW.GDI32(?,00000018,?), ref: 6D0C4CC3
GetObjectW.GDI32(?,00000054,?), ref: 6D0C4D08
CreateCompatibleDC.GDI32(00000000), ref: 6D0C4DF4
SelectObject.GDI32(?,?), ref: 6D0C4E16
GetPixel.GDI32(?,00000000,00000000), ref: 6D0C4E75
GetPixel.GDI32(?,?,00000000), ref: 6D0C4E87
SetPixel.GDI32(?,00000000,00000000,00000000), ref: 6D0C4E96
SetPixel.GDI32(?,?,00000000,00000000), ref: 6D0C4EA8
SelectObject.GDI32(?,00000000), ref: 6D0C4EF6

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ObjectPixel$Select$CompatibleCreateH_prolog3_
String ID:
API String ID: 1266819874-0
Opcode ID: 9089dbffd4c68a848d5cc7dbdb6ed41fd6857c6a53d2277f5a99a812dddeafde
Instruction ID: b0380f26dfc55003db7d776200b1299d88641349baf6b74218e5112611f7cb8b
Opcode Fuzzy Hash: 9089dbffd4c68a848d5cc7dbdb6ed41fd6857c6a53d2277f5a99a812dddeafde
Instruction Fuzzy Hash: F2811975E042299BEF20CFA9C884B9DBBB5FF49300F118169E959A7301EB70AD85CF50

Function 6D07CA75 Relevance: 15.2, APIs: 10, Instructions: 163timeCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 6D07CA98
ScreenToClient.USER32(?,?), ref: 6D07CAA5
KillTimer.USER32(?,0000EC17), ref: 6D07CABD
PtInRect.USER32(?,?,?), ref: 6D07CAEC
KillTimer.USER32(?,0000EC18), ref: 6D07CB7B
GetParent.USER32(?), ref: 6D07CB90
PtInRect.USER32(?,?,?), ref: 6D07CBBC
KillTimer.USER32(?,0000EC07), ref: 6D07CC1B
GetClientRect.USER32(?,?), ref: 6D07CC2F
PtInRect.USER32(?,?,?), ref: 6D07CC3F

Part of subcall function 6D05BF75: ShowWindow.USER32(?,00000000,?,?,6D05975A,00000000), ref: 6D05BF86

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$KillTimer$Client$CursorParentScreenShowWindow
String ID:
API String ID: 966434589-0
Opcode ID: fb4da4cee9bf74316be08fe99e7fe7f52a0439f51819a24e7c23e85b036133fc
Instruction ID: 1e62aaab40dca62da6f82dd03fc8a2fa715a4820bf80954e47fc2f1d33f5b7ee
Opcode Fuzzy Hash: fb4da4cee9bf74316be08fe99e7fe7f52a0439f51819a24e7c23e85b036133fc
Instruction Fuzzy Hash: 1F516271A00616DFEF158F64D844BBEBBF6FF49304F00411AF915A7250EB34A851CB99

Function 6D057B7B Relevance: 15.1, APIs: 10, Instructions: 149windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D057B85
GetMenuItemCount.USER32(?), ref: 6D057BB1
GetSubMenu.USER32(?,00000000), ref: 6D057BE7
GetMenuState.USER32(?,?,00000400), ref: 6D057C04
GetSubMenu.USER32(?,00000000), ref: 6D057C61
GetMenuStringW.USER32(?,?,?,00000100,00000400), ref: 6D057C8A
AppendMenuW.USER32(?,00000010,?,?), ref: 6D057D12
GetMenuItemCount.USER32(00000000), ref: 6D057D82
InsertMenuW.USER32(?,00000000,?,00000000), ref: 6D057DAF
GetMenuItemID.USER32(?,?), ref: 6D057DE0

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$Item$Count$AppendH_prolog3_InsertStateString
String ID:
API String ID: 2171526683-0
Opcode ID: ec3e6fd0808d015cad32d8bd423c4700f85615667be0fff03fddd288a075b716
Instruction ID: 3b7d94637c57913454db2fbaf7e7f47dd4e7fff97e783d1f692528beda43df4c
Opcode Fuzzy Hash: ec3e6fd0808d015cad32d8bd423c4700f85615667be0fff03fddd288a075b716
Instruction Fuzzy Hash: 60613671C40229AFEF24DF64DD88BE9BBB5BF58300F1080E9E909A6250DB749E90DF50

Function 6D0519EC Relevance: 15.1, APIs: 10, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D0519F3
FindResourceW.KERNEL32(?,00000000,00000005,00000024,6D03CDBB), ref: 6D051A34
LoadResource.KERNEL32(?,00000000), ref: 6D051A40
LockResource.KERNEL32(?,00000024,6D03CDBB), ref: 6D051A50
GetDesktopWindow.USER32 ref: 6D051A87
IsWindowEnabled.USER32(00000000), ref: 6D051A92
EnableWindow.USER32(00000000,00000000), ref: 6D051A9E
EnableWindow.USER32(00000000,00000001), ref: 6D051B82
GetActiveWindow.USER32 ref: 6D051B8C
SetActiveWindow.USER32(00000000,?,00000024,6D03CDBB), ref: 6D051B98

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Resource$ActiveEnable$DesktopEnabledFindH_prolog3_catchLoadLock
String ID:
API String ID: 723642982-0
Opcode ID: cc5362ceca64b7e33515598e40554700d5a4598a065cbdfc31d983d010d85b8d
Instruction ID: 6e0e4c645805316cafdf23dd0558c8747f6114476a51d96ae3e12b1d3f92617f
Opcode Fuzzy Hash: cc5362ceca64b7e33515598e40554700d5a4598a065cbdfc31d983d010d85b8d
Instruction Fuzzy Hash: 6B516074A043169BFF019FA1DA84BAEBBBABF08714F014115EE11A7281DF759821CFA1

Function 6D064E20 Relevance: 15.1, APIs: 10, Instructions: 103COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,00000000,?,?), ref: 6D064E3F
GetWindowRect.USER32(?,?), ref: 6D064E5E
SetRect.USER32(?,?,00000000,?,?), ref: 6D064E9D
InvalidateRect.USER32(?,?,00000001), ref: 6D064EAC
SetRect.USER32(?,?,00000000,?,?), ref: 6D064EC4
InvalidateRect.USER32(?,?,00000001), ref: 6D064ED3
SetRect.USER32(?,00000000,?,?,?), ref: 6D064EFB
InvalidateRect.USER32(?,?,00000001), ref: 6D064F0A
SetRect.USER32(?,00000000,?,00000001,?), ref: 6D064F21
InvalidateRect.USER32(?,?,00000001), ref: 6D064F30

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Invalidate$Window$Proc
String ID:
API String ID: 570070710-0
Opcode ID: cd3669fd90276d6a0ff4e98c5621b8343e77e8cdd13221b98216703b45ee0909
Instruction ID: 37933b96ec163259f873e639627d7426717cc7ed79aa3dc670b77f25459a7e55
Opcode Fuzzy Hash: cd3669fd90276d6a0ff4e98c5621b8343e77e8cdd13221b98216703b45ee0909
Instruction Fuzzy Hash: 3541197290024ABFEB10CFA5DD89FAFBBB9FF49304F104119F645A2190DB70A954DBA1

Function 6D06277C Relevance: 15.1, APIs: 10, Instructions: 100timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D062783
ClientToScreen.USER32(?,?), ref: 6D0627A2
GetSystemMetrics.USER32(00000025), ref: 6D0627AA
GetSystemMetrics.USER32(00000025), ref: 6D0627C0
GetSystemMetrics.USER32(00000024), ref: 6D0627D4
GetSystemMetrics.USER32(00000024), ref: 6D0627E8
CreateEllipticRgn.GDI32(00000000,00000000,00000020,00000020,?,00007921,?,?,?,?,00000010), ref: 6D062861
SetWindowRgn.USER32(?,?,00000001), ref: 6D062878
SetCapture.USER32(?,?,00007921,?,?,?,?,00000010), ref: 6D062881
SetTimer.USER32(?,0000EC08,00000032,00000000), ref: 6D06289A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MetricsSystem$CaptureClientCreateEllipticH_prolog3ScreenTimerWindow
String ID:
API String ID: 3001615190-0
Opcode ID: 32e06694dc13e33faa6a4f7e81282f610026d30b732bb4062a9f113456281cb2
Instruction ID: 3c743a01d1b7c6249cb425cfd2bed8da42a75e2745e913abea992221c2ea156a
Opcode Fuzzy Hash: 32e06694dc13e33faa6a4f7e81282f610026d30b732bb4062a9f113456281cb2
Instruction Fuzzy Hash: D63149B6600605AFEB18DF74DC49F6EBBB5FF48304F014628F659A7281DBB0A810DB90

Function 6D049780 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 301windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 6D0497A1
PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 6D0497EB

Strings

RestartByRestartManager, xrefs: 6D049954, 6D049959, 6D049961
%08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X, xrefs: 6D04991B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessagePost
String ID: %08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X$RestartByRestartManager
API String ID: 410705778-5890034
Opcode ID: 2b09ec13bc1410a3b1ced0e2530cd57fad1234c827b79a73abe5a609896d9483
Instruction ID: e69e97c3bd9481a7b41676c8973be63d5d98de2e1c5a7c915c70c04923780ea9
Opcode Fuzzy Hash: 2b09ec13bc1410a3b1ced0e2530cd57fad1234c827b79a73abe5a609896d9483
Instruction Fuzzy Hash: A4B1B032A04119AFDF05DBA8DC54FFEBBB9FF49214F058069EA11A7290DB74AD01CB60

Function 6D04122A Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Comctl32.dll,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 6D0413C0

Part of subcall function 6D0411EC: GetProcAddress.KERNEL32(00000000,00000000), ref: 6D04121A

GetModuleFileNameW.KERNEL32(?,?,00000105,?,6D04A6EA,00000000,6D202418,00000010,6D060524,comctl32.dll,?), ref: 6D0412DA
SetLastError.KERNEL32(0000006F,?,6D04A6EA,00000000,6D202418,00000010,6D060524,comctl32.dll,?), ref: 6D0412EE
GetLastError.KERNEL32(00000020), ref: 6D041345

Strings

@, xrefs: 6D04139B
Comctl32.dll, xrefs: 6D0413AC, 6D0413B1, 6D0413BF
, xrefs: 6D0412F9
GetModuleHandleExW, xrefs: 6D04128D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$AddressFileLibraryLoadModuleNameProc
String ID: $@$Comctl32.dll$GetModuleHandleExW
API String ID: 3640817601-4183358198
Opcode ID: 9ed716d8f91929bb397c60415b99ae453f9834c66564ed6193df03a67b218e90
Instruction ID: c5d49be33180921989b796a78fd0542d1e938855125654082a26b26d1d9e4863
Opcode Fuzzy Hash: 9ed716d8f91929bb397c60415b99ae453f9834c66564ed6193df03a67b218e90
Instruction Fuzzy Hash: 7A41D671904619EAFB20CB65DC98FAE73F8EB45715F1082B6E524E2190DBB48A90CF52

Function 6D0D9371 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 100sleepthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D219BB4,?,00000000,?,6D0717B5,00000001,00000000,?,?,6D07144B,?,00000000,?,?), ref: 6D0D9396
SetThreadPriority.KERNEL32(00000000,000000FF,?,00000000), ref: 6D0D93C7
LeaveCriticalSection.KERNEL32(6D219BB4,?,00000000), ref: 6D0D93DD
PlaySoundW.WINMM(MenuCommand,00000000,00012002), ref: 6D0D942E
Sleep.KERNEL32(00000005,00000000,6D219BB4,00000000,?,00000000,?,6D0717B5,00000001,00000000,?,?,6D07144B,?,00000000,?), ref: 6D0D9459
PlaySoundW.WINMM(00000000,00000000,00000040), ref: 6D0D946E

Strings

MenuPopup, xrefs: 6D0D9429
MenuCommand, xrefs: 6D0D9440

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CriticalPlaySectionSound$EnterLeavePrioritySleepThread
String ID: MenuCommand$MenuPopup
API String ID: 2370138168-2036262055
Opcode ID: 837891ba0b7b4bf24fc4f1facb9ac57e28c1df416102d53f700a013420141e6e
Instruction ID: f57ca0b4581d4fa7673c9fb53ef4a6e17165d64232ca435a5dbf539bd601857e
Opcode Fuzzy Hash: 837891ba0b7b4bf24fc4f1facb9ac57e28c1df416102d53f700a013420141e6e
Instruction Fuzzy Hash: AC31A671848305ABEB518E69EC9DB2B76B4FB93339F208316FA34921D0CBF15491CA50

Function 6D0394D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6D0394DF
FindResourceW.KERNEL32 ref: 6D03953E
LoadResource.KERNEL32 ref: 6D039561
SizeofResource.KERNEL32 ref: 6D03957A
LockResource.KERNEL32 ref: 6D039592

Strings

CONFIG, xrefs: 6D0394EB
$, xrefs: 6D03951D
AFX_DIALOG_LAYOUT, xrefs: 6D039510

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Resource$FindHandleLoadLockModuleSizeof
String ID: $$AFX_DIALOG_LAYOUT$CONFIG
API String ID: 1601749889-1968922069
Opcode ID: b16a24a9ec4e4f79247573325c4d721aa91ba03aa6d8954fd9957cc09bf5549f
Instruction ID: 75d5801c6ed20356b7c0ce9194d609de5d270551b86aa7c846b27755abe09e38
Opcode Fuzzy Hash: b16a24a9ec4e4f79247573325c4d721aa91ba03aa6d8954fd9957cc09bf5549f
Instruction Fuzzy Hash: 1E417FB4D09209DFDB04EFA8E18469DBBF1BF49300F51882EE889A7354EB749955CF42

Function 6D04AA44 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D04AA6A
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6D04AA7A
EncodePointer.KERNEL32(00000000), ref: 6D04AA83
DecodePointer.KERNEL32(00000000), ref: 6D04AA91
GetSystemDirectoryW.KERNEL32(?,00000105), ref: 6D04AAB9

Strings

SetDefaultDllDirectories, xrefs: 6D04AA74
\, xrefs: 6D04AAC7
kernel32.dll, xrefs: 6D04AA65

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeDirectoryEncodeHandleModuleProcSystem
String ID: SetDefaultDllDirectories$\$kernel32.dll
API String ID: 2101061299-3881611067
Opcode ID: b6f06597f9276ee725fd96746041780bef620f9fde804588937609f95f118228
Instruction ID: ecc9c2d823f87ce2fe3a9ca797cdbc5624e04ce317de87d451db7e6b65e15d6b
Opcode Fuzzy Hash: b6f06597f9276ee725fd96746041780bef620f9fde804588937609f95f118228
Instruction Fuzzy Hash: 4D21C370A44219EBFB10DA659E4CFEB3BFDAF45358F208879A905D3141EBA0D544C6D1

Function 6D06CD94 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 6D06CDB6
GetStockObject.GDI32(0000000D), ref: 6D06CDC2
GetObjectW.GDI32(00000000,0000005C,?), ref: 6D06CDD3
GetDC.USER32(00000000), ref: 6D06CDE2
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6D06CDF9
MulDiv.KERNEL32(?,00000048,00000000), ref: 6D06CE05
ReleaseDC.USER32(00000000,00000000), ref: 6D06CE11

Strings

System, xrefs: 6D06CDAC, 6D06CE26

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 9e87a09e879eb7f30f031427389635ea45181ac24ebdf183412afa6e97b302bc
Instruction ID: f0aca5818c4147a91bd0994a40dc9f71ba73f35e14bdf1c62c318191f7f976fe
Opcode Fuzzy Hash: 9e87a09e879eb7f30f031427389635ea45181ac24ebdf183412afa6e97b302bc
Instruction Fuzzy Hash: 3E114275640308ABEF049B65EC89BBF7FF9BB45745F004019FA06DB281DBB09901D765

Function 6D04ECA8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 6D04ECEF
SetActiveWindow.USER32(?), ref: 6D04ECFA
SendMessageW.USER32(?,00000112,?,?), ref: 6D04ED14
IsWindow.USER32(?), ref: 6D04ED1B
SetActiveWindow.USER32(?), ref: 6D04ED26
IsWindow.USER32(00000000), ref: 6D04ED2D
SetFocus.USER32(00000000), ref: 6D04ED38

Strings

u, xrefs: 6D04ED41

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$ActiveFocus$MessageSend
String ID: u
API String ID: 1556911595-4067256894
Opcode ID: 3e3809ac7c65c7268b8f5d49e4a76eba1f2b907b6d16c7f2007335f036f428da
Instruction ID: f1d3c474a9486c19c42318976fcea35f9d09bb4a3f448212e68d4154e5b8a246
Opcode Fuzzy Hash: 3e3809ac7c65c7268b8f5d49e4a76eba1f2b907b6d16c7f2007335f036f428da
Instruction Fuzzy Hash: DC118232904206EBFB119B74E988F7E36FAEB49301B00C534FA25C5195CB74C4019B50

Function 6D15C7C9 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D15C7D0

Part of subcall function 6D0634A0: EnterCriticalSection.KERNEL32(6D2183D0,?,?,0000007C,?,6D04F858,00000001), ref: 6D0634D1
Part of subcall function 6D0634A0: InitializeCriticalSection.KERNEL32(00000000,?,6D04F858,00000001), ref: 6D0634E7
Part of subcall function 6D0634A0: LeaveCriticalSection.KERNEL32(6D2183D0,?,6D04F858,00000001), ref: 6D0634F5
Part of subcall function 6D0634A0: EnterCriticalSection.KERNEL32(00000000,?,0000007C,?,6D04F858,00000001), ref: 6D063502

GetProfileIntW.KERNEL32(windows,DragScrollInset,0000000B), ref: 6D15C81B
GetProfileIntW.KERNEL32(windows,DragScrollDelay,00000032), ref: 6D15C82E
GetProfileIntW.KERNEL32(windows,DragScrollInterval,00000032), ref: 6D15C841

Strings

windows, xrefs: 6D15C815, 6D15C81A, 6D15C828, 6D15C83B
DragScrollInset, xrefs: 6D15C810
DragScrollInterval, xrefs: 6D15C836
DragScrollDelay, xrefs: 6D15C823

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CriticalSection$Profile$Enter$H_prolog3InitializeLeave
String ID: DragScrollDelay$DragScrollInset$DragScrollInterval$windows
API String ID: 4229786687-1024936294
Opcode ID: 6f0cc65dd999ed1461fe0691f44caaa63a143b4eef73ff41acacefa0b266f10e
Instruction ID: a38bc6facfcd858c1906b44ef37255893e7ff37461d47e13b847a3116917d9a3
Opcode Fuzzy Hash: 6f0cc65dd999ed1461fe0691f44caaa63a143b4eef73ff41acacefa0b266f10e
Instruction Fuzzy Hash: 0B018FF4944304AFDB60DFA49D5D71A7AF8BB09B08F04492DE314A7288CBF89500CB59

Function 6D07B77A Relevance: 13.7, APIs: 9, Instructions: 211timewindowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6D07B795

Part of subcall function 6D04AD2B: GetMessageTime.USER32 ref: 6D04AD41
Part of subcall function 6D04AD2B: GetMessagePos.USER32 ref: 6D04AD4A

SetTimer.USER32(?,0000EC18,FFFFFFFE), ref: 6D07B7F3
InvalidateRect.USER32(?,?,00000001), ref: 6D07B802
UpdateWindow.USER32(?), ref: 6D07B80B
KillTimer.USER32(?,0000EC18,00000000), ref: 6D07B826
GetParent.USER32(?), ref: 6D07B8FC
GetParent.USER32(?), ref: 6D07B965
SendMessageW.USER32(?,0000011F,00000080,?), ref: 6D07B9FD
KillTimer.USER32(?,0000EC18,6D02FE79), ref: 6D07BA32

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageParentTimer$Kill$InvalidateRectSendTimeUpdateWindow
String ID:
API String ID: 2902259361-0
Opcode ID: bd7baf039ea1617fd70b2a6d0e189b18d2dc799a305fd86917d7539a98d35d3a
Instruction ID: 5fe693e5909be25cf5650614fc03efe3954cdc17b372b2308968d7a59ae399a2
Opcode Fuzzy Hash: bd7baf039ea1617fd70b2a6d0e189b18d2dc799a305fd86917d7539a98d35d3a
Instruction Fuzzy Hash: 89719B31A042169FEB119F64C888BBE3BF6FF89714F114169ED25AF291DB70D801CB94

Function 6D0535E7 Relevance: 13.6, APIs: 9, Instructions: 137windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0535EE
GetDesktopWindow.USER32 ref: 6D053634
GetWindow.USER32(00000000), ref: 6D05363B
IsWindowEnabled.USER32(00000000), ref: 6D05364B
SendMessageW.USER32(00000000,0000036C,00000000,00000000), ref: 6D053676
EnableWindow.USER32(00000000,00000000), ref: 6D053682
GetWindow.USER32(00000000,00000002), ref: 6D053697
IsWindow.USER32(00000000), ref: 6D053734
EnableWindow.USER32(?,00000001), ref: 6D053749

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Enable$DesktopEnabledH_prolog3MessageSend
String ID:
API String ID: 1053735628-0
Opcode ID: 581f0ded8a536891681b88c8e4c5d2d39025fa377113709240bd8e142a918ade
Instruction ID: 1a372a7535231817020e88bdb095020e71863cbad867214d17fff007ddd6a8f4
Opcode Fuzzy Hash: 581f0ded8a536891681b88c8e4c5d2d39025fa377113709240bd8e142a918ade
Instruction Fuzzy Hash: 8141C2329046179BFB219F74DA48BAF77F9EF05314F11842DED19EB284EB7498108BA0

Function 6D05A2E8 Relevance: 13.6, APIs: 9, Instructions: 104windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D05A2EF

Part of subcall function 6D085F09: LoadCursorW.USER32(?,00007F00), ref: 6D085F6B

GetSystemMenu.USER32(?,00000000,00000000,00000000,6D1F7FF8,?,6D2109BC), ref: 6D05A360
DeleteMenu.USER32(?,0000F000,00000000,00000000), ref: 6D05A383
DeleteMenu.USER32(?,0000F020,00000000), ref: 6D05A393
DeleteMenu.USER32(?,0000F030,00000000), ref: 6D05A3A3
DeleteMenu.USER32(?,0000F120,00000000), ref: 6D05A3B3
DeleteMenu.USER32(00000000,0000F060,00000000,0000F011), ref: 6D05A3E6
AppendMenuW.USER32(00000000,00000000,0000F060,?), ref: 6D05A3FA
SetParent.USER32(?,?), ref: 6D05A447

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$Delete$AppendCursorH_prolog3LoadParentSystem
String ID:
API String ID: 2353656248-0
Opcode ID: 3ca6ee1b1120b63d2f7f2fc4f4fd9c4cee5d2c3339c3fffcd676ed6a0a449a9b
Instruction ID: 104a364b00e9efffc11b1ce0088a4ca996f26a172b21209259d26e9bd5adab7c
Opcode Fuzzy Hash: 3ca6ee1b1120b63d2f7f2fc4f4fd9c4cee5d2c3339c3fffcd676ed6a0a449a9b
Instruction Fuzzy Hash: 7841B531A50606AFFB208FA0CD4AFAA7BB4FF04704F114524BA65A75D1D7B0B810DB90

Function 6D06C6EA Relevance: 13.6, APIs: 9, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 6D06C705
GetWindowLongW.USER32(00000000,000000F0), ref: 6D06C714
IsWindowEnabled.USER32(00000000), ref: 6D06C722
GetDlgItem.USER32(?,00003024), ref: 6D06C739
GetWindowLongW.USER32(00000000,000000F0), ref: 6D06C745
IsWindowEnabled.USER32(?), ref: 6D06C755
GetFocus.USER32 ref: 6D06C776
IsWindowEnabled.USER32(00000000), ref: 6D06C77D
SetFocus.USER32(?), ref: 6D06C78A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Enabled$FocusItemLong
String ID:
API String ID: 1558694495-0
Opcode ID: dc766ac7e441160fb6112b4b39d726d051e100a3c3ec3238253ddfff8a64ad1a
Instruction ID: f1f24ea83b3122a2ec14970b0bd439cd3e285faca4df8c8a9628f24a7c035375
Opcode Fuzzy Hash: dc766ac7e441160fb6112b4b39d726d051e100a3c3ec3238253ddfff8a64ad1a
Instruction Fuzzy Hash: 9111DF36604156ABEF016F64EC88B6EBFBBFF46790B004124F915921A0DB708920EBA4

Function 6D0C1978 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 261windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D0C1814: GdipGetImagePixelFormat.GDIPLUS(?,6D219B30,00000000,00000000,?,6D0C19BC,FDA68A44,?,00000000,6D219B30), ref: 6D0C1822

Part of subcall function 6D0C1858: GdipGetImagePalette.GDIPLUS(?,00000000,?,?,?,6D0C1ADB,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,FDA68A44), ref: 6D0C1867

GdipBitmapLockBits.GDIPLUS(?,?,00000001,?,?,00000000,00000000,?,00000000,00000000,00000000,FDA68A44,?,00000000,6D219B30), ref: 6D0C1BD0
GdipBitmapUnlockBits.GDIPLUS(?,?,?,?,00000001,?,?,00000000,00000000,?,00000000,00000000,00000000,FDA68A44,?,00000000), ref: 6D0C1C80
GdipDrawImageI.GDIPLUS(?,00000000,00000000,00000000,?,?,00000000,00000000,00022009,?,00000000,00000000,?,00000000,00000000,00000000), ref: 6D0C1CD2
GdipDeleteGraphics.GDIPLUS(?,?,00000000,00000000,00000000,?,?,00000000,00000000,00022009,?,00000000,00000000,?,00000000,00000000), ref: 6D0C1CDD
GdipDisposeImage.GDIPLUS(?,?,?,00000000,00000000,00000000,?,?,00000000,00000000,00022009,?,00000000,00000000,?,00000000), ref: 6D0C1CE8

Strings

&, xrefs: 6D0C1A00
&, xrefs: 6D0C1B8A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Gdip$Image$BitmapBits$DeleteDisposeDrawFormatGraphicsLockPalettePixelUnlock
String ID: &$ &
API String ID: 1665940520-360661826
Opcode ID: 3d25009eaddbc29a667d4cdc6b4fa571249349c4f33fd4ca2505ccd2218652e7
Instruction ID: 408ecc34b2bf92e71edf557193fb57bd36e5c11d9b4b416bd355f7e9506b9b6a
Opcode Fuzzy Hash: 3d25009eaddbc29a667d4cdc6b4fa571249349c4f33fd4ca2505ccd2218652e7
Instruction Fuzzy Hash: 3AA151F1A041299BEB24CF54CC90BEDB7B9EF88314F5141E9EA19A7241D7309E81CF96

Function 6D04D88B Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 209libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll), ref: 6D04D8AD
GetProcAddress.KERNEL32(00000000,GetGestureInfo), ref: 6D04D8E2
GetProcAddress.KERNEL32(00000000,CloseGestureInfoHandle), ref: 6D04D90A
ScreenToClient.USER32(?,?), ref: 6D04D996

Strings

GetGestureInfo, xrefs: 6D04D8D4
CloseGestureInfoHandle, xrefs: 6D04D8FC
user32.dll, xrefs: 6D04D8A3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressProc$ClientHandleModuleScreen
String ID: CloseGestureInfoHandle$GetGestureInfo$user32.dll
API String ID: 471820996-2905070798
Opcode ID: 93a2e17b07f21912a43814073b5aace4305a940101b60ce26a61f636e2414e57
Instruction ID: dae0f27525bfcf06c034cc0670f7271588ba9be7970e15de582105b44c59f362
Opcode Fuzzy Hash: 93a2e17b07f21912a43814073b5aace4305a940101b60ce26a61f636e2414e57
Instruction Fuzzy Hash: 47819E74A0461AEFDB06CF68C984FAABBF5FF8A314B008169E91593750DB71E914CF90

Function 6D070A77 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 184COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D070A81

Part of subcall function 6D0BE360: __EH_prolog3.LIBCMT ref: 6D0BE367

IsWindow.USER32(?), ref: 6D070BB4

Part of subcall function 6D05BCD3: GetDlgCtrlID.USER32(?), ref: 6D05BCDE

Strings

Buttons, xrefs: 6D070C0C
Name, xrefs: 6D070BDB
%TsMFCToolBar-%d%x, xrefs: 6D070AEB
%TsMFCToolBar-%d, xrefs: 6D070AD3
MFCToolBars, xrefs: 6D070A91

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CtrlH_prolog3H_prolog3_catchWindow
String ID: %TsMFCToolBar-%d$%TsMFCToolBar-%d%x$Buttons$MFCToolBars$Name
API String ID: 1537839037-190999575
Opcode ID: a59611d8a1e4113fb18a28623f6d36d6b9838956d5f8e14cf1e6444f821f69a8
Instruction ID: fd20af4b9cd3a1434359d0d6be24099f02e1634100d7f6dded93b1cb3a2a275e
Opcode Fuzzy Hash: a59611d8a1e4113fb18a28623f6d36d6b9838956d5f8e14cf1e6444f821f69a8
Instruction Fuzzy Hash: FE71CF74E0421ADFEF01CBA4C954BEEBBB9EF49304F114058EA11B7291DB359E01CBA1

Function 6D04D715 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 130libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll), ref: 6D04D740
GetProcAddress.KERNEL32(00000000,GetTouchInputInfo), ref: 6D04D775
GetProcAddress.KERNEL32(00000000,CloseTouchInputHandle), ref: 6D04D79D
ScreenToClient.USER32(?,?), ref: 6D04D865

Strings

GetTouchInputInfo, xrefs: 6D04D767
user32.dll, xrefs: 6D04D736
CloseTouchInputHandle, xrefs: 6D04D78F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressProc$ClientHandleModuleScreen
String ID: CloseTouchInputHandle$GetTouchInputInfo$user32.dll
API String ID: 471820996-1853737257
Opcode ID: f61eec3604c0806a4236b38234f00eb8d2821d97e5537c059e8b9eff8e803cc7
Instruction ID: ef21aaf1f9db29a00445ff6b288cc12082ffa5f80225c68c9c412049dd40b184
Opcode Fuzzy Hash: f61eec3604c0806a4236b38234f00eb8d2821d97e5537c059e8b9eff8e803cc7
Instruction Fuzzy Hash: 71414E35A00116EBDF049B69DC49F7B7BF9EBCA764B10807AED25D3254EF709901CA60

Function 6D177B64 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D177B6B
IsAppThemed.UXTHEME(00000000,00000000,0000003C,6D177300,?,6D177CB7,00000000,?,00000000), ref: 6D177BAD
OpenThemeData.UXTHEME(?,Button,?,6D177CB7,00000000,?,00000000), ref: 6D177BD8
GetThemePartSize.UXTHEME(?,?,00000003,00000005,00000000,00000001,00000000,00000000,?,?,6D177CB7,00000000,?,00000000), ref: 6D177C1F
CloseThemeData.UXTHEME(?,?,?,6D177CB7,00000000,?,00000000), ref: 6D177C40
GetObjectW.GDI32(?,00000018,?), ref: 6D177C69

Strings

Button, xrefs: 6D177BD2

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Theme$Data$CloseH_prolog3ObjectOpenPartSizeThemed
String ID: Button
API String ID: 1633685699-1034594571
Opcode ID: 821de46abbebf7fc7dfb9f1e5dcdd0a615c6b123d4878e834908f33948b38879
Instruction ID: 9467affa791905a1e0db7f3d30cf4e7b8250681a28b1470cb333aa8e1b85a452
Opcode Fuzzy Hash: 821de46abbebf7fc7dfb9f1e5dcdd0a615c6b123d4878e834908f33948b38879
Instruction Fuzzy Hash: 52318371A4420BAFEB158F94DC54FBEB7B9FF44704F11402AE611AB294DBB49A01CB60

Function 6D066606 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll,?,?,6D05F303,?,00000000,?,?,?,000000FF,?,?,00000040), ref: 6D066618
GetProcAddress.KERNEL32(00000000,DrawThemeTextEx), ref: 6D066628
EncodePointer.KERNEL32(00000000,?,?,6D05F303,?,00000000,?,?,?,000000FF,?,?,00000040), ref: 6D066631
DecodePointer.KERNEL32(00000000,?,?,6D05F303,?,00000000,?,?,?,000000FF,?,?,00000040), ref: 6D06663F
DrawThemeText.UXTHEME(?,?,?,?,?,?,?,00000000,?,?,?,6D05F303,?,00000000,?,?), ref: 6D06668C

Strings

uxtheme.dll, xrefs: 6D066613
DrawThemeTextEx, xrefs: 6D066622

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeDrawEncodeHandleModuleProcTextTheme
String ID: DrawThemeTextEx$uxtheme.dll
API String ID: 1727381832-3035683158
Opcode ID: d9c4b0de332bcdb5dd3f2eee29dcec003dbddc1633901e6e5a0352168e329ded
Instruction ID: b2461524608feead2be02ec1331e6ad8068ca8789068aa84b8e5b82800e2839b
Opcode Fuzzy Hash: d9c4b0de332bcdb5dd3f2eee29dcec003dbddc1633901e6e5a0352168e329ded
Instruction Fuzzy Hash: BF11A83210015ABBDF025FA0EC08AEA3FB6FB0D354B448554FE14A1120DB76D861ABA4

Function 6D07C500 Relevance: 12.3, APIs: 8, Instructions: 253windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(000000FF), ref: 6D07C521
SendMessageW.USER32(000000FF,00000362,0000E001,00000000), ref: 6D07C55D

Part of subcall function 6D07C812: GetParent.USER32(000000FF), ref: 6D07C822

SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 6D07C57C
GetParent.USER32(000000FF), ref: 6D07C635
PostMessageW.USER32(?,?,?,00000000), ref: 6D07C6E9
GetParent.USER32(000000FF), ref: 6D07C753
InvalidateRect.USER32(000000FF,000000FF,00000001,000000FF,?,?), ref: 6D07C7CC
UpdateWindow.USER32(000000FF), ref: 6D07C7D8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Parent$Message$Send$InvalidatePostRectUpdateWindow
String ID:
API String ID: 4048132615-0
Opcode ID: c0bbc42542f9b841f4e97a564479acfa3c503e095ce870f4cac031b3618b0f1c
Instruction ID: 44b9c4c6745fe57dfaa2398b622f6b94ec718f194118b71fc6daad9a51873197
Opcode Fuzzy Hash: c0bbc42542f9b841f4e97a564479acfa3c503e095ce870f4cac031b3618b0f1c
Instruction Fuzzy Hash: C7919E71A0421A9FEF149F64CD84BBE7BF9FF49744B014069EA15AB290DF30E841DB98

Function 6D057EE0 Relevance: 12.2, APIs: 8, Instructions: 246filecomCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D057EE7
OleDuplicateData.OLE32(?,?,00000000), ref: 6D057F78
GlobalLock.KERNEL32(00000000), ref: 6D057F9A
CopyMetaFileW.GDI32(?,00000000), ref: 6D057FA8
GlobalUnlock.KERNEL32(00000000), ref: 6D057FB6
GlobalFree.KERNEL32(00000000), ref: 6D057FBD
GlobalUnlock.KERNEL32(00000000), ref: 6D057FCA

Part of subcall function 6D040987: __EH_prolog3.LIBCMT ref: 6D04098E

CopyFileW.KERNEL32(?,?,00000000,?,?,00000054), ref: 6D058176

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Global$CopyFileUnlock$DataDuplicateFreeH_prolog3H_prolog3_LockMeta
String ID:
API String ID: 4039237054-0
Opcode ID: 4c4e087af1aa05e9e0e382412b59d3055d4fc50f2d5041cd2ba0a17013982c3d
Instruction ID: a56f91153b47fba9e7ffee44044fb085a1daeaa299ce05b35eb75c8f56879876
Opcode Fuzzy Hash: 4c4e087af1aa05e9e0e382412b59d3055d4fc50f2d5041cd2ba0a17013982c3d
Instruction Fuzzy Hash: 78815975924516EFEB159F65CE48F2ABBB9FF8A700701C158ED168B254DB30EC20CBA1

Function 6D0CE5EB Relevance: 12.2, APIs: 8, Instructions: 169windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 6D0CE625
IsWindow.USER32(?), ref: 6D0CE646
DestroyWindow.USER32(?), ref: 6D0CE656
GetParent.USER32(?), ref: 6D0CE67C
IsRectEmpty.USER32(?), ref: 6D0CE74E
IsWindowVisible.USER32(?), ref: 6D0CE79A
MapWindowPoints.USER32(?,?,?,00000001), ref: 6D0CE7B0
SendMessageW.USER32(?,00000202,?,?), ref: 6D0CE7CF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$CaptureDestroyEmptyMessageParentPointsRectReleaseSendVisible
String ID:
API String ID: 3509494761-0
Opcode ID: 1e0ceda573703e437d056c5b107cd3a76658e7f32f8abe0816c610a79195f959
Instruction ID: d255b0784a605615ce1c01cdc27da41a12363a2b16dc45b239bc5ba5deb65efa
Opcode Fuzzy Hash: 1e0ceda573703e437d056c5b107cd3a76658e7f32f8abe0816c610a79195f959
Instruction Fuzzy Hash: 17517C317003169BEF019F64CC9ABBE3BB6AF4A744F0541B8ED16DB281DB749905CB92

Function 6D06BBE0 Relevance: 12.2, APIs: 8, Instructions: 154windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(00000000), ref: 6D06BC59
EnableWindow.USER32(00000000,00000000), ref: 6D06BC65
GetCapture.USER32 ref: 6D06BC72
SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 6D06BC81
EnableWindow.USER32(00000000,00000001), ref: 6D06BD5E
GetActiveWindow.USER32 ref: 6D06BD68
SetActiveWindow.USER32(00000000), ref: 6D06BD73
EnableWindow.USER32(00000000,00000001), ref: 6D06BDB2

Part of subcall function 6D04FB46: UnhookWindowsHookEx.USER32(?), ref: 6D04FB70

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Enable$Active$CaptureEnabledHookMessageSendUnhookWindows
String ID:
API String ID: 1281840512-0
Opcode ID: f68ff152845279a85f93ed4c1b075e250400a56d5f9f7d9f8a64f2c578d240eb
Instruction ID: 9d957dedf4fd6541725f98b6e471e03f005d38902316ab4f25f2eaa0e81e54c2
Opcode Fuzzy Hash: f68ff152845279a85f93ed4c1b075e250400a56d5f9f7d9f8a64f2c578d240eb
Instruction Fuzzy Hash: AB519EB1B00247EBEB009B74D988BAEBBF9BF45314F004569F615D7280DF74A911DBA0

Function 6D04BAE7 Relevance: 12.1, APIs: 8, Instructions: 139windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D04BB31
BeginDeferWindowPos.USER32(00000008), ref: 6D04BB47
GetTopWindow.USER32(?), ref: 6D04BB58
GetDlgCtrlID.USER32(00000000), ref: 6D04BB61
SendMessageW.USER32(00000000,00000361,00000000,00000000), ref: 6D04BB99
GetWindow.USER32(00000000,00000002), ref: 6D04BBA2
CopyRect.USER32(?,?), ref: 6D04BBBD
EndDeferWindowPos.USER32(00000000), ref: 6D04BC4D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$DeferRect$BeginClientCopyCtrlMessageSend
String ID:
API String ID: 1228040700-0
Opcode ID: 35d91bb519488d978a4a5b481d05c1a1361a1802c24b0ee53c64a481b1c0c351
Instruction ID: bed2a9cc213e45477878b4d28767b5b2e9dbe0238c44d63823251eec7fbe562b
Opcode Fuzzy Hash: 35d91bb519488d978a4a5b481d05c1a1361a1802c24b0ee53c64a481b1c0c351
Instruction Fuzzy Hash: 31512672900219DFEF01CFA8D884FEEB7F5BF49315F108069E911A7244CBB5A940CBA4

Function 6D077630 Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

Part of subcall function 6D0CEA1D: ReleaseCapture.USER32 ref: 6D0CEA54
Part of subcall function 6D0CEA1D: IsWindow.USER32(?), ref: 6D0CEA83
Part of subcall function 6D0CEA1D: DestroyWindow.USER32(?), ref: 6D0CEA93

SetRectEmpty.USER32(?), ref: 6D07765B
ReleaseCapture.USER32 ref: 6D077661
SetCapture.USER32(?,?,?,?,6D06F5D2,?), ref: 6D077674
GetCapture.USER32 ref: 6D0776B3
ReleaseCapture.USER32 ref: 6D0776C3
SetCapture.USER32(?,?,?,?,6D06F5D2,?), ref: 6D0776D6
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 6D077774
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 6D0777C1

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Capture$Window$Release$Redraw$DestroyEmptyRect
String ID:
API String ID: 2209428161-0
Opcode ID: 7f1ceaf5e8c44b293baff56f5f9c78b25e8deaec55fe17cb76380ed8280b0c19
Instruction ID: d3f16b6b2550873c433988a2a9f9aacd9392e29c31d551456cbffb518c29e523
Opcode Fuzzy Hash: 7f1ceaf5e8c44b293baff56f5f9c78b25e8deaec55fe17cb76380ed8280b0c19
Instruction Fuzzy Hash: 5C41B371704606AFEB059F74D888FAEB7BAFF85355F114229E629C7290DF70A810CB90

Function 6D0C65C1 Relevance: 12.1, APIs: 8, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,00000000,?,?,?,6D0C65B6,00000000,00000000,?,?,00000000,6D1C7E7C,?,6D0C21EF,?), ref: 6D0C65D2
GlobalLock.KERNEL32(00000000), ref: 6D0C65DF
GlobalUnlock.KERNEL32(00000000), ref: 6D0C65EA
GlobalFree.KERNEL32(00000000), ref: 6D0C65F1
GlobalUnlock.KERNEL32(00000000), ref: 6D0C660F
CreateStreamOnHGlobal.OLE32(00000000,00000001,00000000), ref: 6D0C661C
EnterCriticalSection.KERNEL32(6D219B30,00000000), ref: 6D0C6635
LeaveCriticalSection.KERNEL32(6D219B30,00000000), ref: 6D0C669C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Global$CriticalSectionUnlock$AllocCreateEnterFreeLeaveLockStream
String ID:
API String ID: 295443201-0
Opcode ID: f94cf433f4c04a36a9b9b4d53a8f00d490905611be2f3012ec482790b503ae33
Instruction ID: f347b89b125ad9d0900660c866417b5f1b579dc19939af44b9fa2bd3125095e3
Opcode Fuzzy Hash: f94cf433f4c04a36a9b9b4d53a8f00d490905611be2f3012ec482790b503ae33
Instruction Fuzzy Hash: EA31D331700216ABEF109B64EC59B6E77FAEF4A719F104029FA21D7250EF749A00DB92

Function 6D07A952 Relevance: 12.1, APIs: 8, Instructions: 95COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 6D07A96E
GetParent.USER32(?), ref: 6D07A97E
GetClientRect.USER32(?,?), ref: 6D07A9C2
MapWindowPoints.USER32(?,?,?,00000002), ref: 6D07A9D4
PtInRect.USER32(?,?,?), ref: 6D07A9E4
GetClientRect.USER32(?,?), ref: 6D07AA11
MapWindowPoints.USER32(?,?,?,00000002), ref: 6D07AA23
PtInRect.USER32(?,?,?), ref: 6D07AA33

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Client$PointsWindow$ParentScreen
String ID:
API String ID: 1944725958-0
Opcode ID: 8e658266bdba6e8018b637c9cd8db74c38b4f4453e0ce2923ee54bc6b1c85f56
Instruction ID: bc13cf0cc60a25b88caf57fd737098fdc944e79b68454f1a0fd8d812cbd77ff6
Opcode Fuzzy Hash: 8e658266bdba6e8018b637c9cd8db74c38b4f4453e0ce2923ee54bc6b1c85f56
Instruction Fuzzy Hash: DA317C32A0010AAFDF129FA4D988FAE7BBAFB493047214129FA4ADB150DB70D910DB50

Function 6D057DF4 Relevance: 12.1, APIs: 8, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 6D057DFD
GetMenuItemCount.USER32(?), ref: 6D057E09
GetSubMenu.USER32(?,-00000001), ref: 6D057E20
GetMenuItemCount.USER32(00000000), ref: 6D057E33
GetSubMenu.USER32(00000000,00000000), ref: 6D057E44
RemoveMenu.USER32(00000000,00000000,00000400), ref: 6D057E5E
GetSubMenu.USER32(?,00000000), ref: 6D057E75
RemoveMenu.USER32(?,-00000001,00000400), ref: 6D057E90

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$CountItem$Remove
String ID:
API String ID: 3494307843-0
Opcode ID: 896aa8575820d5f2f2f66b5d00b329ed3947da2657053c6213488b2d7423685f
Instruction ID: 46224540d5eae2150b769c6df2b5553e83f6c5aed2ae5f43a68f7b1be08cf06b
Opcode Fuzzy Hash: 896aa8575820d5f2f2f66b5d00b329ed3947da2657053c6213488b2d7423685f
Instruction Fuzzy Hash: E9113D76904345EBEB114F65ED88F6F3ABAFBC6391F108026FA16A2150C7709971EA50

Function 6D05EDF1 Relevance: 12.1, APIs: 8, Instructions: 65COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000031), ref: 6D05EDFF
GetSystemMetrics.USER32(00000032), ref: 6D05EE0D
SetRectEmpty.USER32(0000016C), ref: 6D05EE20
EnumDisplayMonitors.USER32(00000000,00000000,6D05F5C9,0000016C,?,?,?,6D040F38), ref: 6D05EE30
SystemParametersInfoW.USER32(00000030,00000000,0000016C,00000000), ref: 6D05EE3F
SystemParametersInfoW.USER32(00001002,00000000,00000190,00000000), ref: 6D05EE6C
SystemParametersInfoW.USER32(00001012,00000000,00000194,00000000), ref: 6D05EE80
SystemParametersInfoW.USER32 ref: 6D05EEA6

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: System$InfoParameters$Metrics$DisplayEmptyEnumMonitorsRect
String ID:
API String ID: 2614369430-0
Opcode ID: 88698d384c86863e733c392dc5b306def9049cc78efcd50910bc80870d184a2b
Instruction ID: d384fb5644a90b106760cc1b1f2a699650494f707787d018dfd51aca2c493599
Opcode Fuzzy Hash: 88698d384c86863e733c392dc5b306def9049cc78efcd50910bc80870d184a2b
Instruction Fuzzy Hash: DD2115B1241616BEE7058F71AC88BE7BBECFF4A395F000529B959C6140D7B028658BE0

Function 6D049BB8 Relevance: 12.1, APIs: 8, Instructions: 64memorystringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(00000000), ref: 6D049BCC
lstrcmpW.KERNEL32(00000000,?), ref: 6D049BE5
OpenPrinterW.WINSPOOL.DRV(?,?,00000000), ref: 6D049BFA
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 6D049C1A
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000), ref: 6D049C22
GlobalLock.KERNEL32(00000000), ref: 6D049C30
DocumentPropertiesW.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002), ref: 6D049C41
ClosePrinter.WINSPOOL.DRV(?), ref: 6D049C59

Part of subcall function 6D0604C6: GlobalFlags.KERNEL32(?), ref: 6D0604D3
Part of subcall function 6D0604C6: GlobalUnlock.KERNEL32(?), ref: 6D0604E1
Part of subcall function 6D0604C6: GlobalFree.KERNEL32(?), ref: 6D0604ED

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: c25cd4e5f8345e1741172e4fea4c50610d53069817ad1ed4908b18bb5aeea796
Instruction ID: a3e2e3b840d5a7fb62487caf4b3731320e62b183c2e6c13c257531ca341ca773
Opcode Fuzzy Hash: c25cd4e5f8345e1741172e4fea4c50610d53069817ad1ed4908b18bb5aeea796
Instruction Fuzzy Hash: 1A1119B1544619FFFB129FA1DE85F6A7BEDEB04784B028439F61191021D771E950EA20

Function 6D058227 Relevance: 12.0, APIs: 8, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GlobalSize.KERNEL32(?), ref: 6D058230
GlobalAlloc.KERNEL32(00002002,00000000,?,?,6D0581A3,?,?,00000054), ref: 6D058248
GlobalLock.KERNEL32(?), ref: 6D058258
GlobalLock.KERNEL32(?), ref: 6D058261
GlobalSize.KERNEL32(?), ref: 6D05826E
GlobalUnlock.KERNEL32(?), ref: 6D05827F
GlobalUnlock.KERNEL32(?), ref: 6D058288
GlobalSize.KERNEL32(?), ref: 6D058298

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Global$Size$LockUnlock$Alloc
String ID:
API String ID: 2344174106-0
Opcode ID: 4bcabe878a0071b2872cacc1f1bc5036b72c021b8d2d00bf74605c0dc9d8998f
Instruction ID: 725db7729cfcb1153691dd78709e80b54cbc87b391dd441eb77c73705ebad8b9
Opcode Fuzzy Hash: 4bcabe878a0071b2872cacc1f1bc5036b72c021b8d2d00bf74605c0dc9d8998f
Instruction Fuzzy Hash: 16012172640215BFEB006B65FDCCF6A7FFDEB46351B004824FD0592101D7B189109760

Function 6D0636FF Relevance: 12.0, APIs: 8, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 6D063705
GetSystemMetrics.USER32(0000000C), ref: 6D063710
GetSystemMetrics.USER32(00000002), ref: 6D06371B
GetSystemMetrics.USER32(00000003), ref: 6D063729
GetDC.USER32(00000000), ref: 6D063737
GetDeviceCaps.GDI32(00000000,00000058), ref: 6D063742
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6D06374E
ReleaseDC.USER32(00000000,00000000), ref: 6D06375A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: e25f3067118df2d897eeac0f1482c0df73eee94da9e4e24e250bea80eed66eb4
Instruction ID: 85c5c4c0c5090396eac8174322874bed65a96dabc2fb7c0e731132196565087f
Opcode Fuzzy Hash: e25f3067118df2d897eeac0f1482c0df73eee94da9e4e24e250bea80eed66eb4
Instruction Fuzzy Hash: 00F0F97A984B10ABEB105F71B89DB567FB5FB46752F008516F6028A180DBF584519F80

Function 6D046537 Relevance: 10.8, APIs: 7, Instructions: 347COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000000,?), ref: 6D046650
OffsetRect.USER32(?,?,00000000), ref: 6D046670
SetCapture.USER32(?), ref: 6D0466E3
RedrawWindow.USER32(?,00000000,00000000,00000180,00000000), ref: 6D046702
ReleaseCapture.USER32 ref: 6D046790
OffsetRect.USER32(?,000000FF,000000FF), ref: 6D046806
OffsetRect.USER32(?,000000FF,000000FF), ref: 6D046817

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: OffsetRect$Capture$RedrawReleaseWindow
String ID:
API String ID: 1110970518-0
Opcode ID: 7983fa16c1e936daa5d5b7b02f1a8a6cd687a9bc5befbd743e6ebf94a2e297ba
Instruction ID: 3d257d83d0d682ad55e42d5527f44d4b95b38a189c64301481d02735f3b41869
Opcode Fuzzy Hash: 7983fa16c1e936daa5d5b7b02f1a8a6cd687a9bc5befbd743e6ebf94a2e297ba
Instruction Fuzzy Hash: DDD14B35600215DFDF059F68C898BAD37B6BB8A324F1581B9ED1A9B385DF70AC05CB90

Function 6D19E355 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6D19E3DB

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6841bbd9860f6fda0d7d1fa183d4ead4a9b02b117e0b5a63b269bd0fe24d6878
Instruction ID: f3912f3c7a16be092a0955e25a5dc8ed9a9475753c08cd1a3bf1759e9bcb78f3
Opcode Fuzzy Hash: 6841bbd9860f6fda0d7d1fa183d4ead4a9b02b117e0b5a63b269bd0fe24d6878
Instruction Fuzzy Hash: 72B147729063569FEB028F64C881BAE7BA5FF16710F154155E904EF28AE7F4DA01CBA0

Function 6D15C4C7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D15C4CE

Part of subcall function 6D15C791: OleGetClipboard.OLE32(00000000), ref: 6D15C7A7

ReleaseStgMedium.OLE32(?), ref: 6D15C552
ReleaseStgMedium.OLE32(?), ref: 6D15C599
ReleaseStgMedium.OLE32(?), ref: 6D15C5A8
CoTaskMemFree.OLE32(?,?,00000000,?,00000040,6D0C727C,?,00000000,00000000,0000005C), ref: 6D15C658

Strings

', xrefs: 6D15C506

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MediumRelease$ClipboardFreeH_prolog3_catchTask
String ID: '
API String ID: 3213536121-1997036262
Opcode ID: 89160848f9e209054a685d52056aea22f5181142b673f93336ff7fb1a76d4b8a
Instruction ID: 780f60676c07254bde94150f1b2eb5349f9575c096bb5935d940e4cf05e648d5
Opcode Fuzzy Hash: 89160848f9e209054a685d52056aea22f5181142b673f93336ff7fb1a76d4b8a
Instruction Fuzzy Hash: EC5195B1E1420A9BDF01CFB8C844BADBBB6AF59314F158019E621E7244DBF8DA51CB50

Function 6D052407 Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D07D789: IsWindow.USER32(?), ref: 6D07D795

SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6D0525CB

Part of subcall function 6D07DE07: GetClientRect.USER32(?,?), ref: 6D07DE2F
Part of subcall function 6D07DE07: PtInRect.USER32(?,00000000,?), ref: 6D07DE49

ScreenToClient.USER32(?,?), ref: 6D052498
PtInRect.USER32(?,?,?), ref: 6D0524AB
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6D0524DD
GetParent.USER32(?), ref: 6D05250D
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6D05258B
GetFocus.USER32 ref: 6D052591

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageRectSend$Client$FocusParentScreenWindow
String ID:
API String ID: 1639644240-0
Opcode ID: ade3ce77e3296b8d3a720cca205d1c42c6ac3126e43cb7d3d8b509fc2ca03fef
Instruction ID: 6effcbef5d9c1589dbf941ddd5bee5916a443ef0f7aeb2fea664756ffbe8bffe
Opcode Fuzzy Hash: ade3ce77e3296b8d3a720cca205d1c42c6ac3126e43cb7d3d8b509fc2ca03fef
Instruction Fuzzy Hash: 6C514F72A0420A9FEB21DB79CA54BAE7BF9FF49305B014069ED16E7250DB30D911CF94

Function 6D074515 Relevance: 10.6, APIs: 7, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6D0C7234: __EH_prolog3_catch.LIBCMT ref: 6D0C723B

UpdateWindow.USER32(?), ref: 6D0745C2
EqualRect.USER32(?,?), ref: 6D074602
InflateRect.USER32(?,00000002,00000002), ref: 6D07461A
InvalidateRect.USER32(?,?,00000001), ref: 6D074629
InflateRect.USER32(?,00000002,00000002), ref: 6D074640
InvalidateRect.USER32(?,?,00000001), ref: 6D074652
UpdateWindow.USER32(?), ref: 6D07465B

Part of subcall function 6D072D3A: InvalidateRect.USER32(?,?,00000001,?), ref: 6D072DB1
Part of subcall function 6D072D3A: InflateRect.USER32(?,00000000,?), ref: 6D072DF7
Part of subcall function 6D072D3A: RedrawWindow.USER32(?,?,00000000,00000401), ref: 6D072E0B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$InflateInvalidateWindow$Update$EqualH_prolog3_catchRedraw
String ID:
API String ID: 1041772997-0
Opcode ID: 0c9912b94205792a3125fe01d32c2154ce5d1f6f71eaca8d432c4551be2ee09b
Instruction ID: cb870d53123df5a2ccc11ddd45ffbfcf778a182dfdc96430fd918d4fecd3c1eb
Opcode Fuzzy Hash: 0c9912b94205792a3125fe01d32c2154ce5d1f6f71eaca8d432c4551be2ee09b
Instruction Fuzzy Hash: C3518D7560020AAFDF01DF64C888BAE3BB6FB49354F154179ED19EF281DB719901CBA1

Function 6D0C71B5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 137registryclipboardCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0C71BC
RegisterClipboardFormatW.USER32(00000010), ref: 6D0C7206
__EH_prolog3_catch.LIBCMT ref: 6D0C723B

Part of subcall function 6D083F2C: __EH_prolog3.LIBCMT ref: 6D083F33

__EH_prolog3_catch.LIBCMT ref: 6D0C738A

Part of subcall function 6D05F788: __EH_prolog3_catch.LIBCMT ref: 6D05F78F

Strings

ToolbarButton%p, xrefs: 6D0C71F4
!m, xrefs: 6D0C71CC

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3_catch$H_prolog3$ClipboardFormatRegister
String ID: ToolbarButton%p$!m
API String ID: 3051953459-116341293
Opcode ID: 1f2bb2db703a84751965737d07c178e5c5f87a1d24a3a5cc2ee744183d796dca
Instruction ID: 32e8a3e7956df0209a1b1eb6d43e93a913604cb778674cd39e22faa41399abc9
Opcode Fuzzy Hash: 1f2bb2db703a84751965737d07c178e5c5f87a1d24a3a5cc2ee744183d796dca
Instruction Fuzzy Hash: 2E41B475E042069BEF04DBA58D08B7F7BB9AF85748F124058EA25AB284DF74D901C762

Function 6D04BF5E Relevance: 10.6, APIs: 7, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6D04BF8B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 6D04BFAD
UpdateWindow.USER32(?), ref: 6D04BFC7
SendMessageW.USER32(?,00000121,00000001,?), ref: 6D04BFED
SendMessageW.USER32(?,0000036A,00000000,00000000), ref: 6D04C005
UpdateWindow.USER32(?), ref: 6D04C052

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 6D04C09C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: f3b2dd618553add240ad82a2ada77cb8c85d7d697ad2351f3b6790a63a4a6caa
Instruction ID: 6657d89b9dc03410efd4da6508e6baef0f002659200f9e20bf249a9c49a420c2
Opcode Fuzzy Hash: f3b2dd618553add240ad82a2ada77cb8c85d7d697ad2351f3b6790a63a4a6caa
Instruction Fuzzy Hash: DF417B71A04206EBFB049BB5D888F7EBBF9BF05744F008169E925E7180DBB0E9149B94

Function 6D0913B9 Relevance: 10.6, APIs: 7, Instructions: 131keyboardCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32(00000012), ref: 6D0913DA
GetAsyncKeyState.USER32(00000012), ref: 6D0913F8
GetKeyboardState.USER32(?), ref: 6D09142A
GetKeyboardLayout.USER32(?), ref: 6D09143D
MapVirtualKeyW.USER32(?,00000000), ref: 6D091448
ToUnicodeEx.USER32(?,00000000,?,?,00000002,00000001,00000000), ref: 6D091463
CharUpperW.USER32(?), ref: 6D091479

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: State$AsyncKeyboard$CharLayoutUnicodeUpperVirtual
String ID:
API String ID: 298839909-0
Opcode ID: d9fa32fbd66032e025e7f936deae2d98e0f97e36bf20f333d6c0b94f5de62e3c
Instruction ID: 4207eaa07e74ec56093180633a3d37a3754c29a28b9436a6db9c06b5e1ed10ec
Opcode Fuzzy Hash: d9fa32fbd66032e025e7f936deae2d98e0f97e36bf20f333d6c0b94f5de62e3c
Instruction Fuzzy Hash: F8412435708109ABEB009F209C84BBAB7BDEF55750F418469EA1ADB140EB70D951EB62

Function 6D182A50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6D182A87
___except_validate_context_record.LIBVCRUNTIME ref: 6D182A8F
_ValidateLocalCookies.LIBCMT ref: 6D182B18
__IsNonwritableInCurrentImage.LIBCMT ref: 6D182B43
_ValidateLocalCookies.LIBCMT ref: 6D182B98

Strings

csm, xrefs: 6D182B2D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 66262337016843f7bae6ee9251d467ba403a6dfcb06b583c77187d2e971436f2
Instruction ID: 4b911ecace66130dd9141f3a3d8193bb823240f7b96bc34375669bb3108d0e9f
Opcode Fuzzy Hash: 66262337016843f7bae6ee9251d467ba403a6dfcb06b583c77187d2e971436f2
Instruction Fuzzy Hash: 8B41B734A0521AAFCF22CF68CC94AAE7BB5FF05328F118055E9155B39AD7B1DA11CF90

Function 6D1538FD Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D153904

Part of subcall function 6D0B8FAE: __EH_prolog3.LIBCMT ref: 6D0B8FB5

Part of subcall function 6D17A110: SetRectEmpty.USER32(?), ref: 6D17A145

SetRectEmpty.USER32(?), ref: 6D153A34
SetRectEmpty.USER32 ref: 6D153A45
SetRectEmpty.USER32(?), ref: 6D153A4C

Strings

False, xrefs: 6D153AB3, 6D153AB8, 6D153AC0
True, xrefs: 6D153A54, 6D153A5F, 6D153AA7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: EmptyRect$H_prolog3
String ID: False$True
API String ID: 3752103406-1895882422
Opcode ID: 3a8ae941e21e0cab728b3b0e5d3e94a57f54fa36e34ff15bb62fed07d612fbee
Instruction ID: f8eb01a7d731698fdfc02bfaa5dd622fc428a84050462f0b266e9e42b5681c9b
Opcode Fuzzy Hash: 3a8ae941e21e0cab728b3b0e5d3e94a57f54fa36e34ff15bb62fed07d612fbee
Instruction Fuzzy Hash: 755108B08043019FDB0ACF29D484BA9BBE8BF58304F1981BEE91D9F256CBB41601CF65

Function 6D0CD336 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0CD33D
CopyRect.USER32(?,?), ref: 6D0CD3EB
IsRectEmpty.USER32(?), ref: 6D0CD403
IsRectEmpty.USER32(?), ref: 6D0CD41B
IsRectEmpty.USER32(?), ref: 6D0CD430

Part of subcall function 6D05F13A: __EH_prolog3.LIBCMT ref: 6D05F141
Part of subcall function 6D05F13A: LoadCursorW.USER32(00000000,00007F00), ref: 6D05F165
Part of subcall function 6D05F13A: GetClassInfoW.USER32(?,?,?), ref: 6D05F1A0

Strings

Afx:ControlBar, xrefs: 6D0CD372

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Empty$ClassCopyCursorH_prolog3H_prolog3_InfoLoad
String ID: Afx:ControlBar
API String ID: 685170547-4244778371
Opcode ID: e8f4295eb81d80af94cb537c00e7bf83a04ed9ba520972af0d9237309c6f7bf3
Instruction ID: bd8170dadc9ca15a1c3a2a292b3eb0b6084f0a0114cc21f615ff168e7c1ea89b
Opcode Fuzzy Hash: e8f4295eb81d80af94cb537c00e7bf83a04ed9ba520972af0d9237309c6f7bf3
Instruction Fuzzy Hash: 18415B31A042199BEF01DFA4D884BEE77FABF89304F154069EE05FB240DBB5A905DB61

Function 6D05A0F8 Relevance: 10.6, APIs: 7, Instructions: 123COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D05A125
IsThemeBackgroundPartiallyTransparent.UXTHEME(?,00000006,00000000), ref: 6D05A140
DrawThemeParentBackground.UXTHEME(?,?,?), ref: 6D05A154
SetRectEmpty.USER32(?), ref: 6D05A165
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 6D05A173
DrawThemeBackground.UXTHEME(?,?,00000006,00000000,?,00000000), ref: 6D05A1A9
CopyRect.USER32(?,?), ref: 6D05A20E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: BackgroundRectTheme$Draw$ClientCopyEmptyInfoParametersParentPartiallySystemTransparent
String ID:
API String ID: 2388076383-0
Opcode ID: 74fdc9375d20c63fe134c78d803673dd3f1b35f8ecdfdd79c1bdc2625127af84
Instruction ID: dbbb6445275033cabff3a9ec1bb9c57767dca8474ef9a41db7c8ccab83d1db77
Opcode Fuzzy Hash: 74fdc9375d20c63fe134c78d803673dd3f1b35f8ecdfdd79c1bdc2625127af84
Instruction Fuzzy Hash: E6413B76A00609AFDB01DFA4D984BEFBBF9FF49344F10456AF906A7100D771AA51CBA0

Function 6D0575F4 Relevance: 10.6, APIs: 7, Instructions: 122windowthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6D057520: GetParent.USER32(?), ref: 6D05757D
Part of subcall function 6D057520: GetLastActivePopup.USER32(?), ref: 6D057590
Part of subcall function 6D057520: IsWindowEnabled.USER32(?), ref: 6D0575A4
Part of subcall function 6D057520: EnableWindow.USER32(?,00000000), ref: 6D0575B7

EnableWindow.USER32(?,00000001), ref: 6D05763F
GetWindowThreadProcessId.USER32(?,?), ref: 6D057655
GetCurrentProcessId.KERNEL32 ref: 6D05765F
SendMessageW.USER32(?,00000376,00000000,00000000), ref: 6D057675
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 6D057700
MessageBoxW.USER32(?,?,?,0000004D), ref: 6D057722
EnableWindow.USER32(00000000,00000001), ref: 6D057747

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Enable$MessageProcess$ActiveCurrentEnabledFileLastModuleNameParentPopupSendThread
String ID:
API String ID: 1924968399-0
Opcode ID: 0a7c3f30d2bcfcf78363802e8572188df14d639e4b220a3fa4d6161ba34e0a2e
Instruction ID: b03a01ad70aed45bd68b2b8360dfa9ef3db16b0a2c32d1193594d0915e135077
Opcode Fuzzy Hash: 0a7c3f30d2bcfcf78363802e8572188df14d639e4b220a3fa4d6161ba34e0a2e
Instruction Fuzzy Hash: 4841A475E4021E9BEB109F68DAC8BAA77F9EB44700F10859DE914D3240D7708E909F60

Function 6D06223E Relevance: 10.6, APIs: 7, Instructions: 121windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D062245
CreateCompatibleDC.GDI32(?), ref: 6D062274
GetClientRect.USER32(?,?), ref: 6D062291
SelectObject.GDI32(?,?), ref: 6D0622CA
BitBlt.GDI32(?,00000000,00000000,?,?,00000001,00000000,00000000,00CC0020), ref: 6D0622F1
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 6D062377
SelectObject.GDI32(?,00000000), ref: 6D062385

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ObjectSelect$ClientCompatibleCreateH_prolog3_Rect
String ID:
API String ID: 1651110115-0
Opcode ID: 6cc5f28df094e93e74587c7a86a1f7817ac793b950d6830870fc199f34d5b361
Instruction ID: 2588864a8019fa476f690f3f0fa8299d68226a139071492feba54e297d8db82b
Opcode Fuzzy Hash: 6cc5f28df094e93e74587c7a86a1f7817ac793b950d6830870fc199f34d5b361
Instruction Fuzzy Hash: 4641027191020AAFEF14DBA4DD95FEEBBBAFF48704F118129F605A7190DBB06900CB60

Function 6D05B9DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D05B9E6
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000008,?), ref: 6D05BAEB
RegEnumKeyW.ADVAPI32(?,00000000,?,00000104), ref: 6D05BB08
RegCloseKey.ADVAPI32(?), ref: 6D05BB29
RegQueryValueW.ADVAPI32(80000001,?,?,?), ref: 6D05BB44

Strings

Software\, xrefs: 6D05BA53

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CloseEnumH_prolog3_OpenQueryValue
String ID: Software\
API String ID: 1666054129-964853688
Opcode ID: 8fb14f8d8adae5b179bc673ba53112ca885ca5215bde943b33cd6f7172f4ce07
Instruction ID: 557772175c19ffcc5fdf1d8a4505db42f104425213fcd910fa5ed8f27314e2ef
Opcode Fuzzy Hash: 8fb14f8d8adae5b179bc673ba53112ca885ca5215bde943b33cd6f7172f4ce07
Instruction Fuzzy Hash: DC414F7190512AABEF119BA4DD98FFEB7BCEF09314F1101E9AA05A3150DB74AE50CF50

Function 6D05B83B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6D05B845
RegOpenKeyExW.ADVAPI32(?,00000010,00000000,0002001F,?,00000228), ref: 6D05B8EB

Part of subcall function 6D05B779: __EH_prolog3.LIBCMT ref: 6D05B780

RegEnumKeyW.ADVAPI32(?,00000000,?,00000104), ref: 6D05B90F
RegCloseKey.ADVAPI32(?), ref: 6D05B9C4

Strings

Software\Classes\, xrefs: 6D05B891

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CloseEnumH_prolog3H_prolog3_catch_Open
String ID: Software\Classes\
API String ID: 854624316-1121929649
Opcode ID: d0c613b76e77772190ebfd4db7261f6e821b642a7c315906439ed967708fc2a8
Instruction ID: 63c1628d23e2eea7bfa90b061e9fbc1899c1fc980ccb02ed38dedad767e8297b
Opcode Fuzzy Hash: d0c613b76e77772190ebfd4db7261f6e821b642a7c315906439ed967708fc2a8
Instruction Fuzzy Hash: D241C371904219EBEB11DBA4EE88BEDBBF9EF09310F1140D9D90967251CB70AE54CF50

Function 6D055730 Relevance: 10.6, APIs: 7, Instructions: 85windowthreadCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,00000000), ref: 6D05574F
GetParent.USER32(?), ref: 6D05575D
GetWindowThreadProcessId.USER32(?,00000000), ref: 6D055778
GetCurrentProcessId.KERNEL32 ref: 6D05577E
GetActiveWindow.USER32 ref: 6D0557DD
SendMessageW.USER32(?,00000006,00000001,00000000), ref: 6D0557EE
SendMessageW.USER32(?,00000086,00000001,00000000), ref: 6D055808

Part of subcall function 6D05BFD7: EnableWindow.USER32(?,?), ref: 6D05BFE8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$MessageProcessSend$ActiveCurrentEnableFocusParentThread
String ID:
API String ID: 2169720751-0
Opcode ID: 6a1cf89a57d03a10009ef11dc79f6a874ce0a419a334fd4372b2f63843a824a5
Instruction ID: f4f9b5f4ff16199917582ebe865c866967f8cb6d9f8d397608c3f6727c9507a8
Opcode Fuzzy Hash: 6a1cf89a57d03a10009ef11dc79f6a874ce0a419a334fd4372b2f63843a824a5
Instruction Fuzzy Hash: B831C13564820AEBEB158F20ED8CB797BF6FF45755F104064EA41AB1E0CBB0A864CB90

Function 6D0AF612 Relevance: 10.6, APIs: 7, Instructions: 85COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(00000000,00000004,00000004), ref: 6D0AF653
ValidateRect.USER32(?,00000000,0000E800), ref: 6D0AF68F
UpdateWindow.USER32(?), ref: 6D0AF698
LockWindowUpdate.USER32(00000000), ref: 6D0AF6A9
ValidateRect.USER32(?,00000000,0000E800), ref: 6D0AF6D7
UpdateWindow.USER32(?), ref: 6D0AF6E0
LockWindowUpdate.USER32(00000000), ref: 6D0AF6F1

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: UpdateWindow$Lock$RectValidate
String ID:
API String ID: 797752328-0
Opcode ID: f0143220a19a347c2ef583f53f28e8acadbf66d5642e46bb383c7ffbbb66aa96
Instruction ID: 9af5b343e30285400504c74b0f3a6d04ec5f8fa5027278c86b9fa666d0590d09
Opcode Fuzzy Hash: f0143220a19a347c2ef583f53f28e8acadbf66d5642e46bb383c7ffbbb66aa96
Instruction Fuzzy Hash: DE318D31500706EFEB019FA4E844F6A7BFABB44701F14456EF859A7261DB70E900DB40

Function 6D040DD2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D040DDC
GetClassNameW.USER32(?,?,000000FF), ref: 6D040E36
IsAppThemed.UXTHEME(?,?,00000001,?), ref: 6D040EC7
GetStockObject.GDI32(00000005), ref: 6D040ED8

Strings

Button, xrefs: 6D040E58
Static, xrefs: 6D040E6F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClassH_prolog3_NameObjectStockThemed
String ID: Button$Static
API String ID: 2434646892-2498952662
Opcode ID: 044480e1fbf8b968392bb890fb94cac1d2da55849a2f2f45fc816e5990e7a364
Instruction ID: 9866c5540ef016df3b8da72819b397124533a61ae8e5eaeca61cca767fc322ae
Opcode Fuzzy Hash: 044480e1fbf8b968392bb890fb94cac1d2da55849a2f2f45fc816e5990e7a364
Instruction Fuzzy Hash: 8931A23194821ADBEB14DB66C948FEF73B4AF24354F0181A9DA19B7280DB70AD91CB61

Function 6D0C0F31 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0C0F38

Part of subcall function 6D0C1022: __EH_prolog3.LIBCMT ref: 6D0C1029
Part of subcall function 6D0C1022: GetProfileIntW.KERNEL32(windows,DragMinDist,00000002), ref: 6D0C107C
Part of subcall function 6D0C1022: GetProfileIntW.KERNEL32(windows,DragDelay,000000C8), ref: 6D0C1092

CopyRect.USER32(?,?), ref: 6D0C0F6D
GetCursorPos.USER32(?), ref: 6D0C0F7F
SetRect.USER32(?,?,?,?,?), ref: 6D0C0F92
IsRectEmpty.USER32(?), ref: 6D0C0FAD
InflateRect.USER32(?,00000002,00000002), ref: 6D0C0FBF
DoDragDrop.OLE32(00000000,00000000,?,?), ref: 6D0C1007

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Profile$CopyCursorDragDropEmptyH_prolog3H_prolog3_Inflate
String ID:
API String ID: 1837043813-0
Opcode ID: d37ea7aff22562393aabd6774080925d268a20b02e5bc726eaaa7e94c7546dfd
Instruction ID: 3ff3453aeb63b85de02f69b9531a44480ad29700437e34d22f0b125dcf14262d
Opcode Fuzzy Hash: d37ea7aff22562393aabd6774080925d268a20b02e5bc726eaaa7e94c7546dfd
Instruction Fuzzy Hash: 54317C71A052199FEF01DFE5DD88BEE7BBABF49300B014004F911AB248DB749D56DBA1

Function 6D05AE2D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,software,00000000,0002001F,?,?,00000000,00000000,?,00000000), ref: 6D05AE68
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,00000000,?,00000000,00000000,?,00000000), ref: 6D05AE94
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,00000000,?,00000000,00000000,?,00000000), ref: 6D05AEC0
RegCloseKey.ADVAPI32(00000000,?,00000000), ref: 6D05AED2
RegCloseKey.ADVAPI32(00000000,?,00000000), ref: 6D05AEE1

Part of subcall function 6D05A6FA: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 6D05A70B
Part of subcall function 6D05A6FA: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6D05A71B

Strings

software, xrefs: 6D05AE51

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CloseCreate$AddressHandleModuleOpenProc
String ID: software
API String ID: 550756860-2010147023
Opcode ID: 98b6e8ce12c5d54c1f8410d450d6ae36a1c108739e9baf21b455b507021adfa5
Instruction ID: 516ce2e6a051e2564a4e86b846f18db9232c2b1c101d718bc77c4ed118edbdde
Opcode Fuzzy Hash: 98b6e8ce12c5d54c1f8410d450d6ae36a1c108739e9baf21b455b507021adfa5
Instruction Fuzzy Hash: 3621EA72A04119FFEB019AA4AD44FBFBBBEEB45704F214069AD01E2140D770AE609B64

Function 6D0603C6 Relevance: 10.6, APIs: 7, Instructions: 66COMMON

Download Yara Rule

APIs

RealChildWindowFromPoint.USER32(?,?,?,?,?,?,6D047F18,?,?,?), ref: 6D0603EA
ClientToScreen.USER32(?,?), ref: 6D060404
GetWindow.USER32(?,00000005), ref: 6D060456

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$ChildClientFromPointRealScreen
String ID:
API String ID: 2518355518-0
Opcode ID: 2563b20d103e42b44ea21770fe7294f8af9c25e751e17976cd623c64415cdf6b
Instruction ID: 094ebef293f34a69b9c0d710e49a2136a51630e12469fec9e5c62ea4ae7a93ae
Opcode Fuzzy Hash: 2563b20d103e42b44ea21770fe7294f8af9c25e751e17976cd623c64415cdf6b
Instruction Fuzzy Hash: 3311B172A4451AAFDB11DF69DC48BAF7BF9EF4A340F008125F901E3140EB749A518BA1

Function 6D04FA45 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6D04FA62
GetWindowRect.USER32(?,?), ref: 6D04FA80
ScreenToClient.USER32(?,?), ref: 6D04FA8D
ScreenToClient.USER32(?,?), ref: 6D04FA9A
EqualRect.USER32(?,?), ref: 6D04FAA5
DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000014), ref: 6D04FACC
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,00000000), ref: 6D04FAD6

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$ClientRectScreen$DeferEqualParent
String ID:
API String ID: 443303494-0
Opcode ID: 74fbd9940d59fb44eb92a73419145568251376a4c64d647e9ce191f1408f4dcf
Instruction ID: f2d239cba939b138cf4fa4642af35ffc18d095a655b02a55721edb6d32c7ce02
Opcode Fuzzy Hash: 74fbd9940d59fb44eb92a73419145568251376a4c64d647e9ce191f1408f4dcf
Instruction Fuzzy Hash: 6D213B7690110AEFDF00DFA4D988FAEBBFDEF4A700B108129B901AA154D770A950DB61

Function 6D0C35DD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 6D0C35FB

Part of subcall function 6D060261: DeleteObject.GDI32(00000018), ref: 6D060273

SelectObject.GDI32(?,?), ref: 6D0C3610
DeleteObject.GDI32(00000000), ref: 6D0C3671
DeleteDC.GDI32(00000000), ref: 6D0C3680
LeaveCriticalSection.KERNEL32(6D219B30), ref: 6D0C3697

Strings

, xrefs: 6D0C3616

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Delete$Select$CriticalLeaveSection
String ID:
API String ID: 3849354926-3916222277
Opcode ID: 7f685e6d933661d4315d1f159e3e82c555b615ed01cd006b77106f9c31ac5e33
Instruction ID: f40d689a1d3e81500b27b8b3b071ea6aaab052c50498e56643ec46f2fe59c209
Opcode Fuzzy Hash: 7f685e6d933661d4315d1f159e3e82c555b615ed01cd006b77106f9c31ac5e33
Instruction Fuzzy Hash: 4B212731450201DFEF00DF24DCC8BAA3BB5FF46315F10C268EE249A156DBB19491DBA1

Function 6D04EA9D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 6D04EAB4
FindResourceW.KERNEL32(?,00000000,AFX_DIALOG_LAYOUT), ref: 6D04EADC
SizeofResource.KERNEL32(?,00000000), ref: 6D04EAEE
LoadResource.KERNEL32(?,00000000), ref: 6D04EAFA
LockResource.KERNEL32(00000000), ref: 6D04EB05

Strings

AFX_DIALOG_LAYOUT, xrefs: 6D04EACD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeofWindow
String ID: AFX_DIALOG_LAYOUT
API String ID: 2582447065-2436846380
Opcode ID: d4387ba3d530448cf12527c5de47f57c8cbbbdce6fbcacfaae288b736bbf43d9
Instruction ID: 028b6077632d7d959d5a63027b23a37feb4d319690d075414e5432b85de807e9
Opcode Fuzzy Hash: d4387ba3d530448cf12527c5de47f57c8cbbbdce6fbcacfaae288b736bbf43d9
Instruction Fuzzy Hash: 95117971600201EBFB019B75EC8CF7B76EAEF89250B008179EA06D2210EFB4E90097A0

Function 6D0A3179 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0A3180

Part of subcall function 6D040987: __EH_prolog3.LIBCMT ref: 6D04098E

Strings

AQUA_, xrefs: 6D0A31C6
BLUE_, xrefs: 6D0A31D4
BLACK_, xrefs: 6D0A31CD, 6D0A31D9, 6D0A31E1
SILVER_, xrefs: 6D0A31BF
IDX_OFFICE2007_STYLE, xrefs: 6D0A3190

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3
String ID: AQUA_$BLACK_$BLUE_$IDX_OFFICE2007_STYLE$SILVER_
API String ID: 431132790-2717817858
Opcode ID: 47753440cbee765c948c878aab082d9589aa886e3397ea1174847fbf7cceab31
Instruction ID: 6a19c8690631e2bdb39aae3193c6ad79671111feba5c9b299379e4d56821888c
Opcode Fuzzy Hash: 47753440cbee765c948c878aab082d9589aa886e3397ea1174847fbf7cceab31
Instruction Fuzzy Hash: 85113D7690400AE7FB01CBECCD04BFE7BB5AF85314F1A8205EA11BB185DB709A01C752

Function 6D04DB50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,?,?,00000000,?,6D04D1DA,00000000,00000000), ref: 6D04DB61
GetProcAddress.KERNEL32(00000000,RegisterTouchWindow), ref: 6D04DB73
GetProcAddress.KERNEL32(00000000,UnregisterTouchWindow), ref: 6D04DB81

Strings

UnregisterTouchWindow, xrefs: 6D04DB79
RegisterTouchWindow, xrefs: 6D04DB6D
user32.dll, xrefs: 6D04DB58

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
API String ID: 667068680-2470269259
Opcode ID: e57873434d02e09032018893f9b5a4b82955271207d23d2156cee9e7be7ee257
Instruction ID: e917c86ba54d0c4904c2652bb77a8521a53ac5e49e14c5cfd0163a5d9f1b565c
Opcode Fuzzy Hash: e57873434d02e09032018893f9b5a4b82955271207d23d2156cee9e7be7ee257
Instruction Fuzzy Hash: 3101D63260091AFBEB011BA5DC8CF6976F5FF8A3B1F008436ED1592600DFB0D91486E0

Function 6D06673F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll,?,?,6D05DEA6,00000001,?,00000002,00000000,?), ref: 6D066751
GetProcAddress.KERNEL32(00000000,BeginBufferedPaint), ref: 6D066761
EncodePointer.KERNEL32(00000000,?,6D05DEA6,00000001,?,00000002,00000000,?), ref: 6D06676A
DecodePointer.KERNEL32(00000000,?,?,6D05DEA6,00000001,?,00000002,00000000,?), ref: 6D066778

Strings

uxtheme.dll, xrefs: 6D06674C
BeginBufferedPaint, xrefs: 6D06675B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: BeginBufferedPaint$uxtheme.dll
API String ID: 2061474489-1632326970
Opcode ID: 1892082e9506a3aa505a9bd5711984300f93dc4f8dee14d9bf54c4d0719c7d12
Instruction ID: 68f3c7943bfc1a87b73e0a626f344e08b4802d35d66ac7255c85c073797efdd5
Opcode Fuzzy Hash: 1892082e9506a3aa505a9bd5711984300f93dc4f8dee14d9bf54c4d0719c7d12
Instruction Fuzzy Hash: C0F01D7150126AABEF015FB4AC8CB6A7FF9EB4A791B404564FD15D2214DB70D8109BE0

Function 6D066A9A Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(comctl32.dll), ref: 6D066AAC
GetProcAddress.KERNEL32(00000000,TaskDialogIndirect), ref: 6D066ABC
EncodePointer.KERNEL32(00000000), ref: 6D066AC5
DecodePointer.KERNEL32(00000000), ref: 6D066AD3

Strings

comctl32.dll, xrefs: 6D066AA7
TaskDialogIndirect, xrefs: 6D066AB6

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: TaskDialogIndirect$comctl32.dll
API String ID: 2061474489-2809879075
Opcode ID: 880bdfc74f47aa76213b0072a7cc9c005f1aae0018d2686174d974c9dea6c63c
Instruction ID: a91bf4b4b42fe5d8a177f482d08f673c9a9f7ca16a3ce7eebefa8996e2a3baef
Opcode Fuzzy Hash: 880bdfc74f47aa76213b0072a7cc9c005f1aae0018d2686174d974c9dea6c63c
Instruction Fuzzy Hash: F2F09075600256BBDF119F64AC4CBAA7BF9EF0A3507408560FD1592210DBB0C810DEE1

Function 6D06654F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(shell32.dll), ref: 6D066561
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6D066571
EncodePointer.KERNEL32(00000000), ref: 6D06657A
DecodePointer.KERNEL32(00000000), ref: 6D066588

Strings

SHGetKnownFolderPath, xrefs: 6D06656B
shell32.dll, xrefs: 6D06655C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 2061474489-2936008475
Opcode ID: 93d0cbd10dbc7089ad43580f071f26d3ae16e29396591efbff4b7b4b593f7c1e
Instruction ID: a961e26b753a9435fd334ccf59852d97442100030a2b4ae7c45cb165e2d5c989
Opcode Fuzzy Hash: 93d0cbd10dbc7089ad43580f071f26d3ae16e29396591efbff4b7b4b593f7c1e
Instruction Fuzzy Hash: B0F09071600266ABDF115F64EC0DB6F7FF9BB0A390B404654FD1492208EB70D900DAE0

Function 6D0664EA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(shell32.dll), ref: 6D0664FC
GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 6D06650C
EncodePointer.KERNEL32(00000000), ref: 6D066515
DecodePointer.KERNEL32(00000000), ref: 6D066523

Strings

shell32.dll, xrefs: 6D0664F7
SHCreateItemFromParsingName, xrefs: 6D066506

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2061474489-2320870614
Opcode ID: 4a3af248cba51ea3f3e69feae13c04caff7b1ec1c6ec04c78c6b9e486397ef4b
Instruction ID: 4e5721102b9fc8d1faac4352d7f9fbd18dde4bead59bcc6e1cd12588b9f2ba6b
Opcode Fuzzy Hash: 4a3af248cba51ea3f3e69feae13c04caff7b1ec1c6ec04c78c6b9e486397ef4b
Instruction Fuzzy Hash: 4AF09071500256ABDF025F64EC0DB6E7FF9EB0A350B408554FD1592204EF71C9009BE0

Function 6D066378 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6D049AFF,?,?,?,?), ref: 6D06638A
GetProcAddress.KERNEL32(00000000,RegisterApplicationRecoveryCallback), ref: 6D06639A
EncodePointer.KERNEL32(00000000,?,?,6D049AFF,?,?,?,?), ref: 6D0663A3
DecodePointer.KERNEL32(00000000,?,?,6D049AFF,?,?,?,?), ref: 6D0663B1

Strings

RegisterApplicationRecoveryCallback, xrefs: 6D066394
kernel32.dll, xrefs: 6D066385

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: RegisterApplicationRecoveryCallback$kernel32.dll
API String ID: 2061474489-202725706
Opcode ID: 74b7e260f206b1bc0b5c4acd546dc12076c72cdc5cd1e292d59e8c8702887020
Instruction ID: 73fd166f2eb0a1473134f2f6870a2c623206206a607c9fb2ddbfd91b5b9a18b3
Opcode Fuzzy Hash: 74b7e260f206b1bc0b5c4acd546dc12076c72cdc5cd1e292d59e8c8702887020
Instruction Fuzzy Hash: 14F0903150027AABDF019F64EC0CB6A7BF9EF0AB607408554FE15D2200DBB0C8019BF0

Function 6D06648E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll), ref: 6D0664A0
GetProcAddress.KERNEL32(00000000,ChangeWindowMessageFilter), ref: 6D0664B0
EncodePointer.KERNEL32(00000000), ref: 6D0664B9
DecodePointer.KERNEL32(00000000), ref: 6D0664C7

Strings

ChangeWindowMessageFilter, xrefs: 6D0664AA
user32.dll, xrefs: 6D06649B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 2061474489-2498399450
Opcode ID: e44c2e7c34240bc86ae75dc835bb417d0dcfd64407d81c16d9a57dfbc0bb2c4a
Instruction ID: bcf6f8cb0c8543fad845b51d99509f65f2738f9ced0df06465be93bae6dd63a2
Opcode Fuzzy Hash: e44c2e7c34240bc86ae75dc835bb417d0dcfd64407d81c16d9a57dfbc0bb2c4a
Instruction Fuzzy Hash: B9F05830601266ABEF111B74AC4CB6B7AF9EB0A7A03408561FD19D2204EB72C804CAF0

Function 6D0667A4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll,?,?,6D05DF8D,?,00000001,FDA68A44), ref: 6D0667B6
GetProcAddress.KERNEL32(00000000,EndBufferedPaint), ref: 6D0667C6
EncodePointer.KERNEL32(00000000,?,?,6D05DF8D,?,00000001,FDA68A44), ref: 6D0667CF
DecodePointer.KERNEL32(00000000,?,?,6D05DF8D,?,00000001,FDA68A44), ref: 6D0667DD

Strings

uxtheme.dll, xrefs: 6D0667B1
EndBufferedPaint, xrefs: 6D0667C0

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: EndBufferedPaint$uxtheme.dll
API String ID: 2061474489-2993015961
Opcode ID: 8e45b01efd50c70c2d9dfb19224331d67aa62e799a74c895a2c52f65123f48c9
Instruction ID: 4e8d2b8771f7b9607859594418919dc64a01c24da9147e106476c86979960036
Opcode Fuzzy Hash: 8e45b01efd50c70c2d9dfb19224331d67aa62e799a74c895a2c52f65123f48c9
Instruction Fuzzy Hash: DBF0827160422AABEF011B78AC8CF6A7BF9EF0A7917404565FD25D7200EF70C8048AF0

Function 6D066319 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6D049AE3,?,?), ref: 6D06632B
GetProcAddress.KERNEL32(00000000,RegisterApplicationRestart), ref: 6D06633B
EncodePointer.KERNEL32(00000000,?,?,6D049AE3,?,?), ref: 6D066344
DecodePointer.KERNEL32(00000000,?,?,6D049AE3,?,?), ref: 6D066352

Strings

RegisterApplicationRestart, xrefs: 6D066335
kernel32.dll, xrefs: 6D066326

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: RegisterApplicationRestart$kernel32.dll
API String ID: 2061474489-1259503209
Opcode ID: 5a442bd5b5b5b0fd81fc6a7ac88db8a5a868d5e2ee3113e84cf3b7521705f375
Instruction ID: db38502cec18276feab849417212b1f059046554cbec813613829ab38fe4c9ef
Opcode Fuzzy Hash: 5a442bd5b5b5b0fd81fc6a7ac88db8a5a868d5e2ee3113e84cf3b7521705f375
Instruction Fuzzy Hash: 14F0897150027AABEF015B74AC4C75A7FF9EB0ABA13404551FE15D3200DF70C84096F4

Function 6D0663DD Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6D049B1E,00000000), ref: 6D0663EF
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryInProgress), ref: 6D0663FF
EncodePointer.KERNEL32(00000000,?,?,6D049B1E,00000000), ref: 6D066408
DecodePointer.KERNEL32(00000000,?,?,6D049B1E,00000000), ref: 6D066416

Strings

ApplicationRecoveryInProgress, xrefs: 6D0663F9
kernel32.dll, xrefs: 6D0663EA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: ApplicationRecoveryInProgress$kernel32.dll
API String ID: 2061474489-2899047487
Opcode ID: 8c883aed34feaa89fc05993bd55b8c244a6a65d2b25eb5bef6cdee2ef78c6d1b
Instruction ID: 691bb7c26e1c7b74dde0080eafaebed623a8abf59bd1be261e15ada3c4fc4269
Opcode Fuzzy Hash: 8c883aed34feaa89fc05993bd55b8c244a6a65d2b25eb5bef6cdee2ef78c6d1b
Instruction Fuzzy Hash: 75F0A731600266ABEF011B75AC4C76FBAF9EB0B7943808664FD15E3305EF60C80186E0

Function 6D066439 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,6D049B61,00000001), ref: 6D06644B
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryFinished), ref: 6D06645B
EncodePointer.KERNEL32(00000000,?,6D049B61,00000001), ref: 6D066464
DecodePointer.KERNEL32(00000000,?,?,6D049B61,00000001), ref: 6D066472

Strings

ApplicationRecoveryFinished, xrefs: 6D066455
kernel32.dll, xrefs: 6D066446

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: ApplicationRecoveryFinished$kernel32.dll
API String ID: 2061474489-1962646049
Opcode ID: 180e2a0854522a6855faa2425d069d98ccfb00ffe0aa9a8897d3d01e9eb7d5f1
Instruction ID: 9423d81453081bfd5fcb4f7f3aa2761e0146075f9c4e3ed6be968cf5e7b41f7a
Opcode Fuzzy Hash: 180e2a0854522a6855faa2425d069d98ccfb00ffe0aa9a8897d3d01e9eb7d5f1
Instruction Fuzzy Hash: D8F0A031600226ABEF005B74AC8CB6B7AFCEA0A6913408664FD05D3200EF70C80086E0

Function 6D0665B4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(shell32.dll,?,6D04FFCC,?,?,6D051682,000FC000,00000010,00000048,6D051861,?,?,?,?,00000000), ref: 6D0665C3
GetProcAddress.KERNEL32(00000000,InitNetworkAddressControl), ref: 6D0665D3
EncodePointer.KERNEL32(00000000,?,?,6D051682,000FC000,00000010,00000048,6D051861,?,?,?,?,00000000,?,6D051B11,?), ref: 6D0665DC
DecodePointer.KERNEL32(00000000,?,6D04FFCC,?,?,6D051682,000FC000,00000010,00000048,6D051861,?,?,?,?,00000000), ref: 6D0665EA

Strings

shell32.dll, xrefs: 6D0665BE
InitNetworkAddressControl, xrefs: 6D0665CD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: InitNetworkAddressControl$shell32.dll
API String ID: 2061474489-1950653938
Opcode ID: e6e1a4803dafc7f8432e7d6a61cc58f4095cca84fe181a13268aa9db5227becb
Instruction ID: 181b9c05ad56460a3aa946df2b6b6f4cf56fd1417b369681e8dcfaa87b285131
Opcode Fuzzy Hash: e6e1a4803dafc7f8432e7d6a61cc58f4095cca84fe181a13268aa9db5227becb
Instruction Fuzzy Hash: 23E06D71605662ABEF115B74BD8DB6B7BF9EF0A3913404565F911D2208EF64CC018AE0

Function 6D066695 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll,?,6D05DE78,?,?,?,?,?,?,?,?,00000008), ref: 6D0666A4
GetProcAddress.KERNEL32(00000000,BufferedPaintInit), ref: 6D0666B4
EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000008), ref: 6D0666BD
DecodePointer.KERNEL32(00000000,?,6D05DE78,?,?,?,?,?,?,?,?,00000008), ref: 6D0666CB

Strings

uxtheme.dll, xrefs: 6D06669F
BufferedPaintInit, xrefs: 6D0666AE

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: BufferedPaintInit$uxtheme.dll
API String ID: 2061474489-1331937065
Opcode ID: e6ddeaa9146b3e8f98cc892274cb30bb7ba4133a0feddd8fda541ad0970511b5
Instruction ID: 3294083f75eda1a54f46d06d1a93df3dab631dfdc8ccdb21e972a5a51fbf4efb
Opcode Fuzzy Hash: e6ddeaa9146b3e8f98cc892274cb30bb7ba4133a0feddd8fda541ad0970511b5
Instruction Fuzzy Hash: DBE06D36A04632ABEB109B34BC4C76B7AF9AB4A7913014559FE11E2204DF64CD058AE8

Function 6D0666EA Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(uxtheme.dll,?,6D05F02A,?,?,6D05E2C3,FDA68A44,?,?,?,Function_0019BF80,000000FF), ref: 6D0666F9
GetProcAddress.KERNEL32(00000000,BufferedPaintUnInit), ref: 6D066709
EncodePointer.KERNEL32(00000000,?,6D05F02A,?,?,6D05E2C3,FDA68A44,?,?,?,Function_0019BF80,000000FF), ref: 6D066712
DecodePointer.KERNEL32(00000000,?,6D05F02A,?,?,6D05E2C3,FDA68A44,?,?,?,Function_0019BF80,000000FF), ref: 6D066720

Strings

uxtheme.dll, xrefs: 6D0666F4
BufferedPaintUnInit, xrefs: 6D066703

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: BufferedPaintUnInit$uxtheme.dll
API String ID: 2061474489-1501038116
Opcode ID: e5158b3559e7cb40cde56992fbe29d8dc344fedaea2dab2c3da28b0a14d74387
Instruction ID: 1892a66f4449fadc482291f1a26ad20a9ab0e30567802c066bc43bb9259c9091
Opcode Fuzzy Hash: e5158b3559e7cb40cde56992fbe29d8dc344fedaea2dab2c3da28b0a14d74387
Instruction Fuzzy Hash: BFE06571A01523A7EB005734BC8C76A7AF8EB4B2957454559FD11E2204DF74C8069AE4

Function 6D066A4F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(comctl32.dll), ref: 6D066A5E
GetProcAddress.KERNEL32(00000000,TaskDialogIndirect), ref: 6D066A6E
EncodePointer.KERNEL32(00000000), ref: 6D066A77
DecodePointer.KERNEL32(00000000), ref: 6D066A89

Strings

comctl32.dll, xrefs: 6D066A59
TaskDialogIndirect, xrefs: 6D066A68

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: TaskDialogIndirect$comctl32.dll
API String ID: 2061474489-2809879075
Opcode ID: 26d055689558702ffabff9b1ba364242f78b8580859d5337e7baea677b5bf339
Instruction ID: 0b135ced0a59fab00fb67d2721788a8fe95254e4f35173c334d19a2eff0689c5
Opcode Fuzzy Hash: 26d055689558702ffabff9b1ba364242f78b8580859d5337e7baea677b5bf339
Instruction Fuzzy Hash: 44E04875611222BFAB009B747D8CBA77AFADF462913028B55FD41D3104EB60CC019AF1

Function 6D0636AD Relevance: 10.5, APIs: 7, Instructions: 25COMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 6D0636B2
GetSysColor.USER32(00000010), ref: 6D0636BD
GetSysColor.USER32(00000014), ref: 6D0636C8
GetSysColor.USER32(00000012), ref: 6D0636D3
GetSysColor.USER32(00000006), ref: 6D0636DE
GetSysColorBrush.USER32(0000000F), ref: 6D0636E9
GetSysColorBrush.USER32(00000006), ref: 6D0636F4

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: 1ecaa60ec36be0ef60fc02be89dcfd231994a359142d5f0c90754cf51d9ba6d5
Instruction ID: acdcfa293d91bf851d0540499cf3a26cbe845bd0fbdb596fec3a4360638e92c5
Opcode Fuzzy Hash: 1ecaa60ec36be0ef60fc02be89dcfd231994a359142d5f0c90754cf51d9ba6d5
Instruction Fuzzy Hash: 7AF098759447009BDB706FB1F68D7467AF2BB09751F04096AE2868B980E7F6A060AF00

Function 6D0719EA Relevance: 9.3, APIs: 6, Instructions: 333COMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 6D071A72
GetClientRect.USER32(?,6D0712C4), ref: 6D071A85
GetWindowRect.USER32(00000000,?), ref: 6D071ACF
GetParent.USER32(00000000), ref: 6D071AD8
GetParent.USER32(00000000), ref: 6D071D6B
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,00000000,?,?,?,?,?,?,?,6D0712C4,00000000), ref: 6D071D9B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Parent$RectWindow$ClientRedraw
String ID:
API String ID: 443302174-0
Opcode ID: 532b03ec802adb7f1877146586ceef8fd34bc37a957b15a7a10690fa05a572d3
Instruction ID: 2aa30e7e0a4521dcbb8f3b09ea84c90244805685f6efd629ddb4bfc42041ea5e
Opcode Fuzzy Hash: 532b03ec802adb7f1877146586ceef8fd34bc37a957b15a7a10690fa05a572d3
Instruction Fuzzy Hash: 1DD16A35E0061ADFEF15CFA8C8A8BAE7BF5BF49310F155169E911AB290DB30A840CF55

Function 6D19229E Relevance: 9.3, APIs: 6, Instructions: 295COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6D192431
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D19244D
__allrem.LIBCMT ref: 6D192464
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D192482
__allrem.LIBCMT ref: 6D192499
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6D1924B7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 4e626c3389022694cdf3dd9abb1c06e132224f33bdd4575620872207e3283c84
Instruction ID: 2536fdfedbe7c381b45291f0beae7a83b85f713c6f5a26c0de956ed1f6b585ec
Opcode Fuzzy Hash: 4e626c3389022694cdf3dd9abb1c06e132224f33bdd4575620872207e3283c84
Instruction Fuzzy Hash: 55915972A447029BE7318F69DC80BAA73F9AF56728F614129F511DF2C9E7F0D6018B90

Function 6D063FED Relevance: 9.3, APIs: 6, Instructions: 295COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D064102
GetWindowRect.USER32(?,?), ref: 6D064116
OffsetRect.USER32(?,?,?), ref: 6D064137
GetThemePartSize.UXTHEME(00000000,?,00000002,00000000,00000000,00000001,?), ref: 6D064167
GetThemePartSize.UXTHEME(00000000,?,00000001,00000000,00000000,00000001,?), ref: 6D0641DE
DrawThemeBackground.UXTHEME(00000000,?,?,00000000,?,?), ref: 6D064257

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: RectTheme$PartSize$BackgroundClientDrawOffsetWindow
String ID:
API String ID: 751140830-0
Opcode ID: 9e1277ca61cddcf43ed7d7ffbaff3999bf88ae58841082d444302feab3bc526d
Instruction ID: 35f5abbc4f7fd8bb21b443f3643921e806a2b739d95fa99d1d5ada74d3fff0c0
Opcode Fuzzy Hash: 9e1277ca61cddcf43ed7d7ffbaff3999bf88ae58841082d444302feab3bc526d
Instruction Fuzzy Hash: E1B13035A0420AAFDB04CFA8C995BAEBBF5FF49314F148129E919E7240DB70E951CB60

Function 6D1A2AD2 Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d72a3febe356ceb980817a9cc31ee92252a3ed2a7564ae9f201663163b2ec2d
Instruction ID: d57aa59d56ea649a56c07a8041be50cb18a252b462959c75cad93427a7f97c3a
Opcode Fuzzy Hash: 3d72a3febe356ceb980817a9cc31ee92252a3ed2a7564ae9f201663163b2ec2d
Instruction Fuzzy Hash: 46B11978A482459FDB12CF9AC840BBD7BB1BF56304F195158E5159B28AC7F0D982CB60

Function 6D039BD0 Relevance: 9.2, APIs: 6, Instructions: 240COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 6D039C7B
SHGetFolderPathA.SHELL32 ref: 6D039CC4
GetFileAttributesA.KERNEL32 ref: 6D039DBF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AttributesFile$FolderPath
String ID:
API String ID: 1382956649-0
Opcode ID: f870857d1755d669ca64bb152b9bc77c2ec487fa5c1bd43f687c82a2db08887e
Instruction ID: 4c911f58d24e203aa715e074db3fec4bf81e6936d23d3fe729a598649f08ba5e
Opcode Fuzzy Hash: f870857d1755d669ca64bb152b9bc77c2ec487fa5c1bd43f687c82a2db08887e
Instruction Fuzzy Hash: 5BB159B4904315CFDB14EF68D888B9DBBF0BF49304F4185AAD4199B390DB759A88CF82

Function 6D080A24 Relevance: 9.2, APIs: 6, Instructions: 229windowtimeCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 6D080A33

Part of subcall function 6D040987: __EH_prolog3.LIBCMT ref: 6D04098E

GetClientRect.USER32(?,?), ref: 6D080A75

Part of subcall function 6D044051: ClientToScreen.USER32(?,6D07DE40), ref: 6D044060
Part of subcall function 6D044051: ClientToScreen.USER32(?,6D07DE48), ref: 6D04406D

IsWindowVisible.USER32(?), ref: 6D080CAE
SetTimer.USER32(00000000,0000EC15,00000000), ref: 6D080CD1
InvalidateRect.USER32(?,00000000,00000001,6D217AD8,00000000,00000000,00000000,00000000,00000053), ref: 6D080D40
UpdateWindow.USER32(?), ref: 6D080D49

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Client$RectScreenWindow$CursorH_prolog3InvalidateLoadTimerUpdateVisible
String ID:
API String ID: 3378768144-0
Opcode ID: c8c9a7a17633b9193c71222bf9c73c4a2b7f76c4b9806697947a89e70ab18d79
Instruction ID: 0e28ebe84cda4ddd5f75b285daf14ffb9215d804ddc2b0a7a7b7456c2684ad8c
Opcode Fuzzy Hash: c8c9a7a17633b9193c71222bf9c73c4a2b7f76c4b9806697947a89e70ab18d79
Instruction Fuzzy Hash: 2BA17770A0A20A9FEF14CF25D994BBD7BB5BF48318F144179ED19AB396DB70A840CB50

Function 6D0741D6 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6D074379
GetParent.USER32(?), ref: 6D074398
GetParent.USER32(?), ref: 6D0743A7
RedrawWindow.USER32(?,00000000,00000000,00000505,6D1CA554,00000000), ref: 6D07440D
GetParent.USER32(?), ref: 6D074416
RedrawWindow.USER32(?,00000000,00000000,00000505,00000000), ref: 6D07443D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Parent$RedrawWindow
String ID:
API String ID: 2946272266-0
Opcode ID: 15d43bd5becc3d6da2acc74fa143fdb587ca0a6228073aae8bb0810dbb1d89dc
Instruction ID: d94d9630a6dec681ada5e777a1499787045fd1bb64633657cb42ba43ebd48de9
Opcode Fuzzy Hash: 15d43bd5becc3d6da2acc74fa143fdb587ca0a6228073aae8bb0810dbb1d89dc
Instruction Fuzzy Hash: EA717035B0021AAFDF05DF64C898B6E7BBABF49355B014069E9269B390DF34ED11CB90

Function 6D045B04 Relevance: 9.2, APIs: 6, Instructions: 195COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D045B29
InflateRect.USER32(?,?,?), ref: 6D045B45
PtInRect.USER32(?,?,?), ref: 6D045BAD
PtInRect.USER32(?,?,?), ref: 6D045BFF
PtInRect.USER32(?,?,?), ref: 6D045C5E
PtInRect.USER32(?,?,?), ref: 6D045CC5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$ClientInflate
String ID:
API String ID: 256450704-0
Opcode ID: c4fdf657e8e942254f1fd0ea265c4c72e988aae16fbecb068c6c14ad3966496f
Instruction ID: 8a639a2d68de5600e59aee170cc71211a98de6b45ee2067b4ab6057b580e5088
Opcode Fuzzy Hash: c4fdf657e8e942254f1fd0ea265c4c72e988aae16fbecb068c6c14ad3966496f
Instruction Fuzzy Hash: F571FA75E0060ADFDB05CFA9C988BEEB7F6BF49304F148129E819E7210D771A952CB90

Function 6D05937F Relevance: 9.2, APIs: 6, Instructions: 191COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 6D0593C7
EqualRect.USER32(?,00000000), ref: 6D0593E5

Part of subcall function 6D05BF18: SetWindowPos.USER32(?,00000115,00000000,00000000,00000002,00000002,00000000,?,?,6D0595AB,00000000,00000002,00000002,00000000,00000000,00000115), ref: 6D05BF40

GetDlgCtrlID.USER32(?), ref: 6D059491
CopyRect.USER32(?,00000000), ref: 6D0594CD
GetParent.USER32(?), ref: 6D0595AE
SetParent.USER32(?,?), ref: 6D0595C4

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$ParentWindow$CopyCtrlEqual
String ID:
API String ID: 1662903855-0
Opcode ID: fc63f64c2fda1e7d95ca416b14bc0047ae2330a30c94796caf311830e20f4af7
Instruction ID: 9171b7d93a57a343d260b1e68eadf05c73cdd124275507ed96d844de8de760d5
Opcode Fuzzy Hash: fc63f64c2fda1e7d95ca416b14bc0047ae2330a30c94796caf311830e20f4af7
Instruction Fuzzy Hash: 4961A0B1604219ABEF14DF24DD88BEAB7B9FF45304F0142A8EE1AD7190CB34A951CB50

Function 6D08856A Relevance: 9.2, APIs: 6, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 6D0885B1
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 6D08861C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6D088639
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 6D088678
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 6D0886D7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6D0886FA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: bdfe1fc6c80c3e411136a5397dca41bad796bfb048a1eb2c74252d5d978ef093
Instruction ID: 7c780daf9f143f3508571273e9e69228ad2d4a0dad9889e904b8f14bd982b5e2
Opcode Fuzzy Hash: bdfe1fc6c80c3e411136a5397dca41bad796bfb048a1eb2c74252d5d978ef093
Instruction Fuzzy Hash: E2519E72A00206ABFF218F64EC48FBA3BF9EF45754F514428FA25E6195DB70D9109BA0

Function 6D0710F6 Relevance: 9.2, APIs: 6, Instructions: 167windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 6D071184
SendMessageW.USER32(?,0000040C,00000000,00000000), ref: 6D0711C0
SendMessageW.USER32(00000000,0000041C,00000000,?), ref: 6D0711F3
SetRectEmpty.USER32(?), ref: 6D071259
SendMessageW.USER32(00000000,0000040B,00000000,?), ref: 6D0712B5
RedrawWindow.USER32(00000000,00000000,00000000,00000505), ref: 6D0712E4

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$EmptyParentRectRedrawWindow
String ID:
API String ID: 3879113052-0
Opcode ID: 129f6d46a3a9ca5e3f8f234910f625a3fd05fa4f796630a76d16e6d700e72018
Instruction ID: 7c805849108467675986286ed2e615cf5c47a0bb3589fdda1527d5361c3213fe
Opcode Fuzzy Hash: 129f6d46a3a9ca5e3f8f234910f625a3fd05fa4f796630a76d16e6d700e72018
Instruction Fuzzy Hash: 72519375A002199FEB24CFA4C8A4BAEBBF5FF48304F11412DE915AB390DB70A901CF85

Function 6D0764D4 Relevance: 9.2, APIs: 6, Instructions: 156windowCOMMON

Download Yara Rule

APIs

CallNextHookEx.USER32(00000000,?,?), ref: 6D0764EF
WindowFromPoint.USER32(?,?), ref: 6D076519
ScreenToClient.USER32(00000020,00000200), ref: 6D07654F
GetParent.USER32(00000020), ref: 6D0765B6
UpdateWindow.USER32(?), ref: 6D07661C
SendMessageW.USER32(?,00000100,00000024,00000000), ref: 6D07669A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$CallClientFromHookMessageNextParentPointScreenSendUpdate
String ID:
API String ID: 4074787488-0
Opcode ID: 674fb51cb30b83102711a1b85fdd7ae131ed84248791192e31ad2b07b50b2dfa
Instruction ID: 1ad6a13b7e6ada336fae226d5a9d7d9bb102bd9445fe14d8bbb9263770a45646
Opcode Fuzzy Hash: 674fb51cb30b83102711a1b85fdd7ae131ed84248791192e31ad2b07b50b2dfa
Instruction Fuzzy Hash: A951D035600206EFEF148F64CC98B6E7BF6FF89314F518469EA269B290CB319911DB84

Function 6D05268D Relevance: 9.1, APIs: 6, Instructions: 145windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6D052712
IsWindow.USER32(?), ref: 6D05278D
ClientToScreen.USER32(?,?), ref: 6D05279E
IsWindow.USER32(?), ref: 6D0527BC
ClientToScreen.USER32(?,?), ref: 6D0527EC
SendMessageW.USER32(?,0000020A,?,?), ref: 6D05284A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClientMessageScreenSendWindow
String ID:
API String ID: 2093367132-0
Opcode ID: e53e7b53a2ee07c9a2e190300dd40264c5ef33e30a95af91f4621eced5243574
Instruction ID: 71d1ff911371de00dd49d6280f15bd43903ade8b703c028761ba2af4440873d5
Opcode Fuzzy Hash: e53e7b53a2ee07c9a2e190300dd40264c5ef33e30a95af91f4621eced5243574
Instruction Fuzzy Hash: 2341C03261460BAAFB318FB4CF48B3E7AF5EF09340F114968ED62D65A4E731D961E610

Function 6D048308 Relevance: 9.1, APIs: 6, Instructions: 140windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

SendMessageW.USER32(?,0000043D,00000000,00000000), ref: 6D0483AE
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 6D0483BF
SendMessageW.USER32(?,0000043C,00000001,00000000), ref: 6D0483D3
SendMessageW.USER32(?,0000043C,00000000,00000000), ref: 6D0483E4
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 6D0483F3
InvalidateRect.USER32(?,00000000,00000001,00000000,?,00000000,?,?,?,?,?,?,?,?,?,6D047D90), ref: 6D048486

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$InvalidateLongRectWindow
String ID:
API String ID: 74886174-0
Opcode ID: 7f457626fe982d1a78fd839838e5271a79fd0c33857375f3033d9ffcfcca114e
Instruction ID: 14346362f5c2ed418c335557365c0092bb6016313c2248e25ff587be0a98d17e
Opcode Fuzzy Hash: 7f457626fe982d1a78fd839838e5271a79fd0c33857375f3033d9ffcfcca114e
Instruction Fuzzy Hash: 28418E31640219ABEF119F60DC99FEE7BB6BF89714F044025FA15AB291DBB0A851CB90

Function 6D06B853 Relevance: 9.1, APIs: 6, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D06B85A
GlobalAlloc.KERNEL32(00000040,00000004), ref: 6D06B9C1
GlobalLock.KERNEL32(00000000), ref: 6D06B9CE
GlobalUnlock.KERNEL32(00000000), ref: 6D06B9DF
SetPropW.USER32(?,00000000), ref: 6D06B9EF
GlobalFree.KERNEL32(00000000), ref: 6D06B9FA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Global$AllocFreeH_prolog3LockPropUnlock
String ID:
API String ID: 2329575679-0
Opcode ID: 93aca461491faad5dfb2aee22b21d2d15739653ecb8b8dff4c74698ec073cab8
Instruction ID: 8f7536f62fbc218c3b352b894bf2b5531a79e8ebd363a117500681e6c33ddac7
Opcode Fuzzy Hash: 93aca461491faad5dfb2aee22b21d2d15739653ecb8b8dff4c74698ec073cab8
Instruction Fuzzy Hash: F641F1706046069BEB049F78C844BAEBBF5FF45318F118529FA69CB280DF70D901CBA1

Function 6D039680 Relevance: 9.1, APIs: 6, Instructions: 106processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 6D0396A2
Process32FirstW.KERNEL32 ref: 6D039703
WideCharToMultiByte.KERNEL32 ref: 6D039779
Process32NextW.KERNEL32 ref: 6D039817
CloseHandle.KERNEL32 ref: 6D03984B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Process32$ByteCharCloseCreateFirstHandleMultiNextSnapshotToolhelp32Wide
String ID:
API String ID: 4013288513-0
Opcode ID: 2f1df319a800d6dc114e8a3ea9101d0b0c18672f544302ec6c2133ab1b9683e3
Instruction ID: 7e87575abddfb87a0d9a5f46413f7c1d339f0e25b664c7a54bbde28e1735de04
Opcode Fuzzy Hash: 2f1df319a800d6dc114e8a3ea9101d0b0c18672f544302ec6c2133ab1b9683e3
Instruction Fuzzy Hash: D5511570808369DFDB12DF68E88439DBBF4BB45304F0185ADE498A7280DB759B88CF42

Function 6D0837CE Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 6D0837F6
OffsetRect.USER32(?,?,?), ref: 6D083817
SendMessageW.USER32(00000000,0000000B,00000000,00000000), ref: 6D083824
IsWindowVisible.USER32(00000000), ref: 6D08382D
SendMessageW.USER32(00000000,0000000B,00000001,00000000), ref: 6D0838A0
RedrawWindow.USER32(00000000,00000000,00000000,00000105), ref: 6D0838B0

Part of subcall function 6D05BF75: ShowWindow.USER32(?,00000000,?,?,6D05975A,00000000), ref: 6D05BF86

Part of subcall function 6D05BF18: SetWindowPos.USER32(?,00000115,00000000,00000000,00000002,00000002,00000000,?,?,6D0595AB,00000000,00000002,00000002,00000000,00000000,00000115), ref: 6D05BF40

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$MessageRectSend$OffsetRedrawShowVisible
String ID:
API String ID: 2359670889-0
Opcode ID: 3ecb22f59b340c29835d15a77c800dc611b54ff58ee26be75252be21eabb9cd7
Instruction ID: 99684ccad89e41fcc4623b413465e7b2130194e7b766b8cd0ecfcf8b80e43e8e
Opcode Fuzzy Hash: 3ecb22f59b340c29835d15a77c800dc611b54ff58ee26be75252be21eabb9cd7
Instruction Fuzzy Hash: 6B313E72640209BFEB11DBA8DE84FBFBBBEFB49704F000518B655E2190DB70AD109B20

Function 6D04B629 Relevance: 9.1, APIs: 6, Instructions: 86windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 6D04B64A
GetWindow.USER32(?,00000005), ref: 6D04B661
GetWindowRect.USER32(00000000,?), ref: 6D04B67C

Part of subcall function 6D044090: ScreenToClient.USER32(?,6D0594E1), ref: 6D04409F
Part of subcall function 6D044090: ScreenToClient.USER32(?,6D0594E9), ref: 6D0440AC

SetWindowPos.USER32(00000000,00000000,?,?,00000000,00000000,00000015,?), ref: 6D04B6A2
GetWindow.USER32(00000000,00000002), ref: 6D04B6AB
ScrollWindow.USER32(?,?,?,?,?), ref: 6D04B6C7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$ClientScreen$RectScrollVisible
String ID:
API String ID: 1714389229-0
Opcode ID: 3a272165e330d41f4da9aed044d0d1f2e08e02aaf7a1d0c3a06cafeef9e1fea0
Instruction ID: 5a5dc30c3fa1685536e6ae6eb62d3c833794800cdd7676af5df215265c64e33b
Opcode Fuzzy Hash: 3a272165e330d41f4da9aed044d0d1f2e08e02aaf7a1d0c3a06cafeef9e1fea0
Instruction Fuzzy Hash: E2217C3660060AEBEB01DF64DC88FAF7BBAFF89714B11802DF91597250EB74E9109B50

Function 6D056177 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D05617E
UnpackDDElParam.USER32(000003E8,?,?,?), ref: 6D0561B6
GlobalLock.KERNEL32(?), ref: 6D0561BE
GlobalUnlock.KERNEL32(?), ref: 6D0561F2
ReuseDDElParam.USER32(?,000003E8,000003E4,00008000,?), ref: 6D056235
PostMessageW.USER32(?,000003E4,?,00000000), ref: 6D056241

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: GlobalParam$H_prolog3_catchLockMessagePostReuseUnlockUnpack
String ID:
API String ID: 4045269880-0
Opcode ID: c8bec8e4f3c8b60369c040a3bb3aef1838731976d47c071516fc2570cdccdc0d
Instruction ID: 9127fb8454ffc1ad46dc1b796e84ce7d5c8c7235b05fc281e353c22ee398baeb
Opcode Fuzzy Hash: c8bec8e4f3c8b60369c040a3bb3aef1838731976d47c071516fc2570cdccdc0d
Instruction Fuzzy Hash: 6D316D7090410AEFEF05DBA0CA95FBEBBB9BF54309F154418EA0177290DBB06E15CB91

Function 6D05EEBD Relevance: 9.1, APIs: 6, Instructions: 84windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D05EEC4
CreateRectRgnIndirect.GDI32(00000000), ref: 6D05EEE4

Part of subcall function 6D043A1A: SelectClipRgn.GDI32(?,00000000), ref: 6D043A3A
Part of subcall function 6D043A1A: SelectClipRgn.GDI32(?,00000000), ref: 6D043A50

GetParent.USER32(00000000), ref: 6D05EF04
DrawThemeParentBackground.UXTHEME(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000018), ref: 6D05EF25
MapWindowPoints.USER32(00000000,?,00000000,00000001), ref: 6D05EF59
SendMessageW.USER32(?,00000014,00000000,00000000), ref: 6D05EF85

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClipParentSelect$BackgroundCreateDrawH_prolog3IndirectMessagePointsRectSendThemeWindow
String ID:
API String ID: 935984306-0
Opcode ID: 8761fb53b542b83799292aa200626dfdf8e83b0aa02ece38dca34fb3c8846be7
Instruction ID: dd0bc66c51e4fb8808d5ecaabc64271849ea1cfae99b6c98456acb4d446e7c6e
Opcode Fuzzy Hash: 8761fb53b542b83799292aa200626dfdf8e83b0aa02ece38dca34fb3c8846be7
Instruction Fuzzy Hash: 21312D75A0020AEFEF01DFA1C984FEE7BB5FF08305F014568EA15AB250DB759A24DB50

Function 6D048C8B Relevance: 9.1, APIs: 6, Instructions: 80windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D0649BD

Part of subcall function 6D043F78: __EH_prolog3.LIBCMT ref: 6D043F7F
Part of subcall function 6D043F78: GetWindowDC.USER32(00000000,00000004,6D05E51A,00000000,?,?,?,6D218020,00000000), ref: 6D043FAB

GetClientRect.USER32(?,?), ref: 6D0649DF
GetWindowRect.USER32(?,?), ref: 6D0649F3

Part of subcall function 6D044090: ScreenToClient.USER32(?,6D0594E1), ref: 6D04409F
Part of subcall function 6D044090: ScreenToClient.USER32(?,6D0594E9), ref: 6D0440AC

OffsetRect.USER32(?,?,?), ref: 6D064A14

Part of subcall function 6D043A5D: ExcludeClipRect.GDI32(?,?,?,?,?), ref: 6D043A94
Part of subcall function 6D043A5D: ExcludeClipRect.GDI32(00000000,?,?,?,?), ref: 6D043AB1

OffsetRect.USER32(?,?,?), ref: 6D064A36

Part of subcall function 6D043ABE: IntersectClipRect.GDI32(?,?,?,?,?), ref: 6D043AF5
Part of subcall function 6D043ABE: IntersectClipRect.GDI32(00000000,?,?,?,?), ref: 6D043B12

SendMessageW.USER32(?,00000014,?,00000000), ref: 6D064A6E

Part of subcall function 6D043FCD: ReleaseDC.USER32(?,00000000), ref: 6D044001

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Clip$Client$ExcludeIntersectOffsetScreenWindow$H_prolog3H_prolog3_MessageReleaseSend
String ID:
API String ID: 3860140383-0
Opcode ID: c692614e5a22d6ff9e127419eeb76b330a69f2b2451572518a689534deae690a
Instruction ID: 3b432fb629191dc7393f7efc6b0b4b2f8154236fb6c05135e1224bac163923a8
Opcode Fuzzy Hash: c692614e5a22d6ff9e127419eeb76b330a69f2b2451572518a689534deae690a
Instruction Fuzzy Hash: 7F310572A4411DAFDF05DBA0DC98EFEB7B9BF4D304F144219F502A3290EB24AA55CB60

Function 6D057520 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 6D057558
GetParent.USER32(?), ref: 6D057566
GetParent.USER32(?), ref: 6D05757D
GetLastActivePopup.USER32(?), ref: 6D057590
IsWindowEnabled.USER32(?), ref: 6D0575A4
EnableWindow.USER32(?,00000000), ref: 6D0575B7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 7282e9e09fe964b7be611affdc5ef8969dfc1bd412398baad73351d0ff71197f
Instruction ID: f305dad6a8b3bac316d0371987df12c927438c91206af7ffe9bcf3c2c146d0d2
Opcode Fuzzy Hash: 7282e9e09fe964b7be611affdc5ef8969dfc1bd412398baad73351d0ff71197f
Instruction Fuzzy Hash: 86110B72E0562297F7120A795684B7E32FD7FC6B50B02C124ED17A7240DBE0DD2266D0

Function 6D0CEF45 Relevance: 9.1, APIs: 6, Instructions: 67COMMON

Download Yara Rule

APIs

Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 6D0CEFDA
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 6D0CEFF0
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 6D0CEFFB
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 6D0CF006
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 6D0CF011
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 6D0CF01C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ContextExternal$BaseBase::~Concurrency::details::
String ID:
API String ID: 1690591649-0
Opcode ID: 5d8993df89d39f99db2406cc232877226400319d9fa9fcb60aa335996a7f0743
Instruction ID: 539aa6858efabdd7b968c9d6ffdfcec1e3856b9da211d1d49bb514050c394fad
Opcode Fuzzy Hash: 5d8993df89d39f99db2406cc232877226400319d9fa9fcb60aa335996a7f0743
Instruction Fuzzy Hash: 9A21B071308906ABE708DF65C8A0BADB769FB45314F42462CDA1657280DF747912CB82

Function 6D1981AC Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6D1829F6,6D04091B,6D182035,?,00000007,6D20F650,00000010,6D182058,?,?,6D1820E1,?,00000001,?), ref: 6D1981BA
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6D1981C8
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6D1981E1
SetLastError.KERNEL32(00000000,00000007,6D20F650,00000010,6D182058,?,?,6D1820E1,?,00000001,?,?,00000001,?,6D20F678,0000000C), ref: 6D198233

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c0c9f5a5ba3131725e53e4b37da92a77dfd5f2568257c388b989b2d31aa5307b
Instruction ID: d5bf4b589e334b6c8e4a63c37aea8732b372b43d49ec85aea307db28243944d9
Opcode Fuzzy Hash: c0c9f5a5ba3131725e53e4b37da92a77dfd5f2568257c388b989b2d31aa5307b
Instruction Fuzzy Hash: A401283224C6625FAB2506B4BD897672AB4EB667BD321433AF320590D8EFE18805D184

Function 6D053773 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 6D05377C
GetWindow.USER32(00000000), ref: 6D053783
GetWindowLongW.USER32(00000000,000000F0), ref: 6D0537B1
ShowWindow.USER32(00000000,00000000), ref: 6D0537CC
ShowWindow.USER32(00000000,00000004), ref: 6D0537ED
GetWindow.USER32(00000000,00000002), ref: 6D0537FA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Show$DesktopLong
String ID:
API String ID: 3178490500-0
Opcode ID: 190677651cd07bd96a3ad1623d743114352df8d547e5bbc7148f032ad21cc061
Instruction ID: d8d88612d510d65b9d4bb4652dffc7d4baeeabc28f3eeffd055e2673a9f23634
Opcode Fuzzy Hash: 190677651cd07bd96a3ad1623d743114352df8d547e5bbc7148f032ad21cc061
Instruction Fuzzy Hash: 9A11E572909B5B67F73257209D8EB6A3AF5BF0A3E1F100261FD50D5080DB70C420C6D4

Function 6D198A9F Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 6D198BBE
CallUnexpected.LIBVCRUNTIME ref: 6D198E37

Strings

csm, xrefs: 6D198B49
csm, xrefs: 6D198ADC
csm, xrefs: 6D198BF5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 063cf1a6493da28f90ba70b81efe840bf7de009705c014aeca5ab4f775e37343
Instruction ID: ddbadae69ed43f0918ab720ddb23f2ea83eca00a6b976ab86065b9327d65dd7a
Opcode Fuzzy Hash: 063cf1a6493da28f90ba70b81efe840bf7de009705c014aeca5ab4f775e37343
Instruction Fuzzy Hash: 41B19BB180820AEFCF19CFA4D8809AEBBB5FF24314F15456AE9116F219D3B1DA51CF91

Function 6D06033D Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 6D060356
GetDlgCtrlID.USER32(00000000), ref: 6D060361
GetWindowLongW.USER32(00000000,000000F0), ref: 6D060371
GetWindowRect.USER32(00000000,?), ref: 6D06038A
PtInRect.USER32(?,?,?), ref: 6D06039A
GetWindow.USER32(?,00000005), ref: 6D0603A7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 80d702a0c3e6951ef5b2af55ad240724fcfe4c8e99c78c3acb125db007511b6e
Instruction ID: 3f03c2a9f302bfe6578ff96d7253c84e12d97e3280af9934409cf5f6bf395fa9
Opcode Fuzzy Hash: 80d702a0c3e6951ef5b2af55ad240724fcfe4c8e99c78c3acb125db007511b6e
Instruction Fuzzy Hash: 8C012231A8812AABEF11DF64DD48FAF37FCEF06705F408115F801E6080DB709A109BA1

Function 6D0601E7 Relevance: 9.0, APIs: 6, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 6D0601EB

Part of subcall function 6D060287: GetWindowLongW.USER32(00000018,000000F0), ref: 6D0602A2
Part of subcall function 6D060287: GetClassNameW.USER32(00000018,?,0000000A), ref: 6D0602B7
Part of subcall function 6D060287: CompareStringW.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF), ref: 6D0602CE

GetParent.USER32(00000000), ref: 6D06020C
GetWindowLongW.USER32(00000000,000000F0), ref: 6D06022B
GetParent.USER32(00000000), ref: 6D060239
GetDesktopWindow.USER32 ref: 6D060241
SendMessageW.USER32(00000000,0000014F,00000000,00000000), ref: 6D060255

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$LongParent$ClassCompareDesktopFocusMessageNameSendString
String ID:
API String ID: 1233893325-0
Opcode ID: 1354a4c682746fbcd5cf08ad296080627fb2f6b55200320f99b72323ef8165fa
Instruction ID: e9ec1e8fd520ad9417ab4fd923431b7642ea34efb9b2a1c1606860f2ca24f9b7
Opcode Fuzzy Hash: 1354a4c682746fbcd5cf08ad296080627fb2f6b55200320f99b72323ef8165fa
Instruction Fuzzy Hash: 0FF0A43528C55367F7031F26BC98B7E36FA5FC2F92F014410FE15A31809B64D50155B5

Function 6D070732 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D07073C

Part of subcall function 6D0BE360: __EH_prolog3.LIBCMT ref: 6D0BE367

Part of subcall function 6D05BCD3: GetDlgCtrlID.USER32(?), ref: 6D05BCDE

Strings

Buttons, xrefs: 6D070832
%TsMFCToolBar-%d%x, xrefs: 6D0707A9
%TsMFCToolBar-%d, xrefs: 6D070791
MFCToolBars, xrefs: 6D07074C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CtrlH_prolog3H_prolog3_catch
String ID: %TsMFCToolBar-%d$%TsMFCToolBar-%d%x$Buttons$MFCToolBars
API String ID: 905329913-3577816979
Opcode ID: 26b7f8b3d783ae0afd112883ab99fa8c95448e42962c74c5e444ef2eb504b762
Instruction ID: 8e535521cdfc7273eb89869002908579977820fea8df4da4e371cd00c868c2c5
Opcode Fuzzy Hash: 26b7f8b3d783ae0afd112883ab99fa8c95448e42962c74c5e444ef2eb504b762
Instruction Fuzzy Hash: 95915D35A0420ADFEF10DF95C994BEEB7B6AF49304F154068EA11AB391DB71AD01CF61

Function 6D04D360 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000433,00000000,?), ref: 6D04D43A
GetWindowLongW.USER32(?,000000FC), ref: 6D04D445
GetWindowLongW.USER32(?,000000FC), ref: 6D04D459
SetWindowLongW.USER32(?,000000FC,00000000), ref: 6D04D482

Strings

,, xrefs: 6D04D422

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: ,
API String ID: 2178440468-3772416878
Opcode ID: a9e3980a721239ecbd4a758b7d4fccfc98fb303d5a0617dc85b609eebfb36cc1
Instruction ID: 019e280e99bd178c463173108da469c09f3e16a6b354c0d97b979dad9773a096
Opcode Fuzzy Hash: a9e3980a721239ecbd4a758b7d4fccfc98fb303d5a0617dc85b609eebfb36cc1
Instruction Fuzzy Hash: 2E41BD35A0461ADFEB01EF70D898B6EBBF5BF89314B018179E95197391DB70AC10CBA1

Function 6D05456F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D054579

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

swprintf.LIBCMT ref: 6D0545CE
swprintf.LIBCMT ref: 6D054672

Strings

- , xrefs: 6D0545EF, 6D0545F4, 6D0545FC, 6D05462C, 6D054631, 6D054639
:%d, xrefs: 6D0545C3, 6D054664

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: swprintf$H_prolog3_LongWindow
String ID: - $:%d
API String ID: 524023746-2359489159
Opcode ID: 2d2db0fccb0d2e1519d97ac9777fe83939f1c82b9d4355a3725ab12810602a39
Instruction ID: f14830aefbe1c88ac73fc7efe48b71090e073e950077dc93ff9978197335a6df
Opcode Fuzzy Hash: 2d2db0fccb0d2e1519d97ac9777fe83939f1c82b9d4355a3725ab12810602a39
Instruction Fuzzy Hash: 1431B472D04115BAFB14DB70CE54FFEB3ACBF05204F064069A709AB155DB74AE66CBA0

Function 6D05F223 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D05F22A
SysStringLen.OLEAUT32(?), ref: 6D05F269
SysStringLen.OLEAUT32(?), ref: 6D05F288
SysFreeString.OLEAUT32(?), ref: 6D05F30F

Strings

@, xrefs: 6D05F2AD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: String$FreeH_prolog3
String ID: @
API String ID: 315669285-2766056989
Opcode ID: 9db0edc1f32d138b2d3be449fa6d16f8f58e10f3c35bf1126093dd5a814a65e2
Instruction ID: b4263cf453672828ebed52277038d2d89252ea80eeed8087ce2d5662123592a4
Opcode Fuzzy Hash: 9db0edc1f32d138b2d3be449fa6d16f8f58e10f3c35bf1126093dd5a814a65e2
Instruction Fuzzy Hash: 6D3118B190414AABEF05DFA4CD84AAE7FB9EF04314F104129FA25AB290DB349961CB60

Function 6D0CA118 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0CA11F

Part of subcall function 6D0BE360: __EH_prolog3.LIBCMT ref: 6D0BE367

Part of subcall function 6D05BCD3: GetDlgCtrlID.USER32(?), ref: 6D05BCDE

Strings

%TsBasePane-%d%x, xrefs: 6D0CA180
BasePanes, xrefs: 6D0CA12C
%TsBasePane-%d, xrefs: 6D0CA169
IsVisible, xrefs: 6D0CA1D7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3$Ctrl
String ID: %TsBasePane-%d$%TsBasePane-%d%x$BasePanes$IsVisible
API String ID: 3879667756-2169875744
Opcode ID: 275a5e72f30ef1aca1f5dd3b1e986d31cf98b3b7a3f6750973e23515bb4515ce
Instruction ID: 7547a182e6cd895260887af554bdf49ba75b48e4752a88eabe009aaa3cef2e2f
Opcode Fuzzy Hash: 275a5e72f30ef1aca1f5dd3b1e986d31cf98b3b7a3f6750973e23515bb4515ce
Instruction Fuzzy Hash: 7431B735A0421A9FDF00DFA4CC48FBEB7B5BF89318F160559DA22A7391DB74A901CB51

Function 6D0CA004 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0CA00B

Part of subcall function 6D0BE360: __EH_prolog3.LIBCMT ref: 6D0BE367

Part of subcall function 6D05BCD3: GetDlgCtrlID.USER32(?), ref: 6D05BCDE

Strings

%TsBasePane-%d%x, xrefs: 6D0CA06F
BasePanes, xrefs: 6D0CA01B
%TsBasePane-%d, xrefs: 6D0CA058
IsVisible, xrefs: 6D0CA0BE

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3$Ctrl
String ID: %TsBasePane-%d$%TsBasePane-%d%x$BasePanes$IsVisible
API String ID: 3879667756-2169875744
Opcode ID: 77258656095705803ad012d465c83c9ce632ac743fdd0008d6c79ceec01ca63d
Instruction ID: 05f0d8bd0b62eccd80d9aca2eeb55a76f88df7f2bcf84111a6d08a37b600b361
Opcode Fuzzy Hash: 77258656095705803ad012d465c83c9ce632ac743fdd0008d6c79ceec01ca63d
Instruction Fuzzy Hash: 06318F7590410A9FEF00DFA4C984BFEBBB5BF49318F154168EA21A7291DB71AD01CB61

Function 6D079A0A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 6D079A4F
ScreenToClient.USER32(?,?), ref: 6D079A5C
SendMessageW.USER32(?,00000030,-0000011C,00000000), ref: 6D079AE4

Strings

,, xrefs: 6D079A73
!m, xrefs: 6D079AAC, 6D079ABE

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClientCursorMessageScreenSend
String ID: ,$!m
API String ID: 3733300889-3671664291
Opcode ID: fdf278ba9ca837b47cfc902c17a299963aee7590b4baa84093d80b2eaf1e66a1
Instruction ID: 61afdebf539499d04e171df95b41ea0bb114be4edc55d6524993f3f15984d167
Opcode Fuzzy Hash: fdf278ba9ca837b47cfc902c17a299963aee7590b4baa84093d80b2eaf1e66a1
Instruction Fuzzy Hash: 8E314C31A0111ABFEB14DB65EC85BAEBBF9FF09214F414025B514EB250EB70E900CB94

Function 6D04F72F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

__snprintf_s.LIBCMT ref: 6D04F75C
__snprintf_s.LIBCMT ref: 6D04F790
GetClassInfoW.USER32(?,0000007C,?), ref: 6D04F7C0

Strings

Afx:%p:%x, xrefs: 6D04F750
Afx:%p:%x:%p:%p:%p, xrefs: 6D04F786

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: __snprintf_s$ClassInfo
String ID: Afx:%p:%x$Afx:%p:%x:%p:%p:%p
API String ID: 1341824228-2801496823
Opcode ID: 0cb2b9f8089993bdcc004274702289a539f1e01e7b432b6fa132da22c9ec9334
Instruction ID: 14b7c9847f1d75e90912ec688f84055ccb7758837d4dffe893e87a917c60e573
Opcode Fuzzy Hash: 0cb2b9f8089993bdcc004274702289a539f1e01e7b432b6fa132da22c9ec9334
Instruction Fuzzy Hash: 72218DB5D44609EFEB11CFA9C980FAE7BF8EF49314F418026EA05EB211D7748A108F61

Function 6D051CEB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

Edit, xrefs: 6D051D42

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 9f5597839ca8efc255dbffa8b48a7a14c2ee2206ca50f670fc4142afd4d68cfc
Instruction ID: 877a7e1d3f27cc23597a308fefa7dab8740ea1e6ec1f25fb83ec3f09072c1eba
Opcode Fuzzy Hash: 9f5597839ca8efc255dbffa8b48a7a14c2ee2206ca50f670fc4142afd4d68cfc
Instruction Fuzzy Hash: 3311E531E84202F7FB111F25EE48F7A76FAAF41381F008434ED55920A0CBB1D421C672

Function 6D066DDA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,FDA68A44,?,?,?,Function_0019BF80,000000FF), ref: 6D066E21
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 6D066E31

Part of subcall function 6D05B7DC: GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 6D05B7EF
Part of subcall function 6D05B7DC: GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 6D05B7FF

Strings

Advapi32.dll, xrefs: 6D066E1C
RegDeleteKeyExW, xrefs: 6D066E2B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW
API String ID: 1646373207-2191092095
Opcode ID: 69f40376e39d0ae455cf1884088d0f01c8ef2409b525b26c4039f718e8db83b6
Instruction ID: 22fe0d1323c0fcaac5b9f37d4f72f31f29f8aea41c997377d76cff0cf66e7a0f
Opcode Fuzzy Hash: 69f40376e39d0ae455cf1884088d0f01c8ef2409b525b26c4039f718e8db83b6
Instruction Fuzzy Hash: D9118B75504185FBEF028F65CC48B6ABBB6FB0A718F408169E92592250CB72A810CBE0

Function 6D06A20F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D06A216
GetClassNameW.USER32(?,00000000,00000400), ref: 6D06A247
GetWindowLongW.USER32(?,000000F0), ref: 6D06A280

Strings

ComboBoxEx32, xrefs: 6D06A26B
ComboBox, xrefs: 6D06A25A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClassH_prolog3LongNameWindow
String ID: ComboBox$ComboBoxEx32
API String ID: 297531199-1907415764
Opcode ID: c0d4794a084dd3f44f1a4dec220ad08bdf8cf3752b2ada09f81460767b90fa78
Instruction ID: f465d7b63b8572d53880d9dc19847009449cc9c521226defd602c9594f887a34
Opcode Fuzzy Hash: c0d4794a084dd3f44f1a4dec220ad08bdf8cf3752b2ada09f81460767b90fa78
Instruction Fuzzy Hash: 3001D27544C1239BEB00AB64DD04FEEB7B4BF51368F620528D620670D8DF75A921CB64

Function 6D0C655D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,PNG,?,?,00000000,6D1C7E7C,?,6D0C21EF,?,?,0000002C,6D0C216E,?,?,?), ref: 6D0C657F
LoadResource.KERNEL32(?,00000000,?,?,00000000,6D1C7E7C,?,6D0C21EF,?,?,0000002C,6D0C216E,?,?,?), ref: 6D0C658D
LockResource.KERNEL32(00000000,?,?,00000000,6D1C7E7C,?,6D0C21EF,?,?,0000002C,6D0C216E,?,?,?,?,6D108AB7), ref: 6D0C6598
SizeofResource.KERNEL32(?,00000000,?,?,00000000,6D1C7E7C,?,6D0C21EF,?,?,0000002C,6D0C216E,?,?,?), ref: 6D0C65A6

Strings

PNG, xrefs: 6D0C6576

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: PNG
API String ID: 3473537107-364855578
Opcode ID: 8803930f3c32e9185cf34b4a5cf7b98612981e98c4174bb4a59c4ceb65aed656
Instruction ID: 6fef9385ef709b158a6f7192ba7334e6ef80c523451202767bdf87503c8ecc0e
Opcode Fuzzy Hash: 8803930f3c32e9185cf34b4a5cf7b98612981e98c4174bb4a59c4ceb65aed656
Instruction Fuzzy Hash: 4AF0F036501211BBEB125BA5EC48FBF77FDEE86261B508015FE00A3218DBB0DA0086F2

Function 6D18F93B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,FDA68A44,6D196272,?,00000000,6D1ABF80,000000FF,?,6D18F9FC,00000002,?,6D18FA98,6D1946D4), ref: 6D18F970
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6D18F982
FreeLibrary.KERNEL32(00000000,?,00000000,6D1ABF80,000000FF,?,6D18F9FC,00000002,?,6D18FA98,6D1946D4), ref: 6D18F9A4

Strings

mscoree.dll, xrefs: 6D18F969
CorExitProcess, xrefs: 6D18F97A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5141b40b68e78db404ba88b0478a5bc89ee261dce9090e073f3c6cb5f281ec59
Instruction ID: a9a6f3952281ca0b37f18a14c0a048142fe081d09f14cf6cdc0f52d586bdce8b
Opcode Fuzzy Hash: 5141b40b68e78db404ba88b0478a5bc89ee261dce9090e073f3c6cb5f281ec59
Instruction Fuzzy Hash: DB016231A0465AAFDF019F50DC09BBEBBF9FB05B65F004629F831A2284DBB49900CA90

Function 6D066803 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 6D06683C

Part of subcall function 6D04AA44: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D04AA6A
Part of subcall function 6D04AA44: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6D04AA7A
Part of subcall function 6D04AA44: EncodePointer.KERNEL32(00000000), ref: 6D04AA83

GetProcAddress.KERNEL32(00000000,DwmDefWindowProc), ref: 6D066825
EncodePointer.KERNEL32(00000000), ref: 6D06682E

Strings

dwmapi.dll, xrefs: 6D066810
DwmDefWindowProc, xrefs: 6D06681F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmDefWindowProc$dwmapi.dll
API String ID: 1102202064-234806475
Opcode ID: 454373f74317309fb832d09ef6c0be949541c89a04ebf0644b43fc47c8650205
Instruction ID: df2da6a73c99dc519813646d255b2957c0b7d93919c769289a67804535a9cbb1
Opcode Fuzzy Hash: 454373f74317309fb832d09ef6c0be949541c89a04ebf0644b43fc47c8650205
Instruction Fuzzy Hash: CCF06D3250022AAFAF015FB5EC48B6A7BF9EF0A6643408564FD10E2210DB70C8109BE0

Function 6D0669EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 6D066A23

Part of subcall function 6D04AA44: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D04AA6A
Part of subcall function 6D04AA44: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6D04AA7A
Part of subcall function 6D04AA44: EncodePointer.KERNEL32(00000000), ref: 6D04AA83

GetProcAddress.KERNEL32(00000000,DwmSetIconicLivePreviewBitmap), ref: 6D066A0C
EncodePointer.KERNEL32(00000000), ref: 6D066A15

Strings

dwmapi.dll, xrefs: 6D0669F7
DwmSetIconicLivePreviewBitmap, xrefs: 6D066A06

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmSetIconicLivePreviewBitmap$dwmapi.dll
API String ID: 1102202064-1757063745
Opcode ID: f4badb4cd10bda883d2b01d28f6f03427f50bcf57a4c6845be60d3df81ce2cb7
Instruction ID: 261f964d75b64cdceff1706cd738438f2b48775af57949f3539d6d79faa2bcb4
Opcode Fuzzy Hash: f4badb4cd10bda883d2b01d28f6f03427f50bcf57a4c6845be60d3df81ce2cb7
Instruction Fuzzy Hash: DEF09671540256BB9F019E64DC08BAA7FF9EF0A354741C565FD14D2200EFB0C9108EE0

Function 6D0668C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 6D066900

Part of subcall function 6D04AA44: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D04AA6A
Part of subcall function 6D04AA44: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6D04AA7A
Part of subcall function 6D04AA44: EncodePointer.KERNEL32(00000000), ref: 6D04AA83

GetProcAddress.KERNEL32(00000000,DwmSetWindowAttribute), ref: 6D0668E9
EncodePointer.KERNEL32(00000000), ref: 6D0668F2

Strings

DwmSetWindowAttribute, xrefs: 6D0668E3
dwmapi.dll, xrefs: 6D0668D4

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmSetWindowAttribute$dwmapi.dll
API String ID: 1102202064-3105884578
Opcode ID: 5b8d98345100c2731aa701e5440c6e6b87e48c95e75e85cf13677ac7fb8fab1c
Instruction ID: 8962ca017fcd065f5a9ec3f7b086a87b9367b9aa39e9a4562ea39172f0d0379f
Opcode Fuzzy Hash: 5b8d98345100c2731aa701e5440c6e6b87e48c95e75e85cf13677ac7fb8fab1c
Instruction Fuzzy Hash: 97F09A3550021ABBAF015BA4EC48B6A7FFDEF0A6A87418065FE14A2204DBB0C8108AF0

Function 6D06692C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 6D066965

Part of subcall function 6D04AA44: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D04AA6A
Part of subcall function 6D04AA44: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6D04AA7A
Part of subcall function 6D04AA44: EncodePointer.KERNEL32(00000000), ref: 6D04AA83

GetProcAddress.KERNEL32(00000000,DwmSetIconicThumbnail), ref: 6D06694E
EncodePointer.KERNEL32(00000000), ref: 6D066957

Strings

dwmapi.dll, xrefs: 6D066939
DwmSetIconicThumbnail, xrefs: 6D066948

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmSetIconicThumbnail$dwmapi.dll
API String ID: 1102202064-2331651847
Opcode ID: a423635824518646606ada2232e7d4704a99047acc34b39adb0a6fb9cec53558
Instruction ID: 77078fe06a6a739c18a03077f1eebbc364d3f149b66fa634c8a448efbe7bd564
Opcode Fuzzy Hash: a423635824518646606ada2232e7d4704a99047acc34b39adb0a6fb9cec53558
Instruction Fuzzy Hash: DCF09A35510716ABAB115AA59C48F6ABAF8EB0A2A43418564FD14E7208DBB0C801CAF0

Function 6D066868 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000,?,?,6D05F20E,6D21821C,0000002C), ref: 6D0668A1

Part of subcall function 6D04AA44: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D04AA6A
Part of subcall function 6D04AA44: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6D04AA7A
Part of subcall function 6D04AA44: EncodePointer.KERNEL32(00000000), ref: 6D04AA83

GetProcAddress.KERNEL32(00000000,DwmIsCompositionEnabled), ref: 6D06688A
EncodePointer.KERNEL32(00000000,?,?,6D05F20E,6D21821C,0000002C), ref: 6D066893

Strings

DwmIsCompositionEnabled, xrefs: 6D066884
dwmapi.dll, xrefs: 6D066875

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmIsCompositionEnabled$dwmapi.dll
API String ID: 1102202064-1198327662
Opcode ID: dac888ef57baecd633191aedc9f45006f72447d425926fd42c96e0ceeef85c1d
Instruction ID: 3b19a8bf19967f623159a3aa23c2359400a210147faca4b386a2fb7df604e272
Opcode Fuzzy Hash: dac888ef57baecd633191aedc9f45006f72447d425926fd42c96e0ceeef85c1d
Instruction Fuzzy Hash: D8F05E35514256AFEF01ABB4EC48B6A7BF8EB0A3657418665FD01D7205EB70C8008AE0

Function 6D06698E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000), ref: 6D0669C7

Part of subcall function 6D04AA44: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 6D04AA6A
Part of subcall function 6D04AA44: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 6D04AA7A
Part of subcall function 6D04AA44: EncodePointer.KERNEL32(00000000), ref: 6D04AA83

GetProcAddress.KERNEL32(00000000,DwmInvalidateIconicBitmaps), ref: 6D0669B0
EncodePointer.KERNEL32(00000000), ref: 6D0669B9

Strings

dwmapi.dll, xrefs: 6D06699B
DwmInvalidateIconicBitmaps, xrefs: 6D0669AA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$DecodeHandleModule
String ID: DwmInvalidateIconicBitmaps$dwmapi.dll
API String ID: 1102202064-1901905683
Opcode ID: 240274ef2b7c8b891b507f38a0cc1411331f12157f5bc348ea6519d690f7443c
Instruction ID: 7f33ea8a63e7968b3c9990bebe51e1d162968a970491c03b2e84d074a3546305
Opcode Fuzzy Hash: 240274ef2b7c8b891b507f38a0cc1411331f12157f5bc348ea6519d690f7443c
Instruction Fuzzy Hash: A6F08C75501656A7AB019A74AC4DB2A7BFCAF0A3A83818161FE11E7208DBB4CC00CAF0

Function 6D075607 Relevance: 7.9, APIs: 5, Instructions: 357COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6D075629
SetRectEmpty.USER32(?), ref: 6D0756B4
SetRectEmpty.USER32(?), ref: 6D0758D4
GetClientRect.USER32(?,?), ref: 6D075931
GetClientRect.USER32(?,?), ref: 6D075947

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Empty$Client
String ID:
API String ID: 1457177775-0
Opcode ID: 971f62789cf81941596bc88b61a42c0912357409ec966e86e66334e8ab69a2df
Instruction ID: 4a041d82d3b639f370154a0903078e8ce99ae7aa74a07a8ac32dc9c8b10f94d2
Opcode Fuzzy Hash: 971f62789cf81941596bc88b61a42c0912357409ec966e86e66334e8ab69a2df
Instruction Fuzzy Hash: 77D13675D0060ACBEB15CFA8C5886EEB7F2FF49310F258169E815BB240D771A942CBA4

Function 6D07AE37 Relevance: 7.7, APIs: 5, Instructions: 227COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D07AE3E
IsWindow.USER32(00000000), ref: 6D07AE52
GetClientRect.USER32(00000000,00000000), ref: 6D07AEA7
GetCursorPos.USER32(?), ref: 6D07B070
ScreenToClient.USER32(00000000,?), ref: 6D07B07D

Part of subcall function 6D0759D1: __EH_prolog3_GS.LIBCMT ref: 6D0759DB
Part of subcall function 6D0759D1: GetClientRect.USER32(00000000,00000000), ref: 6D075A35

Part of subcall function 6D07380B: __EH_prolog3_GS.LIBCMT ref: 6D073815
Part of subcall function 6D07380B: SendMessageW.USER32(00000000,0000040D,00000000,00000000), ref: 6D073840

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClientH_prolog3_$Rect$CursorMessageScreenSendWindow
String ID:
API String ID: 3214297127-0
Opcode ID: 9d130637c79a7ba951d9a25b35be2e9ee1b5b20c331e36eed1c1ca8015729266
Instruction ID: 4a0c0ee956e6056e121e771dbccd717b765d86bda759d0bf36efd666336c1d9e
Opcode Fuzzy Hash: 9d130637c79a7ba951d9a25b35be2e9ee1b5b20c331e36eed1c1ca8015729266
Instruction Fuzzy Hash: 0C917771A00219DFEF15CFA4C884BEDBBB5FF48314F15806AE919AB251DB30A945CF64

Function 6D051631 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6D051638
GlobalLock.KERNEL32(00000000), ref: 6D05173A
DestroyWindow.USER32(00000000,?,00000000,00000000,6D0521FF,00000000), ref: 6D051823
GlobalUnlock.KERNEL32(00000000), ref: 6D051830
GlobalFree.KERNEL32(00000000), ref: 6D051837

Part of subcall function 6D06CD94: GetStockObject.GDI32(00000011), ref: 6D06CDB6
Part of subcall function 6D06CD94: GetStockObject.GDI32(0000000D), ref: 6D06CDC2
Part of subcall function 6D06CD94: GetObjectW.GDI32(00000000,0000005C,?), ref: 6D06CDD3
Part of subcall function 6D06CD94: GetDC.USER32(00000000), ref: 6D06CDE2
Part of subcall function 6D06CD94: GetDeviceCaps.GDI32(00000000,0000005A), ref: 6D06CDF9
Part of subcall function 6D06CD94: MulDiv.KERNEL32(?,00000048,00000000), ref: 6D06CE05
Part of subcall function 6D06CD94: ReleaseDC.USER32(00000000,00000000), ref: 6D06CE11

Part of subcall function 6D06CEA6: GlobalFree.KERNEL32(?), ref: 6D06CEAD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Global$Object$FreeStock$CapsDestroyDeviceH_prolog3_catchLockReleaseUnlockWindow
String ID:
API String ID: 15253214-0
Opcode ID: 0bd5955cd68feaff07852d0a7ef54cd3b596a7b30ba6112ae79ac19dea97ab87
Instruction ID: a4eb03d2a361890fb7a11b84a63395e00a76b33aed638047a838a2b21fde07cb
Opcode Fuzzy Hash: 0bd5955cd68feaff07852d0a7ef54cd3b596a7b30ba6112ae79ac19dea97ab87
Instruction Fuzzy Hash: E9514E35E0421ADFEF01DFA4CA84BAEBBB4BF09314F154059EA11B7290DB749E11CBA1

Function 6D07DE07 Relevance: 7.6, APIs: 5, Instructions: 120COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D07DE2F

Part of subcall function 6D044051: ClientToScreen.USER32(?,6D07DE40), ref: 6D044060
Part of subcall function 6D044051: ClientToScreen.USER32(?,6D07DE48), ref: 6D04406D

PtInRect.USER32(?,00000000,?), ref: 6D07DE49
PtInRect.USER32(?,?,?), ref: 6D07DEC2

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClientRect$Screen
String ID:
API String ID: 3187875807-0
Opcode ID: 9c5f94e43b5b0028a17f94623a0a1c893eb7bb9b7120e1d690f13655cc9310ad
Instruction ID: 06b001b6f1e366cf2ca1315965cdcaaa2b3072dc0a1f6d39c8ef7dd1e44a6f21
Opcode Fuzzy Hash: 9c5f94e43b5b0028a17f94623a0a1c893eb7bb9b7120e1d690f13655cc9310ad
Instruction Fuzzy Hash: 76414B7191410AEFDF12DFA8DA84BAEBBF5FF49344F104429E905EB200D775AA40CB64

Function 6D06139F Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0613A6

Part of subcall function 6D043F78: __EH_prolog3.LIBCMT ref: 6D043F7F
Part of subcall function 6D043F78: GetWindowDC.USER32(00000000,00000004,6D05E51A,00000000,?,?,?,6D218020,00000000), ref: 6D043FAB

Part of subcall function 6D04376D: SetMapMode.GDI32(?,?), ref: 6D043781
Part of subcall function 6D04376D: SetMapMode.GDI32(?,?), ref: 6D043793

LPtoDP.GDI32(?,?,00000001), ref: 6D06140A
LPtoDP.GDI32(?,?,00000001), ref: 6D061429
LPtoDP.GDI32(?,?,00000001), ref: 6D061448
InvalidateRect.USER32(?,00000000,00000001), ref: 6D06150C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3Mode$InvalidateRectWindow
String ID:
API String ID: 1124340077-0
Opcode ID: d3cb4e8bd8b410dbee5de36b96a8f8b371fd3ce1daad96adaa6c3d658fb7fdf3
Instruction ID: 8d29dbfa5cd6bc7889bf4e74021be37ccafabc8a5bb1455ce312075760bc00dc
Opcode Fuzzy Hash: d3cb4e8bd8b410dbee5de36b96a8f8b371fd3ce1daad96adaa6c3d658fb7fdf3
Instruction Fuzzy Hash: 5341D474644706DFEB24CF79D581B9AB7F1BF4A314F10882DE5AADB290E770A840CB21

Function 6D0777CB Relevance: 7.6, APIs: 5, Instructions: 113COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(?,00007904), ref: 6D077803
LoadCursorW.USER32(?,00007905), ref: 6D077836
LoadCursorW.USER32(00000000,00007F86), ref: 6D077861
CreatePen.GDI32(00000000,00000001,?), ref: 6D0778D9

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CursorLoad$Create
String ID:
API String ID: 1516763891-0
Opcode ID: 349f2d21f7685142d5913bd56b49ac04eb7eee32dc3ce22dd834de4b1d7bca1e
Instruction ID: 6f9abec7f1f344aa5a01f931d1688e0020980cf38f274560df8b7b3b40cc981d
Opcode Fuzzy Hash: 349f2d21f7685142d5913bd56b49ac04eb7eee32dc3ce22dd834de4b1d7bca1e
Instruction Fuzzy Hash: D231D57094C202AAFB21AB76DC88FBD32E9EF84358F168075EA199F151DF709400C675

Function 6D046E47 Relevance: 7.6, APIs: 5, Instructions: 108keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 6D046E5C
GetKeyState.USER32(00000011), ref: 6D046E64
ScreenToClient.USER32(?,00000000), ref: 6D046EFC
ClientToScreen.USER32(?,00000000), ref: 6D046F49
SetCursorPos.USER32(00000000,00000000), ref: 6D046F55

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClientCursorScreen$State
String ID:
API String ID: 3982492586-0
Opcode ID: 582a73d84347cf38cc6d64daf9ff5d17c74e47c4cfa7b8494f25327a47c170b8
Instruction ID: ba31fddcd00358d025f375822a03daf028dc8d1c194a88cef36bd6bffbf8fc61
Opcode Fuzzy Hash: 582a73d84347cf38cc6d64daf9ff5d17c74e47c4cfa7b8494f25327a47c170b8
Instruction Fuzzy Hash: 3D318372610506EBDB09CBA9D494FEDBAF5FF46311F90C23AE512D7190E7719A508B80

Function 6D078CD3 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 6D078CFA
ScreenToClient.USER32(?,?), ref: 6D078D28
ScreenToClient.USER32(?,?), ref: 6D078D96
PtInRect.USER32(?,?,?), ref: 6D078DBE
SetCursor.USER32(?), ref: 6D078DF2

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClientCursorScreen$Rect
String ID:
API String ID: 1082406499-0
Opcode ID: 3afbc5a71b7787bc6e2942c718daff5abcdee382a91e5082307d4f31d988b615
Instruction ID: 7425504216b43eb3b58bbda14920dd9f6ee6e0c19b97d90d79f798d1fb857e66
Opcode Fuzzy Hash: 3afbc5a71b7787bc6e2942c718daff5abcdee382a91e5082307d4f31d988b615
Instruction Fuzzy Hash: A3316D31E0420AEFDF15DFA4C884BBEB7B5FF49308F01422AEA15A7240DB70A951CB60

Function 6D04276F Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 6D0421E1: GetParent.USER32(?), ref: 6D0421E4
Part of subcall function 6D0421E1: GetParent.USER32(00000000), ref: 6D0421EB

GetWindowLongW.USER32(?,000000EC), ref: 6D0427CF
RedrawWindow.USER32(?,00000000,00000000,00000081), ref: 6D042823
SetWindowLongW.USER32(?,000000EC,00000000), ref: 6D042832
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000137), ref: 6D042848
GetClientRect.USER32(?,?), ref: 6D04285C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$LongParent$ClientRectRedraw
String ID:
API String ID: 556606033-0
Opcode ID: 6d29678c5c78fde31cef567651a0bd6a6ed0476083b0b4695e09cf959da55692
Instruction ID: 241783d0f13b66d617a7cdac76d21f7f5c09a087324c2b31517afd3447c4d334
Opcode Fuzzy Hash: 6d29678c5c78fde31cef567651a0bd6a6ed0476083b0b4695e09cf959da55692
Instruction Fuzzy Hash: 6C21D132714216EBFB125A759C84FBE7AF9FF09394F018138E911D3290CBA09D109790

Function 6D04246D Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

Part of subcall function 6D0421E1: GetParent.USER32(?), ref: 6D0421E4
Part of subcall function 6D0421E1: GetParent.USER32(00000000), ref: 6D0421EB

SendMessageW.USER32(?,00000234,00000000,00000000), ref: 6D0424E1
SendMessageW.USER32(?,00000229,00000000,00000000), ref: 6D04250A
SendMessageW.USER32(?,00000229,00000000,00000000), ref: 6D042529
SendMessageW.USER32(?,00000222,?,00000000), ref: 6D042543
SendMessageW.USER32(?,00000222,00000000,?), ref: 6D04256C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$Parent$LongWindow
String ID:
API String ID: 4191550487-0
Opcode ID: 64e52dba0b00ce810b8b15d6f270aa5dc51f446b7355122aac7c94c1251f1b02
Instruction ID: df8c6203bb1c06afb8a3558f2b9cd6d8be24c0e3a1a65edd0c164420a2de963b
Opcode Fuzzy Hash: 64e52dba0b00ce810b8b15d6f270aa5dc51f446b7355122aac7c94c1251f1b02
Instruction Fuzzy Hash: 9521E571740604FFFB219B74EC94FAE7ABAFB89358F008124E656D3190CBB0AD508660

Function 6D07CE59 Relevance: 7.6, APIs: 5, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 6D07CEA2
GetClientRect.USER32(?,?), ref: 6D07CECE
PtInRect.USER32(?,?,?), ref: 6D07CEE6
MapWindowPoints.USER32(?,?,?,00000001), ref: 6D07CF0F
SendMessageW.USER32(?,00000200,?,?), ref: 6D07CF2E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$ClientCursorMessagePointsSendWindow
String ID:
API String ID: 1257894355-0
Opcode ID: 208bffaef3d2feee02c736013a865585fad96a197c9d3af4174a95e044fba798
Instruction ID: 9496e6be8eefd6f330db00c15eede0275bea86a19f123b76083e36f0d22f0308
Opcode Fuzzy Hash: 208bffaef3d2feee02c736013a865585fad96a197c9d3af4174a95e044fba798
Instruction Fuzzy Hash: 3C31B37190420AEFEF258F68DC94ABEBBF6FF04350F10412EF92596150D731A960DB58

Function 6D07E770 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 6D07E7BC

Part of subcall function 6D05BBEC: GetWindowLongW.USER32(?,000000EC), ref: 6D05BBF9

OffsetRect.USER32(?,?,00000000), ref: 6D07E818
UnionRect.USER32(?,?,?), ref: 6D07E831
EqualRect.USER32(?,?), ref: 6D07E83F
UpdateWindow.USER32(?), ref: 6D07E876

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Window$EqualLongOffsetUnionUpdate
String ID:
API String ID: 4261707372-0
Opcode ID: 312e24e75d7bf645057a24fe7695db8ff889a217660bf95ee59a2c9dec3d3506
Instruction ID: 50e1a3fa3b80fadcfa349601ab8e8fae65e2f97b2e61f1041bd0470879d876c8
Opcode Fuzzy Hash: 312e24e75d7bf645057a24fe7695db8ff889a217660bf95ee59a2c9dec3d3506
Instruction Fuzzy Hash: 64316171A0160AEBDB04DFA5D944BEEF7F9FF09314F104226E529E7290DB70A990CB94

Function 6D078E0C Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D07684C: __EH_prolog3_GS.LIBCMT ref: 6D076853
Part of subcall function 6D07684C: GetWindowRect.USER32(00000000,00000000), ref: 6D07689C
Part of subcall function 6D07684C: CreateRoundRectRgn.GDI32(00000000,00000000,00000001,?,00000004,00000004), ref: 6D0768C6
Part of subcall function 6D07684C: SetWindowRgn.USER32(00000000,?,00000000), ref: 6D0768DC

GetSystemMenu.USER32(?,00000000), ref: 6D078E96
DeleteMenu.USER32(?,0000F120,00000000,00000000), ref: 6D078EB3
DeleteMenu.USER32(?,0000F020,00000000), ref: 6D078EC2
DeleteMenu.USER32(?,0000F030,00000000), ref: 6D078ED1
EnableMenuItem.USER32(?,0000F060,00000001), ref: 6D078EF9

Part of subcall function 6D077630: SetRectEmpty.USER32(?), ref: 6D07765B
Part of subcall function 6D077630: ReleaseCapture.USER32 ref: 6D077661
Part of subcall function 6D077630: SetCapture.USER32(?,?,?,?,6D06F5D2,?), ref: 6D077674
Part of subcall function 6D077630: RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 6D077774

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$DeleteRectWindow$Capture$CreateEmptyEnableH_prolog3_ItemRedrawReleaseRoundSystem
String ID:
API String ID: 4022425685-0
Opcode ID: d1c4ff23478edf2a89c47c6eca1fdbb9474109d8a64910ddf29b997918b86922
Instruction ID: a287de8f69e0812b6dc7e517aeecd70987f0655520ff5fa365ac8018250875f5
Opcode Fuzzy Hash: d1c4ff23478edf2a89c47c6eca1fdbb9474109d8a64910ddf29b997918b86922
Instruction Fuzzy Hash: 1321AE35200217EBEF255B60CC89BBE7FBAFF89354B044065FA195B291DF719810DBA4

Function 6D04BC64 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D04BC6E
GetTopWindow.USER32(?), ref: 6D04BC9B
GetDlgCtrlID.USER32(00000000), ref: 6D04BCAD
SendMessageW.USER32(?,00000087,00000000,00000000), ref: 6D04BD08
GetWindow.USER32(00000000,00000002), ref: 6D04BD4A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$CtrlH_prolog3MessageSend
String ID:
API String ID: 849854284-0
Opcode ID: 2a0398bc56fa9cc840d3cf49020461c0d0847dbd90b44333ef8effe15d22cc40
Instruction ID: d1c7c3df8353070747c0f21fd1f7b6bfcdcaa1c18a24802bc48dcbf825a34551
Opcode Fuzzy Hash: 2a0398bc56fa9cc840d3cf49020461c0d0847dbd90b44333ef8effe15d22cc40
Instruction Fuzzy Hash: A921D375805219EAFF118F60DE84FBE76FAEF41304F1141A9EE15A3145EB309A00CB52

Function 6D048F96 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 6D048FE5
SendMessageW.USER32(?,00000455,00000000,00000000), ref: 6D048FF9
SendMessageW.USER32(?,00000454,00000000,00000000), ref: 6D04900C
SetWindowLongW.USER32(?,000000F0,?), ref: 6D049043
SendMessageW.USER32(?,00000454,00000000,00000000), ref: 6D049058

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSendWindow$Long
String ID:
API String ID: 3430364388-0
Opcode ID: 8ef94e97d55e7118fcf391d31c6395d8aaf13fdb7bbd731b1bbc1d463fc85025
Instruction ID: 4e6a09197a9b1bae9e18d6e34b80e2816d460526f81130c327ccbbca637f8ecc
Opcode Fuzzy Hash: 8ef94e97d55e7118fcf391d31c6395d8aaf13fdb7bbd731b1bbc1d463fc85025
Instruction Fuzzy Hash: EA21B071200601EFEB108F69ED85F2E7AFAFB44714F10813DB655972A0DBB19C00DB50

Function 6D06F55F Relevance: 7.6, APIs: 5, Instructions: 74threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6D06F571
SetWindowsHookExW.USER32(00000007,6D0764D4,00000000,00000000), ref: 6D06F581
UnhookWindowsHookEx.USER32(00000000), ref: 6D06F599
UpdateWindow.USER32(?), ref: 6D06F611
SendMessageW.USER32(?,00000362,0000E001,00000000), ref: 6D06F62D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: HookWindows$CurrentMessageSendThreadUnhookUpdateWindow
String ID:
API String ID: 1891640330-0
Opcode ID: 8eaa71ee35b9d9a2f2b74ff373901c869bc7f2ab8c2c4fba7cbe120b2e9c2352
Instruction ID: fd9119c3a71bf983a6c2d6907b8b60610206fe8ee322d187abfbd0321f7657b4
Opcode Fuzzy Hash: 8eaa71ee35b9d9a2f2b74ff373901c869bc7f2ab8c2c4fba7cbe120b2e9c2352
Instruction Fuzzy Hash: 6F21C431745602BBEB145F28DC89B2ABFF9FF41725F014124E72597290DF709851CAA0

Function 6D0463AE Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6D0634A0: EnterCriticalSection.KERNEL32(6D2183D0,?,?,0000007C,?,6D04F858,00000001), ref: 6D0634D1
Part of subcall function 6D0634A0: InitializeCriticalSection.KERNEL32(00000000,?,6D04F858,00000001), ref: 6D0634E7
Part of subcall function 6D0634A0: LeaveCriticalSection.KERNEL32(6D2183D0,?,6D04F858,00000001), ref: 6D0634F5
Part of subcall function 6D0634A0: EnterCriticalSection.KERNEL32(00000000,?,0000007C,?,6D04F858,00000001), ref: 6D063502

SetCursor.USER32(00000009), ref: 6D0463F8
LoadCursorW.USER32(?,00007905), ref: 6D04643D
LoadCursorW.USER32(00000000,00007F85), ref: 6D046453
SetCursor.USER32(?,?,00000009), ref: 6D04646C
DestroyCursor.USER32(00000000), ref: 6D046477

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Cursor$CriticalSection$EnterLoad$DestroyInitializeLeave
String ID:
API String ID: 900973665-0
Opcode ID: 6552c1261d4c9ab3dadbb97997ad3ea2ca1f4e771c30db475d12abb118cf7475
Instruction ID: a1cc92c531a00641a259af8d22a905d12c4971b5cd22e8055f33660dd06ebc4b
Opcode Fuzzy Hash: 6552c1261d4c9ab3dadbb97997ad3ea2ca1f4e771c30db475d12abb118cf7475
Instruction Fuzzy Hash: 53119071908152DBFF218B64E8C8F9A76B9E783319B95C432E319C7150EB689441C6E1

Function 6D053F3C Relevance: 7.6, APIs: 5, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

SendMessageW.USER32(?,00000086,00000001,00000000), ref: 6D053F9B
SendMessageW.USER32(?,00000086,00000000,00000000), ref: 6D053FB4
GetDesktopWindow.USER32 ref: 6D053FBC
SendMessageW.USER32(00000000,0000036D,0000000C,00000000), ref: 6D053FDC
GetWindow.USER32(00000000), ref: 6D053FE5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSendWindow$DesktopLong
String ID:
API String ID: 2272707703-0
Opcode ID: d800cf593e752ccf55ca7d79aa0cf3c7b914b28d8eb832b577b00be6c5d3fb63
Instruction ID: 1652a2a37e5088aa27210ded193a634423aa6398666115f3cb8c2376932520bd
Opcode Fuzzy Hash: d800cf593e752ccf55ca7d79aa0cf3c7b914b28d8eb832b577b00be6c5d3fb63
Instruction Fuzzy Hash: 74110836244A077BFB120626DD54F7E7ABAAF49394F014114FE2946190DFA1CC20D7A0

Function 6D048DD1 Relevance: 7.6, APIs: 5, Instructions: 66windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 6D048E20
SendMessageW.USER32(?,00000455,00000000,00000000), ref: 6D048E34
SendMessageW.USER32(?,00000454,00000000,00000000), ref: 6D048E47
SetWindowLongW.USER32(?,000000F0,?), ref: 6D048E66
SendMessageW.USER32(?,00000454,00000000,00000000), ref: 6D048E7C

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSendWindow$Long
String ID:
API String ID: 3430364388-0
Opcode ID: 8b3e42e5e68cfe447590425720484db8f088892ab66e89c3c433bbcc1f56dda9
Instruction ID: 6a2bbf703775ddf7cfc45e2f1e59ab541fdd86b2ef4680ef5e31cf3b2fcdcc29
Opcode Fuzzy Hash: 8b3e42e5e68cfe447590425720484db8f088892ab66e89c3c433bbcc1f56dda9
Instruction Fuzzy Hash: 5B11D371200600FBFB105B66DC09F1BBAFAFBC1B54F108629B611A3290DBB09840DBA0

Function 6D05AA63 Relevance: 7.6, APIs: 5, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(00000000,?), ref: 6D05AA87
RegDeleteValueW.ADVAPI32(00000000,?,?,00000000), ref: 6D05AAA7
RegCloseKey.ADVAPI32(00000000), ref: 6D05AAD8

Part of subcall function 6D05AE2D: RegCloseKey.ADVAPI32(00000000,?,00000000), ref: 6D05AED2
Part of subcall function 6D05AE2D: RegCloseKey.ADVAPI32(00000000,?,00000000), ref: 6D05AEE1

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000001,?,00000000,?,00000000), ref: 6D05AACF
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 6D05AAF3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Close$DeleteValue$PrivateProfileStringWrite
String ID:
API String ID: 222425065-0
Opcode ID: 053902b865a3f127eddfb4202e644070b0b8cd716e1a70469bae1ee6297df0f0
Instruction ID: 98727690ef1ab304154bb6701ce61ab52e7105c297544274499eacad56716627
Opcode Fuzzy Hash: 053902b865a3f127eddfb4202e644070b0b8cd716e1a70469bae1ee6297df0f0
Instruction Fuzzy Hash: 3F11A336414516BBEB135E64AE44FDF7BBDAF857A0B214024FD119A100DB72E861D7B0

Function 6D07C078 Relevance: 7.6, APIs: 5, Instructions: 65windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32(?,00004212,00000001), ref: 6D07C0AA
EnableMenuItem.USER32(?,00004213,00000000), ref: 6D07C0BB
EnableMenuItem.USER32(?,00004214,00000000), ref: 6D07C0EA
CheckMenuItem.USER32(?,00004213,00000008), ref: 6D07C110
CheckMenuItem.USER32(?,00004214,00000000), ref: 6D07C11C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ItemMenu$Enable$Check
String ID:
API String ID: 1852492618-0
Opcode ID: 8271a9ac160c1430b13e514facc12dd21188735a3fa16b2ac289c4f8a06fbcad
Instruction ID: 3c49ebf513394537ed5df338e5d4557932ab8d195427e69a58f23da0b5a2ecd5
Opcode Fuzzy Hash: 8271a9ac160c1430b13e514facc12dd21188735a3fa16b2ac289c4f8a06fbcad
Instruction Fuzzy Hash: C7119372284605BFFB209A24DD85B56B7FDFB05758B40C424F615DA860D770AC10DAA8

Function 6D056092 Relevance: 7.6, APIs: 5, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GlobalGetAtomNameW.KERNEL32(?,?,00000103), ref: 6D056107
GlobalAddAtomW.KERNEL32(?), ref: 6D056114
GlobalGetAtomNameW.KERNEL32(?,?,00000103), ref: 6D05612E
GlobalAddAtomW.KERNEL32(?), ref: 6D05613B
SendMessageW.USER32(00000000,000003E4,00000000,?), ref: 6D056160

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AtomGlobal$Name$MessageSend
String ID:
API String ID: 1515195355-0
Opcode ID: d8fd28ae2233b4e8d90e4d18ad3b4d27039df23ef2a9116de672b45ea8c5f481
Instruction ID: 946376641bc01a11a1cc92933670644ea7423d3a09c245b7ce67241e0e7abab6
Opcode Fuzzy Hash: d8fd28ae2233b4e8d90e4d18ad3b4d27039df23ef2a9116de672b45ea8c5f481
Instruction Fuzzy Hash: 1E21CD75600309ABEB109F64DA48BBA73F8FB05704F40451ABD6983082E7B4EA94CBD5

Function 6D0655E4 Relevance: 7.6, APIs: 5, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,00000000), ref: 6D065641
LocalReAlloc.KERNEL32(00000000,00000000,00000002), ref: 6D06564F
TlsSetValue.KERNEL32 ref: 6D065680
LeaveCriticalSection.KERNEL32(6D04201F,?,00000000,?,6D04F4BB,?,?,?,6D04AD90,00000000,?,?,?,6D052D13,00000004,6D04201F), ref: 6D06569E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AllocLocal$CriticalLeaveSectionValue
String ID:
API String ID: 901235349-0
Opcode ID: 17fed26fc8593d21a04d3fb7c3905506c8df8706bb30cf4994d69507fc30428c
Instruction ID: e9c7fc5451a1b2454d9d8d0b3c76145a3c69ac87bfb29392a5473e43ac1388b1
Opcode Fuzzy Hash: 17fed26fc8593d21a04d3fb7c3905506c8df8706bb30cf4994d69507fc30428c
Instruction Fuzzy Hash: 26116A381046029FEB258F15E888F2A7BF6FF81315B10C42DFA5A9B165DB70E950DF60

Function 6D07684C Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D076853
GetWindowRect.USER32(00000000,00000000), ref: 6D07689C
CreateRoundRectRgn.GDI32(00000000,00000000,00000001,?,00000004,00000004), ref: 6D0768C6
SetWindowRgn.USER32(00000000,?,00000000), ref: 6D0768DC
SetWindowRgn.USER32(00000000,00000000,00000000), ref: 6D0768F4

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Rect$CreateH_prolog3_Round
String ID:
API String ID: 2502471913-0
Opcode ID: 93ae43dfb9fe30b43a09e0e7ec4d353c51e48b510a756741ddf83b610e3685a1
Instruction ID: 9a4c2b78bc73ea8d4b9412847e02f6b1e7fda2b54f9dec23a6760cf455ef24a6
Opcode Fuzzy Hash: 93ae43dfb9fe30b43a09e0e7ec4d353c51e48b510a756741ddf83b610e3685a1
Instruction Fuzzy Hash: F0116A7190060AEFEF45DFA0C884BEDBBB9FF08358F541229E602B7650DB749950CBA4

Function 6D047969 Relevance: 7.6, APIs: 5, Instructions: 56windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 6D047972
SendMessageW.USER32(?,00000420,00000000,0000E800), ref: 6D047996
SendMessageW.USER32(?,0000041F,00000000,0000E800), ref: 6D0479B3
SendMessageW.USER32(?,0000043A,00000000,00000000), ref: 6D0479CF
InvalidateRect.USER32(?,00000000,00000001,?,6D047956,?,?,?,?,ToolbarWindow32,00000000,?,?,?,0000E800,00000000), ref: 6D0479ED

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$InvalidateRectWindow
String ID:
API String ID: 3225880595-0
Opcode ID: 05e6fc2f6abe90733896ef26957e41c4cc208af8e0a1a1ad650d345b14091322
Instruction ID: e718bfe388203b4a49937a86ba8da2b38e084e33a577a3014e5f2b5f86218528
Opcode Fuzzy Hash: 05e6fc2f6abe90733896ef26957e41c4cc208af8e0a1a1ad650d345b14091322
Instruction Fuzzy Hash: E5115170140744ABEB108F25E848FBB7BF6FB85701F00892EF99A96250EBB09850DB60

Function 6D0544F1 Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,00000367,00000367,00000003), ref: 6D054516
PostMessageW.USER32(?,00000367,00000000,00000000), ref: 6D054526
GetCapture.USER32 ref: 6D05452C
ReleaseCapture.USER32 ref: 6D054538
PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 6D05455F

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Message$CapturePost$PeekRelease
String ID:
API String ID: 1125932295-0
Opcode ID: 4bc0b36231e423f0e8bb68da991bc6a8140db5e6186d5535366bf2393dc7c598
Instruction ID: 68253c47a4b303be54bf05cedc394bd375af2315aaee0ba6078e40fcbefe6398
Opcode Fuzzy Hash: 4bc0b36231e423f0e8bb68da991bc6a8140db5e6186d5535366bf2393dc7c598
Instruction Fuzzy Hash: 10018B31500604BBFB116B35ED89FAB7AFEFBC9744F000429F94B82052EBA0D821DA20

Function 6D044BAF Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 6D044BBA

Part of subcall function 6D0609D1: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 6D060A18
Part of subcall function 6D0609D1: CreatePatternBrush.GDI32(00000000), ref: 6D060A25
Part of subcall function 6D0609D1: DeleteObject.GDI32(00000000), ref: 6D060A31

SelectObject.GDI32(?,?), ref: 6D044BD9
PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 6D044BFE
SelectObject.GDI32(?,00000000), ref: 6D044C0C
ReleaseDC.USER32(?,?), ref: 6D044C18

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$BitmapBrushDeletePatternRelease
String ID:
API String ID: 2474928807-0
Opcode ID: d9bb7bc3c93fc4ca1979e0cb28b8958e802c7232d44910ef6b89506ada644ff4
Instruction ID: ecbd30feb1565f23f0c1585ac7f1a0739fd1e79a256bdd19aedcb5b8de8ef094
Opcode Fuzzy Hash: d9bb7bc3c93fc4ca1979e0cb28b8958e802c7232d44910ef6b89506ada644ff4
Instruction Fuzzy Hash: 76011E36140100AFDB015FA9ED88E56BFBAEF897553158069F61986122CBB3D811EB50

Function 6D05C6CA Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D05C6D1
std::_Lockit::_Lockit.LIBCPMT ref: 6D05C6DC
std::_Lockit::~_Lockit.LIBCPMT ref: 6D05C74A

Part of subcall function 6D05C5D3: std::locale::_Locimp::_Locimp.LIBCPMT ref: 6D05C5EB

std::locale::_Setgloballocale.LIBCPMT ref: 6D05C6F7
_Yarn.LIBCPMT ref: 6D05C70D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 2f39b384fa13c6d8d56cb4e830841fdcf48daeda2086cb3c087e27ab9cb99cfe
Instruction ID: 50b81517519b6c86f847fcbfc3c047c835bf6276afdf2657751b31cbf5bb2ebd
Opcode Fuzzy Hash: 2f39b384fa13c6d8d56cb4e830841fdcf48daeda2086cb3c087e27ab9cb99cfe
Instruction Fuzzy Hash: 9701D479A0411A9BEB05DF60C944B7D7BB1BF85248B054009DE2167380CF74AE11CBC5

Function 6D01E540 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 6D01E6A2
_strcspn.LIBCMT ref: 6D01E6C9

Strings

@, xrefs: 6D01EA0C
., xrefs: 6D01E6AA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: _strcspn
String ID: .$@
API String ID: 3709121408-1252397774
Opcode ID: 61c09ec3c7e8c245331b57de2267050e645c6c86650447cb4b987c283dde05bb
Instruction ID: cffa4fe23314df3dab95ceaf0756cd2ade793465a270f8b1f287c4166f2ff055
Opcode Fuzzy Hash: 61c09ec3c7e8c245331b57de2267050e645c6c86650447cb4b987c283dde05bb
Instruction Fuzzy Hash: 1E322774908668CFDB15CFA8C890BDDBBB1BF4A300F0581DAD859AB351DB749A84CF91

Function 6D07380B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D073815
SendMessageW.USER32(00000000,0000040D,00000000,00000000), ref: 6D073840
SendMessageW.USER32(?,0000043A,-00000001,00000030), ref: 6D073888

Strings

0, xrefs: 6D07385C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$H_prolog3_
String ID: 0
API String ID: 3491702567-4108050209
Opcode ID: a14850f420e437169a0ac03aeda8d976727f5689ff8862069214e287875c52da
Instruction ID: e6fe2ba1709c8c6da77e7c7135c35dae16c36035a1c03c055de812aa4eb8eecc
Opcode Fuzzy Hash: a14850f420e437169a0ac03aeda8d976727f5689ff8862069214e287875c52da
Instruction Fuzzy Hash: BB316075A0021AAFEB24CB64CC94FA9B779FF49304F0002A5E66D67290DBB06D94CF51

Function 6D070CE2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D070CE9

Part of subcall function 6D0BE360: __EH_prolog3.LIBCMT ref: 6D0BE367

Part of subcall function 6D05BCD3: GetDlgCtrlID.USER32(?), ref: 6D05BCDE

Strings

%TsMFCToolBar-%d%x, xrefs: 6D070D4A
%TsMFCToolBar-%d, xrefs: 6D070D33
MFCToolBars, xrefs: 6D070CF6

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3$Ctrl
String ID: %TsMFCToolBar-%d$%TsMFCToolBar-%d%x$MFCToolBars
API String ID: 3879667756-2016111687
Opcode ID: 75c8b143e4d137083cafc06abdce18b4f33b57e3740948cfde4673f1f5745507
Instruction ID: 1b438c6111746ba0b0606df856f1faf78a15369ce0dfa0c62f40d5eee09225c9
Opcode Fuzzy Hash: 75c8b143e4d137083cafc06abdce18b4f33b57e3740948cfde4673f1f5745507
Instruction Fuzzy Hash: 9721F375D0421A9BEF00DFA4CC94BBEB774BF44308F064528EA217B281DB71AE01CB60

Function 6D07CF57 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D07CF5E
GetCursorPos.USER32(?), ref: 6D07D030

Strings

Control Panel\Desktop, xrefs: 6D07CFA8
MenuShowDelay, xrefs: 6D07CFD7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CursorH_prolog3
String ID: Control Panel\Desktop$MenuShowDelay
API String ID: 634316419-702829638
Opcode ID: 974b95e0afade6c1cc2d3123449882644a4b258291c02251f83c1eb520025557
Instruction ID: f87c92f6439a18f0499fe89d64ace38230b6b826a845a65ea2a51a2f6cf904f7
Opcode Fuzzy Hash: 974b95e0afade6c1cc2d3123449882644a4b258291c02251f83c1eb520025557
Instruction Fuzzy Hash: FC215E70A0420ADBEF04CB64CD58BBE7BB5BF89358F150529DA21DB280EF719D02CB94

Function 6D04A392 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,6D1F8208,00000000,00000001,00000000), ref: 6D04A3DC
RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000004), ref: 6D04A3FD
RegCloseKey.ADVAPI32(00000000), ref: 6D04A441

Strings

P!m, xrefs: 6D04A3B4

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: P!m
API String ID: 3677997916-1510269751
Opcode ID: 463551cfd25ab0cc9ef181c095462b9192cfa3a2a9f71b0a2502c723f2cfddf0
Instruction ID: e6c0d090f61450c8cff337c239ec744c24722cf6979ac16869de61dedd1dcec8
Opcode Fuzzy Hash: 463551cfd25ab0cc9ef181c095462b9192cfa3a2a9f71b0a2502c723f2cfddf0
Instruction Fuzzy Hash: DA211DB2A14209EFFB04CF95DC89FAEB7F4FB5171AF20C468E515A6081E7B4A6448B50

Function 6D070DC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D070DC7

Part of subcall function 6D0BE360: __EH_prolog3.LIBCMT ref: 6D0BE367

Strings

%TsMFCToolBarParameters, xrefs: 6D070DFA
LargeIcons, xrefs: 6D070E3F
MFCToolBars, xrefs: 6D070DD2

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3
String ID: %TsMFCToolBarParameters$LargeIcons$MFCToolBars
API String ID: 431132790-953485693
Opcode ID: 793bce1773a1e01cd1db9219f6d0a52ba85e49273a146bd05883e88fa0a01636
Instruction ID: a355a097f0ee19c80f0c95e2aa0e422b4dfa68b52ac4a9cbb250746592d98c19
Opcode Fuzzy Hash: 793bce1773a1e01cd1db9219f6d0a52ba85e49273a146bd05883e88fa0a01636
Instruction Fuzzy Hash: F7218074A0421A9BDF00DFA4CCD4BBEBBB5BF48308F110428D611BB381DB75A905CB61

Function 6D0604F9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6D04A6BB: LoadLibraryW.KERNEL32(00000000,6D202418,00000010,6D060524,comctl32.dll,?), ref: 6D04A6FC

GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 6D060538
FreeLibrary.KERNEL32(00000000), ref: 6D060584

Part of subcall function 6D060137: GetLastError.KERNEL32(6D06052F,comctl32.dll,?,?,00001000,?,?,?), ref: 6D060137

Strings

comctl32.dll, xrefs: 6D060511
DllGetVersion, xrefs: 6D060532

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: DllGetVersion$comctl32.dll
API String ID: 2540614322-3857068685
Opcode ID: cf88495e2ee81037ab4c61e33a86749a359728dbfed4e774309861cc130cb596
Instruction ID: 74cd518dd27ac95f409f1a42c9f699f4d27940d5159f04e16ecdf111b2660adb
Opcode Fuzzy Hash: cf88495e2ee81037ab4c61e33a86749a359728dbfed4e774309861cc130cb596
Instruction Fuzzy Hash: 5A110A7594461A9BDB01DF69D884B9FBBF5FF85314F014029E90097340EB74D900CBB1

Function 6D05F13A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D05F141
LoadCursorW.USER32(00000000,00007F00), ref: 6D05F165
GetClassInfoW.USER32(?,?,?), ref: 6D05F1A0

Part of subcall function 6D04F814: __EH_prolog3_catch.LIBCMT ref: 6D04F81B
Part of subcall function 6D04F814: GetClassInfoW.USER32(?,?,?), ref: 6D04F82D

Strings

%Ts:%x:%x:%x:%x, xrefs: 6D05F18B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClassInfo$CursorH_prolog3H_prolog3_catchLoad
String ID: %Ts:%x:%x:%x:%x
API String ID: 937286869-4057404147
Opcode ID: 10b43e94e0273962269574680203b12a73af7442ff448eb32b0a8565e1f6eb62
Instruction ID: ce87fde8e5e6b7e2c032c06a0ffdf6cdda88b37cf693b69538e5111cf37d1982
Opcode Fuzzy Hash: 10b43e94e0273962269574680203b12a73af7442ff448eb32b0a8565e1f6eb62
Instruction Fuzzy Hash: 4D210DB5E04209AFEB40DFA9D984B9DBAF9FF48304F114029EA08E7240D7B45A548B65

Function 6D05A68A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?,?,?,80070057), ref: 6D05A69B
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 6D05A6AB

Strings

Advapi32.dll, xrefs: 6D05A696
RegCreateKeyTransactedW, xrefs: 6D05A6A5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1646373207-2994018265
Opcode ID: cf9c2654742b523466cf24f7e452a012385793bd6c5846312b63469036c368e4
Instruction ID: 5bac3f73232be1a356910d6798771fc6c66958256552fbb23d8ee9f11d840cba
Opcode Fuzzy Hash: cf9c2654742b523466cf24f7e452a012385793bd6c5846312b63469036c368e4
Instruction Fuzzy Hash: C2016D3220010AAFDF025F94ED08FAA7BF6FB89391F104429FA1491064DBB2D4B1EB60

Function 6D05B7DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 6D05B7EF
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 6D05B7FF

Strings

Advapi32.dll, xrefs: 6D05B7EA
RegDeleteKeyTransactedW, xrefs: 6D05B7F9

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyTransactedW
API String ID: 1646373207-2168864297
Opcode ID: ce096ace3370abf40eb818b086b634384478f99a70d35921058cfcb9a0d18caa
Instruction ID: 8124df6c11e0d1bf81f3137845036f67e5549672a0ac2f119faf4b05bf2dc973
Opcode Fuzzy Hash: ce096ace3370abf40eb818b086b634384478f99a70d35921058cfcb9a0d18caa
Instruction Fuzzy Hash: 89F0BB7320010AAFFF012E95ED84B3AB7EDFB85AA5310447EF55081100C7719C51D760

Function 6D060287 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000018,000000F0), ref: 6D0602A2
GetClassNameW.USER32(00000018,?,0000000A), ref: 6D0602B7
CompareStringW.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF), ref: 6D0602CE

Strings

combobox, xrefs: 6D0602BF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClassCompareLongNameStringWindow
String ID: combobox
API String ID: 1414938635-2240613097
Opcode ID: db3a61f31b1cbd5fa81a31ce5c1bd32d98b156d30b53af7b8d1fafdedf771f00
Instruction ID: b9c952ef76967e5e5d90896096ffd5fc8a0a7f55e6af639aaddd76f1bd23766d
Opcode Fuzzy Hash: db3a61f31b1cbd5fa81a31ce5c1bd32d98b156d30b53af7b8d1fafdedf771f00
Instruction Fuzzy Hash: C3F0A431698119ABDF00EF688D86FAE77F8EF06720F504315F921E60C0DB60A54187A5

Function 6D05A6FA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 6D05A70B
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 6D05A71B

Strings

Advapi32.dll, xrefs: 6D05A706
RegOpenKeyTransactedW, xrefs: 6D05A715

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1646373207-3913318428
Opcode ID: 0072cba0e68db69f78e4550925c230c0c471bfc96478813cc5cd06959bf314a9
Instruction ID: dd9dddf6a03e02888785c20469d780d5f4fc59f747cd3d59f9929085a94d397c
Opcode Fuzzy Hash: 0072cba0e68db69f78e4550925c230c0c471bfc96478813cc5cd06959bf314a9
Instruction Fuzzy Hash: 4CF0623264010FABDF125E54ED48FAA7BFAEB89365F104439FA1481150E7B19461EB60

Function 6D0B9D96 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?,?,6D0BA162,?,00000000,?,00000024), ref: 6D0B9DAD
GetProcAddress.KERNEL32(00000000,GetFileAttributesTransactedW), ref: 6D0B9DBD

Strings

GetFileAttributesTransactedW, xrefs: 6D0B9DB7
kernel32.dll, xrefs: 6D0B9DA8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetFileAttributesTransactedW$kernel32.dll
API String ID: 1646373207-1378992308
Opcode ID: 1fae64a267e3fe36f6909fa8621ef3e440a7f20e80f20dcddfa387254839af40
Instruction ID: 17d543eeb3b63641ffcfbafa701299b343f1b9ddd7c3ccd5d8d59da112244cf2
Opcode Fuzzy Hash: 1fae64a267e3fe36f6909fa8621ef3e440a7f20e80f20dcddfa387254839af40
Instruction Fuzzy Hash: 54F0543160960ADFFF111F99FC88BBA77E9FB15356F10483AF52495150CBB28454D650

Function 6D1A4093 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,6D1A412F,00000000,?,6D21A37C,?,?,?,6D1A4066,00000004,InitializeCriticalSectionEx,6D1E39B4,6D1E39BC), ref: 6D1A40A0
GetLastError.KERNEL32(?,6D1A412F,00000000,?,6D21A37C,?,?,?,6D1A4066,00000004,InitializeCriticalSectionEx,6D1E39B4,6D1E39BC,00000000,?,6D1990EC), ref: 6D1A40AA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 6D1A40D2

Strings

api-ms-, xrefs: 6D1A40B7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 5371db16a530d0ff3637fee3796ede70f93b96f62a7110319ea5227cdd8a2e6b
Instruction ID: d9a392b198fbeb93bbb60ef8e5b9d4f5137f17556b31555f2b487111ed4c69a0
Opcode Fuzzy Hash: 5371db16a530d0ff3637fee3796ede70f93b96f62a7110319ea5227cdd8a2e6b
Instruction Fuzzy Hash: 01E04831684205F7EF101EA0ED45FAD3AF6AB15745F144021F94DE8495DBE1E428E944

Function 6D0405DA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6D216028,00000000,?,6D01778D,6D0176A9,?,?,6D0174AC), ref: 6D0405E4
ReleaseSRWLockExclusive.KERNEL32(6D216028,?,6D01778D,6D0176A9,?,?,6D0174AC), ref: 6D040617
WakeAllConditionVariable.KERNEL32(6D216024,?,6D01778D,6D0176A9,?,?,6D0174AC), ref: 6D040622

Strings

(`!m, xrefs: 6D0405DE

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: (`!m
API String ID: 1466638765-3012140011
Opcode ID: c6d474251dc64ee32f470eed62c3c79503e9b86097b4b2ddf4a69431c44f8c93
Instruction ID: 6bfbe7ce143099cdb097da0e5fb1d1eee08b9146f5d43894403002eb117cf077
Opcode Fuzzy Hash: c6d474251dc64ee32f470eed62c3c79503e9b86097b4b2ddf4a69431c44f8c93
Instruction Fuzzy Hash: B1F01535546509DFCB04DF59EA89AAABBF9FB0B305B02802AFA0583340CB706800CF90

Function 6D0C5869 Relevance: 6.4, APIs: 4, Instructions: 433COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0C5873
GetObjectW.GDI32(?,00000018,?), ref: 6D0C5943
DeleteObject.GDI32(?), ref: 6D0C5A18
DeleteObject.GDI32(?), ref: 6D0C5DDA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$Delete$H_prolog3
String ID:
API String ID: 487261545-0
Opcode ID: c00dd45b7802dfc7f26aad40af33c95ff85af0c8f880c92977d12f3ed58074dd
Instruction ID: 68d448725dd6055dcbbc96341f8a4a3905b276a60d45a4b05cdb6838cc40c383
Opcode Fuzzy Hash: c00dd45b7802dfc7f26aad40af33c95ff85af0c8f880c92977d12f3ed58074dd
Instruction Fuzzy Hash: A6121574D047198FDB25CFA9C894BAEBBB5FF09304F10826AD419BB250EB70A981CF51

Function 6D1A1DE4 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(FDA68A44,00000000,00000000,?), ref: 6D1A1E47

Part of subcall function 6D199551: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6D19CD39,?,00000000,-00000008), ref: 6D1995B2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6D1A2099
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6D1A20DF
GetLastError.KERNEL32 ref: 6D1A2182

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 9dc2027e93aa70dad0fd2abc6e8794d2d7c2ac64c0775a846c3b0b44d69aca82
Instruction ID: d2d5608c7d4a63a3488afabb516b62a8ba96e92d270d405711e8702fffbada81
Opcode Fuzzy Hash: 9dc2027e93aa70dad0fd2abc6e8794d2d7c2ac64c0775a846c3b0b44d69aca82
Instruction Fuzzy Hash: B7D19EB5D04249AFCF15CFA9C880AADBBB5FF09304F18812AE665EB355D770A942CF50

Function 6D0AB52B Relevance: 6.3, APIs: 4, Instructions: 283keyboardCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6D0AB559
GetKeyState.USER32(00000011), ref: 6D0AB561
IsRectEmpty.USER32(?), ref: 6D0AB5CB
GetWindowRect.USER32(?,?), ref: 6D0AB797

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Empty$StateWindow
String ID:
API String ID: 2684165152-0
Opcode ID: 99ba1cecb7960a2c89a900ee3aa46b8b97c22073a8745427d8766349f7f29c27
Instruction ID: dbc7aa6497c231cb1b5e60fd53b2bda3bacc2edb28d29c577608512d8fb5f414
Opcode Fuzzy Hash: 99ba1cecb7960a2c89a900ee3aa46b8b97c22073a8745427d8766349f7f29c27
Instruction Fuzzy Hash: E0A1AD35A0021A9FEF05CFA4C984BBEBBF5FF49314F184059E915AB281DF35A851CBA0

Function 6D08023C Relevance: 6.2, APIs: 4, Instructions: 250windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D080246
GetMenuItemCount.USER32(?), ref: 6D080306
GetMenuItemID.USER32(?,00000000), ref: 6D080326
GetSubMenu.USER32(00000001,00000000), ref: 6D080445

Part of subcall function 6D06DD7B: __EH_prolog3.LIBCMT ref: 6D06DD82
Part of subcall function 6D06DD7B: SetRectEmpty.USER32(?), ref: 6D06DF3B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$Item$CountEmptyH_prolog3H_prolog3_Rect
String ID:
API String ID: 2186202558-0
Opcode ID: ac956cea57a244c952caca1ebd83a1a80cf7b6804cac462e44ffd3d0708733d0
Instruction ID: f579ac2a49d31ebf96dd7c10e01a8dca6ada806387008fa45c7aa569b126ba10
Opcode Fuzzy Hash: ac956cea57a244c952caca1ebd83a1a80cf7b6804cac462e44ffd3d0708733d0
Instruction Fuzzy Hash: 4AA18130A04229DBEF14DB64CC58BEEB7B5AF49314F1142A9E929AB2D1DF309E41CF50

Function 6D063D6B Relevance: 6.2, APIs: 4, Instructions: 228COMMON

Download Yara Rule

APIs

IsThemeBackgroundPartiallyTransparent.UXTHEME(?,00000006,00000000,6D1BDE30), ref: 6D063E59
DrawThemeParentBackground.UXTHEME(?,?,00000000), ref: 6D063E73
DrawThemeBackground.UXTHEME(?,?,00000006,00000000,00000000,00000000), ref: 6D063E8F
GetBkColor.GDI32(?), ref: 6D063EA1

Part of subcall function 6D060D71: SetBkColor.GDI32(?,?), ref: 6D060D8A
Part of subcall function 6D060D71: ExtTextOutW.GDI32(?,00000000,00000000,00000002,00000000,00000000,00000000,00000000), ref: 6D060DBC

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: BackgroundTheme$ColorDraw$ParentPartiallyTextTransparent
String ID:
API String ID: 501873518-0
Opcode ID: 2590cad346f4bb71a87715ba5bc9bdf1e43c0b2168fd072a6648fa7d416c91aa
Instruction ID: cbb9d06d5a7f8798bd00117cbb86725ff5c1786ebe7bfdaed09bbfa0c145691b
Opcode Fuzzy Hash: 2590cad346f4bb71a87715ba5bc9bdf1e43c0b2168fd072a6648fa7d416c91aa
Instruction Fuzzy Hash: AD913935E04259ABEF11CFA9C884BAEBBF5FF48714F148159F914BB294CB719840CBA0

Function 6D07F596 Relevance: 6.2, APIs: 4, Instructions: 195COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D07F5EA
InflateRect.USER32(?,00000000,00000000), ref: 6D07F620
GetSystemMetrics.USER32(00000002), ref: 6D07F6A7

Part of subcall function 6D04B7D4: SetScrollInfo.USER32(?,?,?,?), ref: 6D04B818

EnableScrollBar.USER32(?,00000002,00000003), ref: 6D07F7C6

Part of subcall function 6D05BFD7: EnableWindow.USER32(?,?), ref: 6D05BFE8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: EnableRectScroll$ClientInflateInfoMetricsSystemWindow
String ID:
API String ID: 3090651611-0
Opcode ID: 233c0e7520d3e79121654a9cb8341d7b50ca4ff0f69b7d9851b46b7621d20fdc
Instruction ID: 8bc5e1997efb106b02664da3ee509ffaf3dc2b1b8136cf830b7eb208a2ed1129
Opcode Fuzzy Hash: 233c0e7520d3e79121654a9cb8341d7b50ca4ff0f69b7d9851b46b7621d20fdc
Instruction Fuzzy Hash: B2713731A0061ADFDF10CFA8C988BEDBBF9BF49704F14416AE905EB245DB70A941CB50

Function 6D0C4779 Relevance: 6.2, APIs: 4, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0C4780
LoadImageW.USER32(?,?,00000000,00000000,00000000,00002000), ref: 6D0C48D6
GetObjectW.GDI32(00000000,00000018,?), ref: 6D0C48E8
DeleteObject.GDI32(00000000), ref: 6D0C4940

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Object$DeleteH_prolog3ImageLoad
String ID:
API String ID: 91933946-0
Opcode ID: e342250295104bb19a4a5f0ea2153cde565ce2ab4fe934868d55246a5eff4a25
Instruction ID: c4a3f97f17c6bd5d2087ba1f2440c62a6baa7473df3ff055321662acf631a778
Opcode Fuzzy Hash: e342250295104bb19a4a5f0ea2153cde565ce2ab4fe934868d55246a5eff4a25
Instruction Fuzzy Hash: 3161C131804616EBEF11CF64C8807AE77B5FF89314F118269ED257F295CBB0A945CBA2

Function 6D1987C6 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6D19888D
___AdjustPointer.LIBCMT ref: 6D1988B0
___AdjustPointer.LIBCMT ref: 6D19894C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 0eab89abf72d7ca09a2af23b821468b6dbecb7e2d1b720b2217bb6a6d95c3d24
Instruction ID: f60c20f2b072a931c10a54fc349774888d282521ba85d06984b2b2b0194c93ac
Opcode Fuzzy Hash: 0eab89abf72d7ca09a2af23b821468b6dbecb7e2d1b720b2217bb6a6d95c3d24
Instruction Fuzzy Hash: 2951EE72A08307AFEB158F14C880BBA77B4FF58704F11452DEA154F699E7B1E881CBA1

Function 6D04564A Relevance: 6.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 6D044700: GetDlgCtrlID.USER32(?), ref: 6D04470E
Part of subcall function 6D044700: IsChild.USER32(?,?), ref: 6D04471C

GetScrollPos.USER32(?,00000002), ref: 6D045693
GetScrollPos.USER32(?,00000002), ref: 6D0456BF
SetScrollPos.USER32(?,00000002,00000000,00000000), ref: 6D04571C
SetScrollPos.USER32(?,00000002,00000000,00000000), ref: 6D04579E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Scroll$ChildCtrl
String ID:
API String ID: 656700424-0
Opcode ID: edf07b1e7c9359e4c17c8ef2bfc497e3ed46d528fe28fc621fc5551c900131e9
Instruction ID: b1806e31ae61b7fa5bde4a895ac3a5b4eaf4d8df972cccbda717f8a4326343b0
Opcode Fuzzy Hash: edf07b1e7c9359e4c17c8ef2bfc497e3ed46d528fe28fc621fc5551c900131e9
Instruction Fuzzy Hash: 46513F75A0022AEFEF05DF54CC55BBEBBB5BF49710F108079E916A7290DB70A901DB90

Function 6D045800 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 6D044700: GetDlgCtrlID.USER32(?), ref: 6D04470E
Part of subcall function 6D044700: IsChild.USER32(?,?), ref: 6D04471C

GetScrollPos.USER32(?,00000002), ref: 6D045849
GetScrollPos.USER32(?,00000002), ref: 6D045875
SetScrollPos.USER32(?,00000002,00000000,00000000), ref: 6D0458D2
SetScrollPos.USER32(?,00000002,00000000,00000000), ref: 6D045947

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Scroll$ChildCtrl
String ID:
API String ID: 656700424-0
Opcode ID: 774828ce8882538bb95eb2f0ff43dc33a0205adb9648bbfe58f9845b89b6fb32
Instruction ID: 34fab6b60be3a84290a7c4cdb6ae30ecf597351429a74f6a91d74ef095bab203
Opcode Fuzzy Hash: 774828ce8882538bb95eb2f0ff43dc33a0205adb9648bbfe58f9845b89b6fb32
Instruction Fuzzy Hash: 5851F675A0021AEFEF05CF54C845BBEBBF6BF89310F108069E915A7290DB71AD11DB90

Function 6D1A056C Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 135992f8443b4e81f36f97f4b8a286dd9b4ed3c766fc44477996ee744a5d3b5f
Instruction ID: ca656b20d118aac2d53f27218e6cf57693cb46f1320754ffb7da436301453aa2
Opcode Fuzzy Hash: 135992f8443b4e81f36f97f4b8a286dd9b4ed3c766fc44477996ee744a5d3b5f
Instruction Fuzzy Hash: BD4169BAA44705AFE3118F79CC01B6ABBB8EB85714F14812AE145DB288D3F1E941CB80

Function 6D07E420 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6D07E4F1
SetRectEmpty.USER32(?), ref: 6D07E4FE
SetRectEmpty.USER32(?), ref: 6D07E5BC
SetRectEmpty.USER32 ref: 6D07E61B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 18b54f5b22a165df387039a245e2ed8d8bd599ca532cde7c791bc3af01a69ac1
Instruction ID: ee247d14b4e5b782e0f1e4e11d2de0c0db7cb121c12c6fb0dcfabb394e4ffd03
Opcode Fuzzy Hash: 18b54f5b22a165df387039a245e2ed8d8bd599ca532cde7c791bc3af01a69ac1
Instruction Fuzzy Hash: DE51C4B0815226CFDB248F2984C47E53AE8BB49B54F1842BBED1CCF64ACBB05141DFA1

Function 6D031030 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 6D03106A
MultiByteToWideChar.KERNEL32 ref: 6D0310FB
WideCharToMultiByte.KERNEL32 ref: 6D031144
WideCharToMultiByte.KERNEL32 ref: 6D0311C2

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: d599165540f4151d66186ededd78ff7a4fa9622dc2b128a48c88e3682a4b6786
Instruction ID: f5abff0636aa7b31f772963712dce92b34c69fc28b28aaf0f7f7ec1d20c21c1b
Opcode Fuzzy Hash: d599165540f4151d66186ededd78ff7a4fa9622dc2b128a48c88e3682a4b6786
Instruction Fuzzy Hash: 68519FB09083059FDB04DFA8D49879EBBF1BF88354F018A1DE4A9A7380D7789944CF92

Function 6D05A8E4 Relevance: 6.1, APIs: 4, Instructions: 117registryCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(?,?,6D1F7FF8,?,00001000,?), ref: 6D05AA31

Part of subcall function 6D05ADD9: RegCloseKey.ADVAPI32(00000000,?,?,?,?,6D05A808,?,00000000), ref: 6D05AE1E

RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,?,?,00000000,FDA68A44,?,?,?,?,6D1AC011,000000FF), ref: 6D05A97F
RegQueryValueExW.ADVAPI32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,6D1AC011,000000FF), ref: 6D05A9BB
RegCloseKey.ADVAPI32(00000000,?,?,?,?,6D1AC011,000000FF), ref: 6D05A9D5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CloseQueryValue$PrivateProfileString
String ID:
API String ID: 2114517702-0
Opcode ID: 6be8403d31e14453d0923fafab9596a5044f9cfd13d4e5e9331ec1b0e7dfa262
Instruction ID: 029cc3105e0efea81033c7b1b32a51a10134511064737b04836b68115ba9ddbe
Opcode Fuzzy Hash: 6be8403d31e14453d0923fafab9596a5044f9cfd13d4e5e9331ec1b0e7dfa262
Instruction Fuzzy Hash: F0418D71904229EFEB25CF14CD48FAEB7B9FB45314F1041AAE909A3281DB70AE55DF60

Function 6D07ACF8 Relevance: 6.1, APIs: 4, Instructions: 111windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 6D07AD91
ScreenToClient.USER32(000000FF,?), ref: 6D07ADA1
PtInRect.USER32(000000D8,?,?), ref: 6D07ADB4
PostMessageW.USER32(000000FF,00000010,00000000,00000000), ref: 6D07ADCF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ClientCursorMessagePostRectScreen
String ID:
API String ID: 1913696736-0
Opcode ID: ee5fd8db20e08497615399ba3f0215020440e226a3c6c49cea779844159c12f1
Instruction ID: 3c5ec6b23bcaa55c26a3aba6791139b636f0e323a7ee2c02ccf56a3234dbaaad
Opcode Fuzzy Hash: ee5fd8db20e08497615399ba3f0215020440e226a3c6c49cea779844159c12f1
Instruction Fuzzy Hash: 0031E235A0011AAFEF118F64C888F7E7BBAFF48350F204165E92A9B290EF30D901DB54

Function 6D0DE30A Relevance: 6.1, APIs: 4, Instructions: 109windowstringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0DE311
SendMessageW.USER32(?,00000421,00000001,?), ref: 6D0DE3A8
SendMessageW.USER32(?,00000421,00000001,?), ref: 6D0DE3BD
lstrcpyW.KERNEL32(00000000,00000010,00000000,00000010,6D075331,00000000,?,00000002,?,?), ref: 6D0DE3EC

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$H_prolog3lstrcpy
String ID:
API String ID: 3361160815-0
Opcode ID: edbb9e1db48b76c1bbbbf83e09f395c5b36cc8bfb10961f89ff54e49ba43422a
Instruction ID: 7ed3e8ec4a99ef7ed034de92caf43cffc3e8c002f13a5fd9ccf309a61fcb235b
Opcode Fuzzy Hash: edbb9e1db48b76c1bbbbf83e09f395c5b36cc8bfb10961f89ff54e49ba43422a
Instruction Fuzzy Hash: 2941B171A04206DBEF04CF68CC89BBEB7B5BF04318F514469EA61AB2E0CBB09955CB51

Function 6D05DDF0 Relevance: 6.1, APIs: 4, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D05DDF7
GetClientRect.USER32(6D1BD7AC,?), ref: 6D05DE46

Part of subcall function 6D04B5B3: GetScrollPos.USER32(?,?), ref: 6D04B5DF

Part of subcall function 6D066695: GetModuleHandleW.KERNEL32(uxtheme.dll,?,6D05DE78,?,?,?,?,?,?,?,?,00000008), ref: 6D0666A4
Part of subcall function 6D066695: GetProcAddress.KERNEL32(00000000,BufferedPaintInit), ref: 6D0666B4
Part of subcall function 6D066695: EncodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000008), ref: 6D0666BD

CreateCompatibleDC.GDI32(?), ref: 6D05DEE2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 6D05DF08

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CompatibleCreate$AddressBitmapClientEncodeH_prolog3HandleModulePointerProcRectScroll
String ID:
API String ID: 1015973060-0
Opcode ID: 1a7bc2393a1c8eb53867db1dfb27c5c9e1871786cb825015ee3d6f15b6bb8109
Instruction ID: d0f65c1479d56563fb6c3656f239b24fbabeae043ee81074de8a75962bf4497f
Opcode Fuzzy Hash: 1a7bc2393a1c8eb53867db1dfb27c5c9e1871786cb825015ee3d6f15b6bb8109
Instruction Fuzzy Hash: EA415070504606EFEB00DF65CA84B69BBF4BF58308F41C52EE91997650D774E960CFA0

Function 6D04E96F Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6D05BBC2: GetWindowLongW.USER32(F04D8BF4,000000F0), ref: 6D05BBCF

GetClientRect.USER32(?,?), ref: 6D04E9D7
IsMenu.USER32(00000000), ref: 6D04EA13
AdjustWindowRectEx.USER32(?,00000000,00000000,?), ref: 6D04EA2B
GetClientRect.USER32(?,?), ref: 6D04EA73

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$ClientWindow$AdjustLongMenu
String ID:
API String ID: 3435883281-0
Opcode ID: 2e35d5ed4f3957820fe5dba5861c1533d81a8dd3484d6b6e6bd7015ca9b3e6b7
Instruction ID: d95e93f58a8f4d9aaa9d85e22d12275e74ca3b214909f839e6d4c01ee62a4c3c
Opcode Fuzzy Hash: 2e35d5ed4f3957820fe5dba5861c1533d81a8dd3484d6b6e6bd7015ca9b3e6b7
Instruction Fuzzy Hash: 3D315375A0420AAFEB00DBB5CA98FBFBBF9FF45204F114569E901E7240DB74A950CB51

Function 6D0790DA Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0790E1
IsWindow.USER32(?), ref: 6D079189
GetParent.USER32(?), ref: 6D0791A9
GetParent.USER32(?), ref: 6D0791C5

Part of subcall function 6D0BF2FA: __EH_prolog3_catch_GS.LIBCMT ref: 6D0BF301
Part of subcall function 6D0BF2FA: CreateCompatibleDC.GDI32(00000000), ref: 6D0BF341
Part of subcall function 6D0BF2FA: CreateCompatibleBitmap.GDI32(?,?,?), ref: 6D0BF363
Part of subcall function 6D0BF2FA: FillRect.USER32(?,?,?), ref: 6D0BF3AD
Part of subcall function 6D0BF2FA: OpenClipboard.USER32(?), ref: 6D0BF3DD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CompatibleCreateParent$BitmapClipboardFillH_prolog3H_prolog3_catch_OpenRectWindow
String ID:
API String ID: 837828968-0
Opcode ID: 6a2e09032fda758c7dba51b24ea15a9c4edea96fc0afe4f8d4b42d408060bc33
Instruction ID: b7988c690c7571fc081f88d546defdd68ba788614553c48ea02fb0d88892515b
Opcode Fuzzy Hash: 6a2e09032fda758c7dba51b24ea15a9c4edea96fc0afe4f8d4b42d408060bc33
Instruction Fuzzy Hash: 8A31D431A09603ABFB249B75ED48B6B7BFDFF482097024439EA059B550DF30E821C754

Function 6D069E2F Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(6D06A419), ref: 6D069E3B
GetClientRect.USER32(00000000,6D06A419), ref: 6D069E5B
GetParent.USER32(00000000), ref: 6D069E7A
OffsetRect.USER32(6D06A419,00000000,00000000), ref: 6D069EFC

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$ClientEmptyOffsetParent
String ID:
API String ID: 3819956977-0
Opcode ID: f1ed2d41a2115a10f291dbc57fa6b7c3072c06f68f6e35a446046caa692fde44
Instruction ID: f81e44ecf8694f6bc76b75c2bcb8658c38e077f8e505f019544a95ac999f42c9
Opcode Fuzzy Hash: f1ed2d41a2115a10f291dbc57fa6b7c3072c06f68f6e35a446046caa692fde44
Instruction Fuzzy Hash: 54318471608603EFEB048F65E994F39B7F9FF44750710811DE91A8B680DB64EC51CBA0

Function 6D06F64A Relevance: 6.1, APIs: 4, Instructions: 96windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 6D06F654
SetFocus.USER32(?), ref: 6D06F664
InvalidateRect.USER32(?,?,00000001,00000026,00000000), ref: 6D0710C4
UpdateWindow.USER32(?), ref: 6D0710E3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$FocusInvalidateRectUpdate
String ID:
API String ID: 593871241-0
Opcode ID: f1f273bfab779c045f3fb7df3efa842d368dbd7848da02db87e99d85c8dafe54
Instruction ID: e9aaa3a2946be802ed562512839a2c1789c1ee6676a6c88f2e6f5304a9f0f133
Opcode Fuzzy Hash: f1f273bfab779c045f3fb7df3efa842d368dbd7848da02db87e99d85c8dafe54
Instruction Fuzzy Hash: 6031F631604646EBFB219F66E844BAE77F8FF85314F11817AD9146B190DBB0E804CBE1

Function 6D0C9250 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 6D0C9287
GetWindowRect.USER32(?,?), ref: 6D0C92C8
GetClientRect.USER32(?,?), ref: 6D0C92DF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$ClientEmptyWindow
String ID:
API String ID: 742297903-0
Opcode ID: a5b4cf101cff80adaa2dd422aa781afc0ec41210517ba58184a602d3d3cd1915
Instruction ID: 438f42305c7ad7a0d21eeefb648cc88eb66d3140b806a1451bad53ada90ec2cf
Opcode Fuzzy Hash: a5b4cf101cff80adaa2dd422aa781afc0ec41210517ba58184a602d3d3cd1915
Instruction Fuzzy Hash: DE316D74A0020ADFDB00DF24D984BAEBBF5FF49309B108168E819EB381DB30E951CB91

Function 6D14ABE9 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D14ABF3
CoTaskMemFree.OLE32(?,?,?,?,?,00000000,?,00000040,6D0C727C,?,00000000,00000000,0000005C), ref: 6D14AC97
CoTaskMemFree.OLE32(?,?,?,00000000,?,00000040,6D0C727C,?,00000000,00000000,0000005C), ref: 6D14ACD7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,00000003,000000FF,00000000,?,00000000,?,00000040,6D0C727C,?,00000000,00000000), ref: 6D14ACF5

Part of subcall function 6D040987: __EH_prolog3.LIBCMT ref: 6D04098E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: FreeTask$CreateGlobalH_prolog3H_prolog3_Stream
String ID:
API String ID: 655328227-0
Opcode ID: 86df31329824a2acaf786f9467e825ef26e85c6942c8f54bf8fc4c612e94326d
Instruction ID: 9d63d43bb0ac057ba33a0e067343b7712e4be07cc7c47cf6ee357a1ee11e01f0
Opcode Fuzzy Hash: 86df31329824a2acaf786f9467e825ef26e85c6942c8f54bf8fc4c612e94326d
Instruction Fuzzy Hash: 0831BB7190821E9BEF109F54DD88FAEB778EF10318F1141A9E60597290CBB19E80DF91

Function 6D0DC603 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 6D0DC66C
EqualRect.USER32(?,?), ref: 6D0DC692
BeginDeferWindowPos.USER32(?), ref: 6D0DC69F
EndDeferWindowPos.USER32(00000000), ref: 6D0DC6C5

Part of subcall function 6D0CBE05: GetWindowRect.USER32(?,?), ref: 6D0CBE19
Part of subcall function 6D0CBE05: GetParent.USER32(?), ref: 6D0CBE6F
Part of subcall function 6D0CBE05: GetParent.USER32(?), ref: 6D0CBE82

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Rect$DeferParent$BeginEqual
String ID:
API String ID: 2054780619-0
Opcode ID: 6b0024af018c0303b4c6608e7c329c938c6bad3df723b8fba2098c5559ae5ae7
Instruction ID: 00131006868fc6efd730077612d642cd83a71400244f1468af64546d357fda01
Opcode Fuzzy Hash: 6b0024af018c0303b4c6608e7c329c938c6bad3df723b8fba2098c5559ae5ae7
Instruction Fuzzy Hash: B3318031E0020A9BDF01DF74D994BEEB7F9FF0E304B51512AE901A3100EB71A955CBA5

Function 6D047453 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,?,?), ref: 6D0474E5
GetWindowRect.USER32(?,?), ref: 6D0474F9
GetParent.USER32(?), ref: 6D047502
EqualRect.USER32(?,?), ref: 6D047521

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$EqualInflateParentWindow
String ID:
API String ID: 719057501-0
Opcode ID: 6fbe4c99dab98634bf3fbedb6081cf9eb749fba47003c32d12f16bc832a5a65b
Instruction ID: 947019e2d6ceb5559300e2ca219cfdeb27d26cfc192425b8c5267f0ba86f7060
Opcode Fuzzy Hash: 6fbe4c99dab98634bf3fbedb6081cf9eb749fba47003c32d12f16bc832a5a65b
Instruction Fuzzy Hash: 94310D71A042099BDF00DFA4D984FEEBBF9FB49304F118529EA01E3150EB75EA55CB61

Function 6D19F019 Relevance: 6.1, APIs: 4, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D199551: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,6D19CD39,?,00000000,-00000008), ref: 6D1995B2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 6D19F07D
__dosmaperr.LIBCMT ref: 6D19F084
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 6D19F0BE
__dosmaperr.LIBCMT ref: 6D19F0C5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 11fdb7860c425599b4efd44229aeab8bf62425df05346666c92f0f6fd144b444
Instruction ID: 1f0f0051eaabbbdff8241513b2b2a4575f40471903c8912389afec761b393e00
Opcode Fuzzy Hash: 11fdb7860c425599b4efd44229aeab8bf62425df05346666c92f0f6fd144b444
Instruction Fuzzy Hash: C121C271608706BFA7118FA5C88096FB7AEFF043687158918FA25DF259E7F1EC408B90

Function 6D07CC97 Relevance: 6.1, APIs: 4, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 6D07CCB9
PtInRect.USER32(?,?,?), ref: 6D07CCE3

Part of subcall function 6D07A952: ScreenToClient.USER32(?,?), ref: 6D07A96E
Part of subcall function 6D07A952: GetParent.USER32(?), ref: 6D07A97E
Part of subcall function 6D07A952: GetClientRect.USER32(?,?), ref: 6D07AA11
Part of subcall function 6D07A952: MapWindowPoints.USER32(?,?,?,00000002), ref: 6D07AA23
Part of subcall function 6D07A952: PtInRect.USER32(?,?,?), ref: 6D07AA33

MapWindowPoints.USER32(?,?,?,00000001), ref: 6D07CD0C
SendMessageW.USER32(?,00000202,?,?), ref: 6D07CD2B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Client$PointsWindow$MessageParentScreenSend
String ID:
API String ID: 2689702638-0
Opcode ID: 0ce43453a51e61a4a0aad091656defb71e80201562a3cd400a93a2961ea52a1c
Instruction ID: 4dcbe7daa8b3d3b43c94e0d012ff9ef088e8a32e44f973ccf2eddcd55342a82d
Opcode Fuzzy Hash: 0ce43453a51e61a4a0aad091656defb71e80201562a3cd400a93a2961ea52a1c
Instruction Fuzzy Hash: 8C31E33190060AEBDF22CF65CC54BAE7FF6FF45740B00412AF9199B110EB319920DB54

Function 6D044ABF Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

RedrawWindow.USER32(00000041,?,?,00000041), ref: 6D044AE2
InflateRect.USER32(?,000000FF,000000FF), ref: 6D044B25

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: InflateRectRedrawWindow
String ID:
API String ID: 3190756164-0
Opcode ID: b8d5c5a0a0193f3f8d3212f0648baaeb270551dd8e0954ae499e659720b1970a
Instruction ID: 05e8d82a456077aefbc409e787de5f667f24f0416cc9596cad65940679a4a257
Opcode Fuzzy Hash: b8d5c5a0a0193f3f8d3212f0648baaeb270551dd8e0954ae499e659720b1970a
Instruction Fuzzy Hash: 4B21307590811ABBDF00DE94CC88EAFB7B9EB0A3287204625B621631D0CF71A918DB61

Function 6D089684 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

RedrawWindow.USER32(?,00000000,00000000,00000585,?,?,00000000,?,6D08966F,00000002,00000000,?,?,?,6D05F37E), ref: 6D0896B5
RedrawWindow.USER32(?,00000000,00000000,00000585,?,00000000,?,6D08966F,00000002,00000000,?,?,?,6D05F37E,?,00000000), ref: 6D0896E2
RedrawWindow.USER32(?,00000000,00000000,00000185,?,00000000,?,6D08966F,00000002,00000000,?,?,?,6D05F37E,?,00000000), ref: 6D08971F
RedrawWindow.USER32(?,00000000,00000000,00000585,?,?,?,?,6D05F37E,?,00000000), ref: 6D0A52F8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: RedrawWindow
String ID:
API String ID: 2219533335-0
Opcode ID: cc6be69c29e053fd36755dfda9b922245e1c4e9f32ebf3227f54ba54c85444e2
Instruction ID: 747a693a138f4ac29f7220618eb93c71393b9754eb149a2f52c7f27cadbe40b9
Opcode Fuzzy Hash: cc6be69c29e053fd36755dfda9b922245e1c4e9f32ebf3227f54ba54c85444e2
Instruction Fuzzy Hash: 7921FB36A40B12BBFF111E28FC49F2A73B1BF85B20F254118ED4577191EF60E850CA84

Function 6D184D2D Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de809aa423a5d90a64afb25f81b7d313a54e96c578e0680f787828f4ec6ff08c
Instruction ID: 56eadc7ffa12a1463c6a4a5b95e4ba1392c19227e52588215f5f9de554e00f17
Opcode Fuzzy Hash: de809aa423a5d90a64afb25f81b7d313a54e96c578e0680f787828f4ec6ff08c
Instruction Fuzzy Hash: E621D471208206AFA710DF65D88096B77AFEF293687128615F919C7146EFF0EC008F50

Function 6D190997 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f518532d1b4278d031b7323a06b0107cf8dd39eba15974cd7cdbb0859751b644
Instruction ID: 11edf40393a470fe5549780c2a5788cba5df220037eac74960e8835f6f0b34b7
Opcode Fuzzy Hash: f518532d1b4278d031b7323a06b0107cf8dd39eba15974cd7cdbb0859751b644
Instruction Fuzzy Hash: B3112C31654205BFEB115AAA9C08F6B77B9FB82764F224511FA15DF198E7F18C00D7D0

Function 6D07D443 Relevance: 6.1, APIs: 4, Instructions: 74windowCOMMON

Download Yara Rule

APIs

DestroyMenu.USER32(?,FDA68A44,?,?,?,Function_0019BF80,000000FF), ref: 6D07D494
IsWindow.USER32(?), ref: 6D07D4A5
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 6D07D4B9
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 6D07D516

Part of subcall function 6D0F0411: GetParent.USER32(00000000), ref: 6D0F0498

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ContextExternal$BaseBase::~Concurrency::details::DestroyMenuMessageParentSendWindow
String ID:
API String ID: 3377428259-0
Opcode ID: e3dd21500c793a84a4bd090fef442bee2a2a7a32fe9521b6000402bd9fbc93fa
Instruction ID: f1e7772ae9c3ab3dc568d344f07746e109050c8c4706708e810ba76467930b2b
Opcode Fuzzy Hash: e3dd21500c793a84a4bd090fef442bee2a2a7a32fe9521b6000402bd9fbc93fa
Instruction Fuzzy Hash: 4A216874204B059BEB25DF35C894BFAB7F8FF85314F01482DE6AA87280DB75B406CA20

Function 6D07C9A1 Relevance: 6.1, APIs: 4, Instructions: 70timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,0000EC17), ref: 6D07C9B5
KillTimer.USER32(?,0000EC18), ref: 6D07C9C3
IsWindow.USER32(?), ref: 6D07CA33
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 6D07CA5A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: KillTimer$MessagePostWindow
String ID:
API String ID: 3970157719-0
Opcode ID: 4ea0d822531f6f93e3deef68d65fd6661ccce6c73976562b041f8466ac0d4891
Instruction ID: 78759423979bb06d39e3aa41b88b11a980505e847ab13708a9d90809ae91ee5d
Opcode Fuzzy Hash: 4ea0d822531f6f93e3deef68d65fd6661ccce6c73976562b041f8466ac0d4891
Instruction Fuzzy Hash: DC218332700206AFFF049B61D884BAA77F6FB89715F104175DA15AB291DF70A901DB58

Function 6D07CD93 Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 6D07CDC5
PtInRect.USER32(?,?,?), ref: 6D07CDDE

Part of subcall function 6D07A952: ScreenToClient.USER32(?,?), ref: 6D07A96E
Part of subcall function 6D07A952: GetParent.USER32(?), ref: 6D07A97E
Part of subcall function 6D07A952: GetClientRect.USER32(?,?), ref: 6D07AA11
Part of subcall function 6D07A952: MapWindowPoints.USER32(?,?,?,00000002), ref: 6D07AA23
Part of subcall function 6D07A952: PtInRect.USER32(?,?,?), ref: 6D07AA33

MapWindowPoints.USER32(?,?,?,00000001), ref: 6D07CE14
SendMessageW.USER32(?,00000201,?,?), ref: 6D07CE33

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$Client$PointsWindow$MessageParentScreenSend
String ID:
API String ID: 2689702638-0
Opcode ID: 07093a7f6cdb33f4e0e6bb61c9b40fe1f372b34e45fc3d78807d3ae873abf29e
Instruction ID: 6f4525515e70e2c8546a6256be36cbfb9224aa1f7f9c61fac8157c55dbc18779
Opcode Fuzzy Hash: 07093a7f6cdb33f4e0e6bb61c9b40fe1f372b34e45fc3d78807d3ae873abf29e
Instruction Fuzzy Hash: 3A218E3190020AEFDF118FA4D848BBF7BB6FF48304F008119F91656150EBB1A960DF90

Function 6D069FEA Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

BeginDeferWindowPos.USER32(?), ref: 6D06A008
IsWindow.USER32(?), ref: 6D06A023
DeferWindowPos.USER32(00000000,00000000,00000000,?,?,?,?,00000000), ref: 6D06A06C
EndDeferWindowPos.USER32(00000000), ref: 6D06A077

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Defer$Begin
String ID:
API String ID: 2880567340-0
Opcode ID: 4117f56685b002137eed2a67e09612b2e4a003b435f25b984770dd21350a5914
Instruction ID: 790c02db52af4cc0f6ecc5018484ef7fe391b8a7b45ac51301c07d7a820e74b7
Opcode Fuzzy Hash: 4117f56685b002137eed2a67e09612b2e4a003b435f25b984770dd21350a5914
Instruction Fuzzy Hash: E9113A71A0021AAFEB01DFA9D984BBEBBF9FF09304F104559E505E3250DB71A950DBA1

Function 6D06B6AD Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000005), ref: 6D06B6CB
LoadResource.KERNEL32(?,00000000), ref: 6D06B6E0
LockResource.KERNEL32(00000000), ref: 6D06B6F2
GlobalFree.KERNEL32(?), ref: 6D06B731

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeGlobalLoadLock
String ID:
API String ID: 3898064442-0
Opcode ID: 82819896fc7370828590d91ef654b81bf06f094b0290aa7b700c654131ad65f6
Instruction ID: c7c6aeecdab9217eea039425bbe3bbcf4fd0a6ec6d90c9ee057cfdd5ef1e73ce
Opcode Fuzzy Hash: 82819896fc7370828590d91ef654b81bf06f094b0290aa7b700c654131ad65f6
Instruction Fuzzy Hash: B21160B1605622AFE7219F65D488FAABBE5FF05365F06C169FD09A7210CB709C109BF0

Function 6D04EFC2 Relevance: 6.1, APIs: 4, Instructions: 62windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 6D04EFFC
SendMessageW.USER32(?,0000001F,00000000,00000000), ref: 6D04F026
GetCapture.USER32 ref: 6D04F03C
SendMessageW.USER32(00000000,0000001F,00000000,00000000), ref: 6D04F04B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 2063bebc440b6b4b055ce047448ae0e8fd6c2a1319bcb3b74eb531b1ec694e03
Instruction ID: 4d93141f5c684b93215c55373416ba27f13f4a210cf6b43dd814169f8b9c2be8
Opcode Fuzzy Hash: 2063bebc440b6b4b055ce047448ae0e8fd6c2a1319bcb3b74eb531b1ec694e03
Instruction Fuzzy Hash: 2E11307134061ABFFA2557249CCDFBA7AAEFB88788F014074B71197291DB919C4096A0

Function 6D0522F6 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 6D052343
GetWindowRect.USER32(?,?), ref: 6D05235F
PtInRect.USER32(?,00000000,00000000), ref: 6D05236F
CallNextHookEx.USER32(?,?,?), ref: 6D052397

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$CallCursorHookNextWindow
String ID:
API String ID: 3719484595-0
Opcode ID: 7a9255df6b4cebee1ca0dff69f92d29e654e4261ee4e49ac87162b21258433e2
Instruction ID: f311afd9a139fc278e2c738977e74572aeb2ae31394828645359628aeaa45e46
Opcode Fuzzy Hash: 7a9255df6b4cebee1ca0dff69f92d29e654e4261ee4e49ac87162b21258433e2
Instruction Fuzzy Hash: 19215C3290010BDBEF01CFB4DE49BBE7FB5AF5A315F108518A910AB050DB35A664DB91

Function 6D04EC1E Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000000C,?), ref: 6D04EC69
SetBkColor.GDI32(?,?), ref: 6D04EC73
GetSysColor.USER32(00000008), ref: 6D04EC83
SetTextColor.GDI32(?,?), ref: 6D04EC8B

Part of subcall function 6D060287: GetWindowLongW.USER32(00000018,000000F0), ref: 6D0602A2
Part of subcall function 6D060287: GetClassNameW.USER32(00000018,?,0000000A), ref: 6D0602B7
Part of subcall function 6D060287: CompareStringW.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF), ref: 6D0602CE

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Color$ClassCompareLongNameObjectStringTextWindow
String ID:
API String ID: 3274569906-0
Opcode ID: b2813a8123a46e5c90976191311f03bbb6aebb3482e078c899d5f34582efe145
Instruction ID: 284e25f5114d9054e9ac1775283fe7c40405fd4eb5647ed250b5703add79d1c1
Opcode Fuzzy Hash: b2813a8123a46e5c90976191311f03bbb6aebb3482e078c899d5f34582efe145
Instruction Fuzzy Hash: 19016DB5600106EBEB10DF689A84FBF7BF9AF4A310F518925F921D3181CB70D9028B61

Function 6D05A85B Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000004,?,00000004,?,00000000), ref: 6D05A896
RegCloseKey.ADVAPI32(00000000), ref: 6D05A89F
swprintf.LIBCMT ref: 6D05A8BC
WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 6D05A8CD

Part of subcall function 6D05ADD9: RegCloseKey.ADVAPI32(00000000,?,?,?,?,6D05A808,?,00000000), ref: 6D05AE1E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Close$PrivateProfileStringValueWriteswprintf
String ID:
API String ID: 581541481-0
Opcode ID: 4ee22b30e6fdde9925f3b459fad8516a5b9888dfdd3fd65abb11e463fb434c54
Instruction ID: f0c5105dcb07549deaf0afa73ab57aa058ce1c55d060982e53834c55c615f34f
Opcode Fuzzy Hash: 4ee22b30e6fdde9925f3b459fad8516a5b9888dfdd3fd65abb11e463fb434c54
Instruction Fuzzy Hash: 4C016D72500308ABEB00DAA4DD85FBFB7FDEB49A14F11046AFA01A7180DBB5ED159760

Function 6D055508 Relevance: 6.1, APIs: 4, Instructions: 55fileCOMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 6D055524
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 6D055537
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 6D055565
DragFinish.SHELL32(?), ref: 6D05559A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Drag$FileQuery$ActiveFinishWindow
String ID:
API String ID: 892977027-0
Opcode ID: 9ff45d7eaf5a7e17f71993aa449d9c4c6fb77cb28988f73ed160e2ec92d3cb0c
Instruction ID: e41a0bed791036253ef9e5dbb43ec22aefa1abe4b7c9e76b9504ddbb882c5ba8
Opcode Fuzzy Hash: 9ff45d7eaf5a7e17f71993aa449d9c4c6fb77cb28988f73ed160e2ec92d3cb0c
Instruction Fuzzy Hash: AD1151759002189FDB10DF25DD8CFAE7BB9FB99304F010198FA1A97241CB709A40CBA0

Function 6D18F5F9 Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,6D18F724,00000000,00000004,00000000), ref: 6D18F648
GetLastError.KERNEL32(?,?,?,6D0D93B3,6D0D9403,00000000,00000000,?,00000000,?,6D0717B5,00000001,00000000,?,?,6D07144B), ref: 6D18F654
__dosmaperr.LIBCMT ref: 6D18F65B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: c7f9b79e4f17f9b522b808dcec1a2e7febc49e3fcc22a3fe1ef4ee52f56fb0f0
Instruction ID: 3333fd70e10564d25905cabc05ad7bcc2487a2df022a0b639e799374ac054531
Opcode Fuzzy Hash: c7f9b79e4f17f9b522b808dcec1a2e7febc49e3fcc22a3fe1ef4ee52f56fb0f0
Instruction Fuzzy Hash: 7601C072904604ABDB01CBA5DC08BAE7AB9EF81375F314318F632960E5DBF08540DE60

Function 6D046FB7 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 6D046FC7
GetScrollPos.USER32(?,00000002), ref: 6D046FDA
SendMessageW.USER32(?,00000114,?,?), ref: 6D047014
SetScrollPos.USER32(?,00000002,?,00000000), ref: 6D047032

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Scroll$CtrlMessageSend
String ID:
API String ID: 1219558039-0
Opcode ID: 94fb1f98168624b960397084c03076c09d60a32d2a91930dae85ffcb1a20073f
Instruction ID: bcca72cc2b358c835dc948def83f65eddcd4481151e041bf5159a781fed89250
Opcode Fuzzy Hash: 94fb1f98168624b960397084c03076c09d60a32d2a91930dae85ffcb1a20073f
Instruction Fuzzy Hash: 2B11AC72600218EFEB018F68DC89FAE7BB6FB49340F014479FA45AB151D7B19C50DBA0

Function 6D047048 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 6D047058
GetScrollPos.USER32(?,00000002), ref: 6D04706B
SendMessageW.USER32(?,00000115,?,?), ref: 6D0470A5
SetScrollPos.USER32(?,00000002,?,00000000), ref: 6D0470C3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Scroll$CtrlMessageSend
String ID:
API String ID: 1219558039-0
Opcode ID: bd463e7df50bec7fc1a187e6b2f810ccfb0b63e1d7eb1e6f14dc8799c8ef5159
Instruction ID: e5c879e6c06eb80055b26d59980d89886dfb720a029dc89b73accb966c10dde1
Opcode Fuzzy Hash: bd463e7df50bec7fc1a187e6b2f810ccfb0b63e1d7eb1e6f14dc8799c8ef5159
Instruction Fuzzy Hash: 5611AC32600218EFEB119FA8DC89FAE7BB6FB88340F000569F941AB151D7B19850DBA0

Function 6D074490 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,00000002,00000002), ref: 6D0744CF
InvalidateRect.USER32(?,?,00000001), ref: 6D0744E3
UpdateWindow.USER32(?), ref: 6D0744EC
SetRectEmpty.USER32(?), ref: 6D0744F3

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Rect$EmptyInflateInvalidateUpdateWindow
String ID:
API String ID: 3040190709-0
Opcode ID: ae6996d2f9bb9f954a61f86c9d5dd3b231b353af885d972d82c9a394589d48a0
Instruction ID: b0c8a8130751115da5a2f107457ae9eea3d6342c444a21d42524e6a930232e1d
Opcode Fuzzy Hash: ae6996d2f9bb9f954a61f86c9d5dd3b231b353af885d972d82c9a394589d48a0
Instruction Fuzzy Hash: 9901AD31500209AFDB10DF69D889F9B7BF9FB8A320F110269B516A7190DB705904CB50

Function 6D041872 Relevance: 6.0, APIs: 4, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00000000), ref: 6D041882
GetSubMenu.USER32(00000000,-00000001), ref: 6D041891
GetMenuItemCount.USER32(00000000), ref: 6D04189E
GetMenuItemID.USER32(00000000,00000000), ref: 6D0418B4

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Menu$Item$Count
String ID:
API String ID: 879546783-0
Opcode ID: 586e296bd48710d54f62e19fa2c709341fabbbd27bc7374ec74af24ceb061643
Instruction ID: 616d51af9e2f481843d9da62ee3e110e15d7d09439a5187a43f54bb147baaec3
Opcode Fuzzy Hash: 586e296bd48710d54f62e19fa2c709341fabbbd27bc7374ec74af24ceb061643
Instruction Fuzzy Hash: 4E01A274A14306EFFB418B75E894F9E7AF9EF06381F108439F806E2140D770C9609B51

Function 6D042380 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000F0), ref: 6D0423A0
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 6D0423AF
IsWindow.USER32(00000000), ref: 6D0423C0
SetWindowLongW.USER32(00000000,000000F0,?), ref: 6D0423D0

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 584ebf72bd3ff83f07a597bdabef4b8d0a7a184e9671d60d2dbdf562d6e119b1
Instruction ID: 7ea9ee988267c4b85c6cfa3d231d9ae8be64c25a4494e078de6c2e0165c02216
Opcode Fuzzy Hash: 584ebf72bd3ff83f07a597bdabef4b8d0a7a184e9671d60d2dbdf562d6e119b1
Instruction Fuzzy Hash: 3F01A231318215EFEF009B74AC88F7E36B9EB8A725B110728F922D72C0DFB49801A651

Function 6D09132B Relevance: 6.0, APIs: 4, Instructions: 47keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 6D091345
GetKeyboardLayout.USER32(?), ref: 6D09136B
MapVirtualKeyW.USER32(00000000,00000000), ref: 6D091378
ToUnicodeEx.USER32(00000000,00000000,?,?,00000002,00000000,00000000), ref: 6D091395

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Keyboard$LayoutStateUnicodeVirtual
String ID:
API String ID: 961187839-0
Opcode ID: d9f7634b7bcefe911b73a7e55aa50364e29788a2cb1eb421fb762b355a0cdf90
Instruction ID: 72d1c0b8f7555fc27b4367b783cf90252ea48b758062a82d21aed939b2695e97
Opcode Fuzzy Hash: d9f7634b7bcefe911b73a7e55aa50364e29788a2cb1eb421fb762b355a0cdf90
Instruction Fuzzy Hash: CF01B5756042086BDB14DB60ED49FDE3BB9EF15704F004495B646D7080EBB0AA54DB91

Function 6D04EEAE Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 6D04EEB5
GetTopWindow.USER32(00000000), ref: 6D04EEF8
GetWindow.USER32(00000000,00000002), ref: 6D04EF1A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: b7627b0dd32f93c9cafda73c2406a4ab60f2992cc525f396275cf7d5cbaabfbb
Instruction ID: bcc5c4125a78cb7379e3467609be6da3a1e7a813c637ab2ef1bfa792eaeae417
Opcode Fuzzy Hash: b7627b0dd32f93c9cafda73c2406a4ab60f2992cc525f396275cf7d5cbaabfbb
Instruction Fuzzy Hash: BE01A93600451AFBEF029F959D44FAF3BAAAF05355F018024FE1495061C776C571EB91

Function 6D04EE37 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 6D04EE41
GetTopWindow.USER32(00000000), ref: 6D04EE4E

Part of subcall function 6D04EE37: GetWindow.USER32(00000000,00000002), ref: 6D04EE9D

GetTopWindow.USER32(?), ref: 6D04EE82

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 689ae9c510085ddc0ddacfa57cb4b0eee969c233efd23ebf62784ce17be94e83
Instruction ID: b946041a941d36fc848358100d79c824d29f96724ac467907e9b66625cb67817
Opcode Fuzzy Hash: 689ae9c510085ddc0ddacfa57cb4b0eee969c233efd23ebf62784ce17be94e83
Instruction Fuzzy Hash: 4D01FB36549616EBFB129FA2EC04FAF3AB9AF05395F01C134FE14D6050D771C6219A91

Function 6D05C00E Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 6D05C01C
GetParent.USER32(?), ref: 6D05C02F
GetParent.USER32(?), ref: 6D05C049
SetFocus.USER32(?,00000000,?,?,6D05517F,?,6D0119CC), ref: 6D05C062

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Parent$Focus
String ID:
API String ID: 384096180-0
Opcode ID: e4f299577e3008e4a53831e8e788fef112c4dc60d0e985e7d944d77d8eea749b
Instruction ID: ef6018fa3defae46b7736e794a1e600a2171abf86130ce355a6925b0ab922b45
Opcode Fuzzy Hash: e4f299577e3008e4a53831e8e788fef112c4dc60d0e985e7d944d77d8eea749b
Instruction Fuzzy Hash: 82F06D76A14601DBEF126B70A80CF2F7BFABF852457024938EA4783260DF64E8119B50

Function 6D1AA6B9 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,6D19FE6C,00000000,00000000,00000000,?,6D1A96A0,00000000,00000001,00000000,?,?,6D1A21D6,?,00000000,00000000), ref: 6D1AA6D0
GetLastError.KERNEL32(?,6D1A96A0,00000000,00000001,00000000,?,?,6D1A21D6,?,00000000,00000000,?,?,?,6D1A1B1C,?), ref: 6D1AA6DC

Part of subcall function 6D1AA72D: CloseHandle.KERNEL32(FFFFFFFE,6D1AA6EC,?,6D1A96A0,00000000,00000001,00000000,?,?,6D1A21D6,?,00000000,00000000,?,?), ref: 6D1AA73D

___initconout.LIBCMT ref: 6D1AA6EC

Part of subcall function 6D1AA70E: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6D1AA6AA,6D1A968D,?,?,6D1A21D6,?,00000000,00000000,?), ref: 6D1AA721

WriteConsoleW.KERNEL32(00000000,6D19FE6C,00000000,00000000,?,6D1A96A0,00000000,00000001,00000000,?,?,6D1A21D6,?,00000000,00000000,?), ref: 6D1AA701

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 8043704ec87da83d045bee068d2577966456a91b97ca7a964c54a0a27268ccbb
Instruction ID: 4accd6b1c40a613536ee7bcf983182e805fee46210df6f45095cfd068d539236
Opcode Fuzzy Hash: 8043704ec87da83d045bee068d2577966456a91b97ca7a964c54a0a27268ccbb
Instruction Fuzzy Hash: 01F0FE3A540219BBCF125ED1DC09E9A3E76FB4A7E4B094410FA1995110D7B38820AB90

Function 6D19FF6D Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

PeekConsoleInputA.KERNEL32(?,?,6D20F7F8,00000000,?,6D19198A,00000000,0000000C,6D20F7F8,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D19FF82
GetLastError.KERNEL32(?,6D19198A,00000000,0000000C,6D20F7F8,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D19FF8E

Part of subcall function 6D1A006A: CloseHandle.KERNEL32(FFFFFFFF,6D19FF52,?,?,6D191920,0000000C,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A007A

___initconin.LIBCMT ref: 6D19FF9E

Part of subcall function 6D1A004B: CreateFileW.KERNEL32(CONIN$,C0000000,00000003,00000000,00000003,00000000,00000000,6D19FEC6,6D19190F,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A005E

PeekConsoleInputA.KERNEL32(?,?,6D20F7F8,?,6D19198A,00000000,0000000C,6D20F7F8,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D19FFB2

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ConsoleInputPeek$CloseCreateErrorFileHandleLast___initconin
String ID:
API String ID: 1545762386-0
Opcode ID: 4d87ea86c6eca365bc8ae776295d8b09312c1fafbd71344be975755b4c43f834
Instruction ID: 7082fedcd8d26a235634946f0f08a8508a80e633274b775b5d90b5edcaf8ef5c
Opcode Fuzzy Hash: 4d87ea86c6eca365bc8ae776295d8b09312c1fafbd71344be975755b4c43f834
Instruction Fuzzy Hash: FDF0C03750512ABB8F121FD5DC09A9E7FB7FF4A3A57558410FE1885528CB728920EB90

Function 6D19FED5 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

ReadConsoleInputW.KERNEL32(0000000C,6D20F818,6D191688,00000000,?,6D19170C,?,00000001,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D19FEEA
GetLastError.KERNEL32(?,6D19170C,?,00000001,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D19FEF6

Part of subcall function 6D1A006A: CloseHandle.KERNEL32(FFFFFFFF,6D19FF52,?,?,6D191920,0000000C,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A007A

___initconin.LIBCMT ref: 6D19FF06

Part of subcall function 6D1A004B: CreateFileW.KERNEL32(CONIN$,C0000000,00000003,00000000,00000003,00000000,00000000,6D19FEC6,6D19190F,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A005E

ReadConsoleInputW.KERNEL32(0000000C,6D20F818,6D191688,?,6D19170C,?,00000001,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D19FF1A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ConsoleInputRead$CloseCreateErrorFileHandleLast___initconin
String ID:
API String ID: 838051604-0
Opcode ID: 1cd75478e88af637e77fbc1d853e269d8df65c9927f50beaf05cff9b3b844ed3
Instruction ID: 999f6c6a7d31e4979e7cd10b404c8d9addc609aa3f15b2ed244bceb2bd4d9454
Opcode Fuzzy Hash: 1cd75478e88af637e77fbc1d853e269d8df65c9927f50beaf05cff9b3b844ed3
Instruction Fuzzy Hash: BDF0303B401015BB8F121FE1DC08ADE3FB7FF4B3A17458110FA1885128CB728920EB80

Function 6D182201 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000001), ref: 6D182213
GetCurrentThreadId.KERNEL32 ref: 6D182222
GetCurrentProcessId.KERNEL32 ref: 6D18222B
QueryPerformanceCounter.KERNEL32(?), ref: 6D182238

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: aaa323b64eea8351837f618d6df4030b575b3ef08a097a8382265a9b51bd32aa
Instruction ID: 39f31875c60a1b29027c2a0707e61b99e26b049b92d41beca83bdbf7fa8b4006
Opcode Fuzzy Hash: aaa323b64eea8351837f618d6df4030b575b3ef08a097a8382265a9b51bd32aa
Instruction Fuzzy Hash: 66F06274D1020DEBCF00DBB4E689A9EBBF5FF1D200B918996A412F7100E770AB44EB50

Function 6D179F31 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 6D05BF75: ShowWindow.USER32(?,00000000,?,?,6D05975A,00000000), ref: 6D05BF86

UpdateWindow.USER32(?), ref: 6D179F58
UpdateWindow.USER32(?), ref: 6D179F6B
SetRectEmpty.USER32(?), ref: 6D179F78
SetRectEmpty.USER32(?), ref: 6D179F85

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Window$EmptyRectUpdate$Show
String ID:
API String ID: 1262231214-0
Opcode ID: d6a1d93e15e10615f8de6692e807334da5e8e3a707ffa2ca0a318ac68983d53a
Instruction ID: da8e1f8f168e7bef2f22c6a22171eeeaf33802fa4931d21853ac1eab815a1c20
Opcode Fuzzy Hash: d6a1d93e15e10615f8de6692e807334da5e8e3a707ffa2ca0a318ac68983d53a
Instruction Fuzzy Hash: A6F05831204712DFEB208B31E848B9A7BF9BB45241F11845AB09AC21A0DBB0A408CF50

Function 6D1A0005 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNEL32(0000000C,00000000,?,6D1916F3,00000000,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D1A0014
GetLastError.KERNEL32(?,6D1916F3,00000000,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D1A0020

Part of subcall function 6D1A006A: CloseHandle.KERNEL32(FFFFFFFF,6D19FF52,?,?,6D191920,0000000C,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A007A

___initconin.LIBCMT ref: 6D1A0030

Part of subcall function 6D1A004B: CreateFileW.KERNEL32(CONIN$,C0000000,00000003,00000000,00000003,00000000,00000000,6D19FEC6,6D19190F,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A005E

SetConsoleMode.KERNEL32(0000000C,?,6D1916F3,00000000,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D1A003E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ConsoleMode$CloseCreateErrorFileHandleLast___initconin
String ID:
API String ID: 3067319862-0
Opcode ID: b66bf49f42da22a03abd04ab55828fa9f69521a21cf3881e4b7ee85058e6f3e6
Instruction ID: 758afa5428c1296274ae8a02a1264f3a3ae26bcbe5710b42d4ef759caca935b8
Opcode Fuzzy Hash: b66bf49f42da22a03abd04ab55828fa9f69521a21cf3881e4b7ee85058e6f3e6
Instruction Fuzzy Hash: 98E04F3A5051256B8F212BE6EC4978A3EB6FB0A3E57464010FA1D82518DBA6C810EBD1

Function 6D19FF27 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetNumberOfConsoleInputEvents.KERNEL32(?,?,?,6D191920,0000000C,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D19FF36
GetLastError.KERNEL32(?,?,6D191920,0000000C,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D19FF42

Part of subcall function 6D1A006A: CloseHandle.KERNEL32(FFFFFFFF,6D19FF52,?,?,6D191920,0000000C,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A007A

___initconin.LIBCMT ref: 6D19FF52

Part of subcall function 6D1A004B: CreateFileW.KERNEL32(CONIN$,C0000000,00000003,00000000,00000003,00000000,00000000,6D19FEC6,6D19190F,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A005E

GetNumberOfConsoleInputEvents.KERNEL32(?,?,?,6D191920,0000000C,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D19FF60

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ConsoleEventsInputNumber$CloseCreateErrorFileHandleLast___initconin
String ID:
API String ID: 1600138625-0
Opcode ID: b85e3c2479114b34f5353da2634f09371a3c32eae632f153dbfa723c6529b22a
Instruction ID: 8cbd0e2d14eae9b059dafc7327567d286704cbd67cfc387e0bd8b113d716dd89
Opcode Fuzzy Hash: b85e3c2479114b34f5353da2634f09371a3c32eae632f153dbfa723c6529b22a
Instruction Fuzzy Hash: 00E04F369041246B8F212BE9EC0978A7EB6EF473A57454514FA18C6518CFB28850EBD1

Function 6D19FFBF Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(0000000C,?,?,6D1916EB,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D19FFCE
GetLastError.KERNEL32(?,?,6D1916EB,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D19FFDA

Part of subcall function 6D1A006A: CloseHandle.KERNEL32(FFFFFFFF,6D19FF52,?,?,6D191920,0000000C,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A007A

___initconin.LIBCMT ref: 6D19FFEA

Part of subcall function 6D1A004B: CreateFileW.KERNEL32(CONIN$,C0000000,00000003,00000000,00000003,00000000,00000000,6D19FEC6,6D19190F,?,?,?,6D191638,6D20F7F8,0000000C,6D014C57), ref: 6D1A005E

GetConsoleMode.KERNEL32(0000000C,?,?,6D1916EB,?,6D20F838,00000038,6D191688,6D20F818,0000000C,6D014C65), ref: 6D19FFF8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ConsoleMode$CloseCreateErrorFileHandleLast___initconin
String ID:
API String ID: 3067319862-0
Opcode ID: e944c42a81bce9bf587a11e3e28fd859f6dede74bad779379b9fdd309308cfdb
Instruction ID: fe219e66d2088ed31a6bd21049144376a5e77e61cc3879f8f63741d4e387a72e
Opcode Fuzzy Hash: e944c42a81bce9bf587a11e3e28fd859f6dede74bad779379b9fdd309308cfdb
Instruction Fuzzy Hash: 8DE04F3A5041246B8F212BE6EC0978A7EBAEB063E5B458111FA09C2518CBB28810EBD0

Function 6D05CDD3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6D05CF75

Strings

-, xrefs: 6D05CFA3
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 6D05CEA0, 6D05CEA5, 6D05CEC1, 6D05CEF6, 6D05CEFB

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: b3dd1bc93fc07ffcc634614a74884d3130daaa1c5e2da3481d0e345f3871cec6
Instruction ID: a819709a6d7f938b13701096b7ca1aa3e7b939c98bb2c52d81e0f827c3bda184
Opcode Fuzzy Hash: b3dd1bc93fc07ffcc634614a74884d3130daaa1c5e2da3481d0e345f3871cec6
Instruction Fuzzy Hash: E0610874E4824A9FFF11CFAAC9807BEBBF5AF45300F108059EC50A7240D37489A2CB65

Function 6D1A5189 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6D199693: GetLastError.KERNEL32(?,?,6D196272,?,6D0154A7), ref: 6D199697
Part of subcall function 6D199693: SetLastError.KERNEL32(00000000,?,6D0154A7), ref: 6D199739

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,6D199FC8,?,?,?,00000055,?,-00000050,?,?,?), ref: 6D1A5248
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,6D199FC8,?,?,?,00000055,?,-00000050,?,?), ref: 6D1A527F

Strings

utf8, xrefs: 6D1A5351

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: f4801fcdeb945842ae0e8da1d4e899ee30250ee4280ba098de18317013800f47
Instruction ID: 809f14a7d019d74d3ae4b8fd594a90d21163d26e6238f6a463ffb61048d15001
Opcode Fuzzy Hash: f4801fcdeb945842ae0e8da1d4e899ee30250ee4280ba098de18317013800f47
Instruction Fuzzy Hash: F7512779A0C702EAF715AB70CC81BBB33B8FF55744F09482AE6159B188F7F0E5408661

Function 6D068660 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D068667
CoCreateGuid.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 6D0686C2

Strings

%08lX%04X%04x%02X%02X%02X%02X%02X%02X%02X%02X, xrefs: 6D06870C

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CreateGuidH_prolog3_
String ID: %08lX%04X%04x%02X%02X%02X%02X%02X%02X%02X%02X
API String ID: 2971167768-1017209998
Opcode ID: 33ecca5c9a71bb12b53b65d645c681e89704cb82f9973e7d813e18cc8301db12
Instruction ID: 858a933bafeb8980b30059f3d98c93981057ec2ad2da24301b557b2503753df8
Opcode Fuzzy Hash: 33ecca5c9a71bb12b53b65d645c681e89704cb82f9973e7d813e18cc8301db12
Instruction Fuzzy Hash: 5C418F72904159AFDB11DFA8C954BFEBBFDAF0A214F054069E641B7281CB789E05CB60

Function 6D0BE360 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D0BE367
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,?,00000008,6D070757,?,MFCToolBars,?,000000A8), ref: 6D0BE4B2

Strings

SOFTWARE\, xrefs: 6D0BE3DC, 6D0BE3E8

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: H_prolog3QueryValue
String ID: SOFTWARE\
API String ID: 2373586757-3302998844
Opcode ID: 6d2ad7b4f8b48e6f667878798668f5ed65b839d865e4d80f92783fdf7b9fd012
Instruction ID: bbe6c4df653fb41be865208b73389cd1a9ff1b3aa105edefc54ca4c7c2e21d49
Opcode Fuzzy Hash: 6d2ad7b4f8b48e6f667878798668f5ed65b839d865e4d80f92783fdf7b9fd012
Instruction Fuzzy Hash: 8331CE70A08105EBFB04DB64CC84F7EB7ADEF44208F068059EA01AB2A4CBB48D40DB51

Function 6D198EC3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,6D198DC4,?,?,00000000,00000000,00000000,?), ref: 6D198EE8

Strings

MOC, xrefs: 6D198EFA
RCC, xrefs: 6D198F02

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 67dbbea7455e189ed98c9ba8cf9de043463ceb0e576b63fcc6ef04ff4aff4d67
Instruction ID: 828c8c1ec034554fccc3cccc479d65393095cae83e80358960ee04e4cc5d1dab
Opcode Fuzzy Hash: 67dbbea7455e189ed98c9ba8cf9de043463ceb0e576b63fcc6ef04ff4aff4d67
Instruction Fuzzy Hash: E341797190420AAFCF06CF94CC80AEEBBB6FF48304F158059FA15AB269D3B5E950DB50

Function 6D05862E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000111,0000E146,00000000), ref: 6D0586B5
GetActiveWindow.USER32 ref: 6D058772

Strings

,}!m, xrefs: 6D0586EF

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ActiveMessageSendWindow
String ID: ,}!m
API String ID: 2084165996-672480415
Opcode ID: 9e34c13023d9160faa6eaa0f3de9f789088bfb991b350c0c57d6436829a9bd11
Instruction ID: ece1eb8034d57b010013943fccc0244fff85d83d88d229c0d61f72caeeb21de6
Opcode Fuzzy Hash: 9e34c13023d9160faa6eaa0f3de9f789088bfb991b350c0c57d6436829a9bd11
Instruction Fuzzy Hash: C631ED3262820BDBFF118F64CB44BA932F4BF48349F114438DE689B190EBB0D865DB61

Function 6D049FB4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 6D04A078
PathFindExtensionW.SHLWAPI(?,?), ref: 6D04A08E

Strings

%Ts%Ts.dll, xrefs: 6D04A09B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ExtensionFileFindModuleNamePath
String ID: %Ts%Ts.dll
API String ID: 2295281026-1896370695
Opcode ID: 8877b5004ec18d1a85ad5d9a0b1387dfa4e1537aef8f820fa5ed21e2c073f9c5
Instruction ID: eb8a748ddd82db170674ce9731dcba6b6dc737748aa45d13f9d60ea461fed559
Opcode Fuzzy Hash: 8877b5004ec18d1a85ad5d9a0b1387dfa4e1537aef8f820fa5ed21e2c073f9c5
Instruction Fuzzy Hash: 4031F331600016EBEB119A68DE88FBFB7E9FF49318B11807AE9159B240DB65E905C791

Function 6D19872F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6D1989A6

Strings

csm, xrefs: 6D1989C8
csm, xrefs: 6D198A39

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 84928eb96c97180e5e2d455289ba4f79c1a535492e616effbec90ff806f25384
Instruction ID: c49f311422e8dfa8ed5f6056c72516da3eb986ce2f62681b5e1b9ded98b34ee8
Opcode Fuzzy Hash: 84928eb96c97180e5e2d455289ba4f79c1a535492e616effbec90ff806f25384
Instruction Fuzzy Hash: A531343640421ADFCF128F90CC409AA3F65FF59318B04815AFE590D125C3F7D862DBA2

Function 6D01C260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D01C29D

Part of subcall function 6D019C10: std::_Lockit::_Lockit.LIBCPMT ref: 6D019C3C
Part of subcall function 6D019C10: std::_Lockit::~_Lockit.LIBCPMT ref: 6D019C82

std::_Lockit::~_Lockit.LIBCPMT ref: 6D01C399

Strings

@^!m, xrefs: 6D01C2AD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: @^!m
API String ID: 593203224-1676577949
Opcode ID: a84fb24331f295bda14dd6acffddf25477d45fee3e0a8a80377a45fa08d168c0
Instruction ID: 54782ef016d762c4ee5bea9e0899e04982cdfa42c680d7a49d9f99c69f406ae7
Opcode Fuzzy Hash: a84fb24331f295bda14dd6acffddf25477d45fee3e0a8a80377a45fa08d168c0
Instruction Fuzzy Hash: EB41D2B4E18208DFDB04DFA8D985BEDBBF1BB09314F108129E822A7350D731A904CFA5

Function 6D02B9C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D02B9FD

Part of subcall function 6D019C10: std::_Lockit::_Lockit.LIBCPMT ref: 6D019C3C
Part of subcall function 6D019C10: std::_Lockit::~_Lockit.LIBCPMT ref: 6D019C82

std::_Lockit::~_Lockit.LIBCPMT ref: 6D02BAF9

Strings

d^!m, xrefs: 6D02BA0D

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: d^!m
API String ID: 593203224-1287566580
Opcode ID: 50038d473d0e0c7be51fd15cf030e3822f772f2b806b321aaf24b04a1631593d
Instruction ID: 86fafb2f5fc11f05bc61d536ce8d3c1115cff188df9f4f6ec6baaca3d931faa1
Opcode Fuzzy Hash: 50038d473d0e0c7be51fd15cf030e3822f772f2b806b321aaf24b04a1631593d
Instruction Fuzzy Hash: 8641C2B4E15208DFDB05DFA8D985BEDBBF0BB09314F108169E922A7354DB31A944CFA1

Function 6D019890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6D0198CD

Part of subcall function 6D019C10: std::_Lockit::_Lockit.LIBCPMT ref: 6D019C3C
Part of subcall function 6D019C10: std::_Lockit::~_Lockit.LIBCPMT ref: 6D019C82

std::_Lockit::~_Lockit.LIBCPMT ref: 6D0199C9

Strings

<^!m, xrefs: 6D0198DD

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: <^!m
API String ID: 593203224-1107792825
Opcode ID: 7e1d1c1f03c480ae67b299fe261a65ffc41b3836482c032d7678e92aad44b3c3
Instruction ID: 02c30dca6d8ca4d44a8db3168dcb00ac1d5820ecc860304752dda00d3ce5c484
Opcode Fuzzy Hash: 7e1d1c1f03c480ae67b299fe261a65ffc41b3836482c032d7678e92aad44b3c3
Instruction Fuzzy Hash: 6941D474E18208DFDB05DFA8E981BDDBBF0BB09314F108129E921A7390D774A944CFA1

Function 6D05AC36 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6D05ADD9: RegCloseKey.ADVAPI32(00000000,?,?,?,?,6D05A808,?,00000000), ref: 6D05AE1E

RegSetValueExW.ADVAPI32(00000000,?,00000000,00000003,?,?,?,00000000), ref: 6D05AC68
RegCloseKey.ADVAPI32(00000000), ref: 6D05AC71

Strings

A, xrefs: 6D05ACAB

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Close$Value
String ID: A
API String ID: 299128501-3554254475
Opcode ID: 626acef01b2068a97630451c6d129e02b6f63aef5182da7d9cee49310f4ca883
Instruction ID: 4b59910a7f45db221cf86eef0d2d19ff7c784fa71662f90335459af6490e4186
Opcode Fuzzy Hash: 626acef01b2068a97630451c6d129e02b6f63aef5182da7d9cee49310f4ca883
Instruction Fuzzy Hash: 7E212436500125ABDF059F68D849FAE7FB5EF09260F208029FD059B250EB32DC52D760

Function 6D05F57F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32(?,?), ref: 6D05F5EC
CopyRect.USER32(?,?), ref: 6D05F5FE

Part of subcall function 6D040987: __EH_prolog3.LIBCMT ref: 6D04098E

Strings

(, xrefs: 6D05F5E5

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CopyH_prolog3InfoMonitorRect
String ID: (
API String ID: 76778085-3887548279
Opcode ID: a88896a82cd121fb8201c1baaa0d51c318e602bb7dd41ac4b2e74990b298f151
Instruction ID: a05e264031efc5cbcf8f971a2b2a857a4be133d48739ec42ebdb54692cb27068
Opcode Fuzzy Hash: a88896a82cd121fb8201c1baaa0d51c318e602bb7dd41ac4b2e74990b298f151
Instruction Fuzzy Hash: C9212C71904609DFDB10DFA9D944A9EB7F8FF08314B10882DE996E3290EB74EE50DB51

Function 6D06E138 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6D06E13F
SetRectEmpty.USER32(?), ref: 6D06E1CF

Strings

Afx:ToolBar, xrefs: 6D06E1DA

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: EmptyH_prolog3_Rect
String ID: Afx:ToolBar
API String ID: 2941628838-177727192
Opcode ID: 1420ab2e85fb1f7ea5b26d6fa8d641c737d82e4c8a631ac50c1a7bbded7eb4e9
Instruction ID: 37b30c28c49cc89a1dd2810504e7e62ef902515ee93df23453adf9b775ade184
Opcode Fuzzy Hash: 1420ab2e85fb1f7ea5b26d6fa8d641c737d82e4c8a631ac50c1a7bbded7eb4e9
Instruction Fuzzy Hash: C121AE31A042199BDF08CF78C995AED7BE5BF48314F16422DF915E7280DB74AD508BA4

Function 6D05F482 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000014), ref: 6D05F4F0
CreateDIBitmap.GDI32(?,00000028,00000004,?,00000028,00000000), ref: 6D05F569

Strings

(, xrefs: 6D05F4D4

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: BitmapColorCreate
String ID: (
API String ID: 2048008349-3887548279
Opcode ID: 6061f84ccd37bcd5b11516492050c0c478b5b1514fa576e42527d745fe52d46e
Instruction ID: dd7b59e28c50e12edc760683514b0005720374bf59427322214f5c219603f382
Opcode Fuzzy Hash: 6061f84ccd37bcd5b11516492050c0c478b5b1514fa576e42527d745fe52d46e
Instruction Fuzzy Hash: FC21D52090138CDAEB11CFB8D846BEDBBB8BF19345F008159EA44F7182EF745A48CB65

Function 6D04E63B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 6D04E6C8

Strings

,}!m, xrefs: 6D04E63E

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CallProcWindow
String ID: ,}!m
API String ID: 2714655100-672480415
Opcode ID: 8d55ca76f08caa4d448dcca918837f8c1a7d9944bae6596d808705cd068d66bd
Instruction ID: 4a52cdee483449ad066e39814d6071deb9cff8c3d51933ef291ad5a5899b8d94
Opcode Fuzzy Hash: 8d55ca76f08caa4d448dcca918837f8c1a7d9944bae6596d808705cd068d66bd
Instruction Fuzzy Hash: DD11543520010AEBDF059F54DC04FADBF76FF8A361B148069F91587620EB31D820DB90

Function 6D093A01 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6D093A08
FindResourceW.KERNEL32(?,?,STYLE_XML,?,?,00000004,6D05F373,?,00000000), ref: 6D093A46

Strings

STYLE_XML, xrefs: 6D093A3A

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: FindH_prolog3Resource
String ID: STYLE_XML
API String ID: 3036663282-3909253476
Opcode ID: c46e59a503d5a58dc1fd916bcc1f21624eda462a9c20a8e8113ed62aa2adea87
Instruction ID: 352729ad53aa7690c027d159b171c9a505d1c38c34dc89a1b050086ce70f32f6
Opcode Fuzzy Hash: c46e59a503d5a58dc1fd916bcc1f21624eda462a9c20a8e8113ed62aa2adea87
Instruction Fuzzy Hash: 57F0F0B19081069BEB01EFB4CC44BBFB6B8FF4A3187099205E739AB154CB748911DF21

Function 6D04FAED Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6D04FB15
SetWindowsHookExW.USER32(00000005,6D04F093,00000000,00000000), ref: 6D04FB25

Strings

,}!m, xrefs: 6D04FAF7

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID: ,}!m
API String ID: 1904029216-672480415
Opcode ID: 0a6836c6df1d2a9bc18afa1c469b2ec0f00b0c45cc3413a32eb8fd1767bfe7c3
Instruction ID: 204f1ab0b79068568a0d9a6f308434b3050aec0da4d171bc2265b6f0150b60fa
Opcode Fuzzy Hash: 0a6836c6df1d2a9bc18afa1c469b2ec0f00b0c45cc3413a32eb8fd1767bfe7c3
Instruction Fuzzy Hash: BAF0E231984B06D7E3200AA6A914F3ABAECCB81752F108139EB198B540DB70D401C6F2

Function 6D04058B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6D216028,00000004,00000000,?,6D01775D,6D0176A9,?,?,6D0174AC), ref: 6D040596
ReleaseSRWLockExclusive.KERNEL32(6D216028,?,6D01775D,6D0176A9,?,?,6D0174AC), ref: 6D0405D0

Strings

(`!m, xrefs: 6D040590

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: (`!m
API String ID: 17069307-3012140011
Opcode ID: 5492c4cc65c4cde4bb8b152be8a7931ec682cef91bfb0d80a2df166382ac96bf
Instruction ID: 4ecd087524bb8756577698b2ea6054d45e3891df8a140f6bfc9481de432f1d14
Opcode Fuzzy Hash: 5492c4cc65c4cde4bb8b152be8a7931ec682cef91bfb0d80a2df166382ac96bf
Instruction Fuzzy Hash: D0F08234108506CFD7109F56D544F6ABBF4FB97335F11823EE9A5532C0CB301441CA51

Function 6D04AD2B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20windowtimeCOMMON

Download Yara Rule

APIs

GetMessageTime.USER32 ref: 6D04AD41
GetMessagePos.USER32 ref: 6D04AD4A

Strings

,}!m, xrefs: 6D04AD31

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: Message$Time
String ID: ,}!m
API String ID: 4026574468-672480415
Opcode ID: 2111fefa090e6b869f2cad8c3ab079ce6d16ea70323ee32a58259c9c89d7847c
Instruction ID: 3c392426c42d082917501125bc755291f7b9d1dff83cd26edbc0376b400cdb4d
Opcode Fuzzy Hash: 2111fefa090e6b869f2cad8c3ab079ce6d16ea70323ee32a58259c9c89d7847c
Instruction Fuzzy Hash: 75E08635C08B55CFD7249F71A45877B7AE0EA40262301496DC9838BB00FB31D841CA51

Function 6D0634A0 Relevance: 5.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D2183D0,?,?,0000007C,?,6D04F858,00000001), ref: 6D0634D1
InitializeCriticalSection.KERNEL32(00000000,?,6D04F858,00000001), ref: 6D0634E7
LeaveCriticalSection.KERNEL32(6D2183D0,?,6D04F858,00000001), ref: 6D0634F5
EnterCriticalSection.KERNEL32(00000000,?,0000007C,?,6D04F858,00000001), ref: 6D063502

Part of subcall function 6D063538: InitializeCriticalSection.KERNEL32(6D2183D0,?,0000007C,?,6D04F858,00000001), ref: 6D063550

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-0
Opcode ID: 0abaf92de6f572267561b3050d9921722281e5be282f45309aab9c5bdd8294fd
Instruction ID: 721dab49dd5e2028368f0323336dc79ee31ea6f1afb5582cf17fdf8ca968284c
Opcode Fuzzy Hash: 0abaf92de6f572267561b3050d9921722281e5be282f45309aab9c5bdd8294fd
Instruction Fuzzy Hash: 27F0F673804219BBEA001B58ECCD75AF6BDFB4B356F984026F64292101DB75E801D9E2

Function 6D0656D6 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6D2184A0,?,?,?,?,6D0657FB,00000000,00000004,6D056FBF,6D0510D4,6D05AF16,?,6D04F4BB), ref: 6D0656E2
TlsGetValue.KERNEL32(6D218484,?,?,?,?,6D0657FB,00000000,00000004,6D056FBF,6D0510D4,6D05AF16,?,6D04F4BB), ref: 6D0656F6
LeaveCriticalSection.KERNEL32(6D2184A0,?,?,?,?,6D0657FB,00000000,00000004,6D056FBF,6D0510D4,6D05AF16,?,6D04F4BB), ref: 6D065710
LeaveCriticalSection.KERNEL32(6D2184A0,?,?,?,?,6D0657FB,00000000,00000004,6D056FBF,6D0510D4,6D05AF16,?,6D04F4BB), ref: 6D06571B

Memory Dump Source

Source File: 00000003.00000002.2073545249.000000006D011000.00000020.00000001.01000000.00000003.sdmp, Offset: 6D010000, based on PE: true

Associated: 00000003.00000002.2073521367.000000006D010000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073747542.000000006D1BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073810182.000000006D210000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073831631.000000006D213000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D215000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073860345.000000006D217000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2073905439.000000006D21D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6d010000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 8b47dab051a52e02c991d57768048e499c5edb84af400fcb16f364f09ef33ee1
Instruction ID: 97ef020cc1c7babfd0ca9bc276a34bd67eed05210adbccc2629ac76c1103a9d1
Opcode Fuzzy Hash: 8b47dab051a52e02c991d57768048e499c5edb84af400fcb16f364f09ef33ee1
Instruction Fuzzy Hash: 70F0B43A219515DFEB105F35F8CCB6AF7B8FE453613058016E812A7102C770F8068AF0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0644F7 ScreenToClient,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,		3_2_6D0644F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D04D23E GetKeyState,GetKeyState,GetKeyState,SendMessageW,		3_2_6D04D23E

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D0200A0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,	3_2_6D0200A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D01FDE0 CryptStringToBinaryA,CryptStringToBinaryA,	3_2_6D01FDE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6D021100 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptSetKeyParam,CryptDestroyKey,CryptReleaseContext,CryptSetKeyParam,CryptDestroyKey,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,CryptReleaseContext,CryptDestroyKey,CryptReleaseContext,	3_2_6D021100

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nsdksetup.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\PolicyManagement.xml

C:\Users\user\AppData\Local\Temp\backup.exe

C:\Users\user\AppData\Local\Temp\monitor.bat

C:\Users\user\AppData\Local\Temp\monitor.pid

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

DNS Answers

Statistics

Windows Analysis Report
nsdksetup.dll

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre