Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
TsLvuUO.dll

Overview

General Information

Sample name:TsLvuUO.dll
Analysis ID:1502267
MD5:edd94a0a267df670b90f41c127f9dd6a
SHA1:bd0005769a9392a922030793b1e88900a808f22a
SHA256:00db74544ae4d92774a3008a5ee322577dab2a53bcb2eb9003e88af617f3b495
Tags:dll
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
AI detected suspicious sample
Overwrites Mozilla Firefox settings
Performs DNS queries to domains with low reputation
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Too many similar processes found
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 1408 cmdline: loaddll32.exe "C:\Users\user\Desktop\TsLvuUO.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)
    • conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6552 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • rundll32.exe (PID: 6544 cmdline: rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)
    • rundll32.exe (PID: 7160 cmdline: rundll32.exe C:\Users\user\Desktop\TsLvuUO.dll,#1 MD5: 889B99C52A60DD49227C5E485A016679)
      • schtasks.exe (PID: 3620 cmdline: schtasks /END /TN "WYKSCfYVrwsdWpT" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5408 cmdline: schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 2700 cmdline: schtasks /END /TN "WYKSCfYVrwsdWpT2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 2640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4476 cmdline: schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4180 cmdline: schtasks /END /TN "nfblQVJFwWHDFj" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 3172 cmdline: schtasks /DELETE /F /TN "nfblQVJFwWHDFj" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 7060 cmdline: schtasks /END /TN "YGYYnsbMowvpr" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 1216 cmdline: schtasks /DELETE /F /TN "YGYYnsbMowvpr" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 2072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 3128 cmdline: schtasks /END /TN "YGYYnsbMowvpr2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 2104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 3620 cmdline: schtasks /DELETE /F /TN "YGYYnsbMowvpr2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5408 cmdline: schtasks /END /TN "SfQlcfTRPgaddFhgU" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 7044 cmdline: schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 2640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5612 cmdline: schtasks /END /TN "SfQlcfTRPgaddFhgU2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 6456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4024 cmdline: schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 2940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 3664 cmdline: schtasks /END /TN "MBOKUVJttHMBWpgjMbJ" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6096 cmdline: schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 2748 cmdline: schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 2072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6804 cmdline: schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 2104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • rundll32.exe (PID: 2300 cmdline: rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)
      • schtasks.exe (PID: 2640 cmdline: schtasks /END /TN "WYKSCfYVrwsdWpT" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 4332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5628 cmdline: schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 1876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5440 cmdline: schtasks /END /TN "WYKSCfYVrwsdWpT2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6780 cmdline: schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 3664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4484 cmdline: schtasks /END /TN "nfblQVJFwWHDFj" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 6688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6020 cmdline: schtasks /DELETE /F /TN "nfblQVJFwWHDFj" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 3128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6628 cmdline: schtasks /END /TN "YGYYnsbMowvpr" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5584 cmdline: schtasks /DELETE /F /TN "YGYYnsbMowvpr" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 2700 cmdline: schtasks /END /TN "YGYYnsbMowvpr2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5064 cmdline: schtasks /DELETE /F /TN "YGYYnsbMowvpr2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5888 cmdline: schtasks /END /TN "SfQlcfTRPgaddFhgU" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 1644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 6048 cmdline: schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 5252 cmdline: schtasks /END /TN "SfQlcfTRPgaddFhgU2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 3924 cmdline: schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 6444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 2072 cmdline: schtasks /END /TN "MBOKUVJttHMBWpgjMbJ" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 5800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4696 cmdline: schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • schtasks.exe (PID: 4708 cmdline: schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2" MD5: 48C2FE20575769DE916F48EF0676A965)
        • conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: TsLvuUO.dllAvira: detected
Antivirus detection for URL or domain
Source: http://api2.check-data.xyzAvira URL Cloud: Label: malware
Source: http://api4.check-data.xyz/api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/97D99714-22C7-D2AF-3668-2A796B33DC65Avira URL Cloud: Label: malware
Source: http://api4.check-data.xyz/api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzrAvira URL Cloud: Label: malware
Source: http://api4.check-data.xyz/api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/1D5E65EB-947C-7A0A-9CCF-076D85CAD35EAvira URL Cloud: Label: malware
Source: http://api4.check-data.xyzAvira URL Cloud: Label: malware
Source: http://api5.check-data.xyzAvira URL Cloud: Label: malware
Source: http://api.check-data.xyzAvira URL Cloud: Label: malware
Source: http://api3.check-data.xyzAvira URL Cloud: Label: malware
Source: http://api4.check-data.xyz/api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzrAvira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: api4.check-data.xyzVirustotal: Detection: 6%Perma Link
Source: http://api4.check-data.xyzVirustotal: Detection: 6%Perma Link
Source: http://api2.check-data.xyzVirustotal: Detection: 10%Perma Link
Source: http://api5.check-data.xyzVirustotal: Detection: 6%Perma Link
Source: http://api.check-data.xyzVirustotal: Detection: 6%Perma Link
Source: http://api3.check-data.xyzVirustotal: Detection: 9%Perma Link
Multi AV Scanner detection for submitted file
Source: TsLvuUO.dllReversingLabs: Detection: 31%
Source: TsLvuUO.dllVirustotal: Detection: 44%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 92.2% probability
Source: TsLvuUO.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ProfilesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\userJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\FirefoxJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\MozillaJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\LocalJump to behavior

Networking

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 44.232.42.242 80Jump to behavior
Performs DNS queries to domains with low reputation
Source: DNS query: api4.check-data.xyz
Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
Source: global trafficHTTP traffic detected: GET /api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/97D99714-22C7-D2AF-3668-2A796B33DC65 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36Host: api4.check-data.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/1D5E65EB-947C-7A0A-9CCF-076D85CAD35E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36Host: api4.check-data.xyzConnection: Keep-AliveCache-Control: no-cache
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/97D99714-22C7-D2AF-3668-2A796B33DC65 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36Host: api4.check-data.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global trafficHTTP traffic detected: GET /api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/1D5E65EB-947C-7A0A-9CCF-076D85CAD35E HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36Host: api4.check-data.xyzConnection: Keep-AliveCache-Control: no-cache
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291908337.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: *://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291908337.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: *://www.facebook.com/platform/impression.php*! equals www.facebook.com (Facebook)
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291908337.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: *://www.facebook.com/platform/impression.php*( equals www.facebook.com (Facebook)
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291908337.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: *://www.facebook.com/platform/impression.php*xW equals www.facebook.com (Facebook)
Source: global trafficDNS traffic detected: DNS query: api4.check-data.xyz
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api.check-data.xyz
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api2.check-data.xyz
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api3.check-data.xyz
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api4.check-data.xyz
Source: rundll32.exe, 00000003.00000002.2224250627.00000000034EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api4.check-data.xyz/api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr
Source: rundll32.exe, 00000006.00000002.2291425440.000000000319C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291908337.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283310545.00000000031CB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291506390.00000000031D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api4.check-data.xyz/api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://api5.check-data.xyz
Source: rundll32.exe, 00000003.00000003.2211108860.00000000034D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
Source: rundll32.exe, 00000003.00000003.2223174899.00000000034EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2224250627.00000000034EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291506390.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283310545.00000000031CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: rundll32.exe, 00000003.00000003.2212333363.000000000351D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283192574.0000000004CB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283339215.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282828895.0000000004C98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282587225.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282330261.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291455240.00000000031BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: prefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: prefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
Source: rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore/
Source: rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
Source: rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281413884.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281539995.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2265993673.00000000031AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282330261.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266367276.00000000031CB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: rundll32.exe, 00000006.00000003.2282587225.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281413884.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281539995.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282330261.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crxW
Source: prefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: prefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drString found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: rundll32.exe, 00000003.00000003.2212333363.000000000351D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283192574.0000000004CB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283339215.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282828895.0000000004C98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282587225.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282330261.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291455240.00000000031BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: rundll32.exe, 00000003.00000003.2195972684.00000000034D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.google.co
Source: rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-autopush.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-0.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-1.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2266015010.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2265993673.00000000031AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-2.c
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-2.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-4.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-5.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-6.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-preprod.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive-staging.corp.google.com/
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
Source: rundll32.exe, 00000006.00000003.2290120533.0000000003161000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291382323.0000000003165000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290784410.0000000003161000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
Source: rundll32.exe, 00000006.00000003.2290120533.0000000003161000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291382323.0000000003165000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290784410.0000000003161000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: rundll32.exe, 00000003.00000003.2212333363.000000000351D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283192574.0000000004CB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283339215.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282828895.0000000004C98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282587225.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282330261.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291455240.00000000031BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/releases/mozilla-release
Source: prefs.js_tempnwhObf.3.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2265993673.00000000031AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280879303.00000000031CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://payments.google.com/
Source: rundll32.exe, 00000003.00000003.2210033495.00000000034D9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2196383980.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280879303.00000000031CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sandbox.google.com/
Source: rundll32.exe, 00000003.00000003.2210033495.00000000034D9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2196383980.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290120533.000000000311F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290221613.000000000312B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291320377.000000000312E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290544375.000000000312E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: rundll32.exe, 00000006.00000003.2282774739.00000000031D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
Source: rundll32.exe, 00000006.00000003.2290120533.0000000003161000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291382323.0000000003165000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290784410.0000000003161000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixeli
Source: prefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291908337.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: prefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drString found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: rundll32.exe, 00000006.00000003.2266015010.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2265993673.00000000031AE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/m/
Source: rundll32.exe, 00000003.00000003.2195972684.00000000034D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/s/
Source: rundll32.exe, 00000006.00000003.2280879303.00000000031CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281226958.0000000004D62000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
Source: rundll32.exe, 00000003.00000003.2210033495.00000000034D9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2196383980.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2195972684.00000000034D7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: rundll32.exe, 00000003.00000003.2210033495.00000000034D9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2196383980.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290120533.000000000311F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290221613.000000000312B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291320377.000000000312E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290544375.000000000312E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: rundll32.exe, 00000003.00000003.2195972684.00000000034D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/chromewebstore7
Source: rundll32.exe, 00000003.00000003.2210033495.00000000034D9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2210277018.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2196383980.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2210033495.00000000034EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2195972684.00000000034D7000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280879303.00000000031CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/sierra
Source: rundll32.exe, 00000006.00000003.2280651031.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280879303.00000000031CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/sierraF
Source: rundll32.exe, 00000003.00000003.2195972684.00000000034D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/sierraX
Source: rundll32.exe, 00000003.00000003.2210033495.00000000034D9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2196383980.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: rundll32.exe, 00000003.00000003.2223174899.00000000034A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2211108860.00000000034D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2212784001.00000000034D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2224250627.00000000034A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281168576.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280948948.00000000031D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281226958.0000000004D4B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282427984.00000000031CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283310545.00000000031CB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291506390.00000000031D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280879303.00000000031CF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282774739.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/chromewebstore/v1.1/items/verify
Source: rundll32.exe, 00000003.00000003.2223174899.00000000034A2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2211108860.00000000034D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2212784001.00000000034D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2224250627.00000000034A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/chromewebstore/v1.1/items/verify(
Source: rundll32.exe, 00000006.00000003.2281226958.0000000004D4B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/chromewebstore/v1.1/items/verifyl
Source: schtasks.exeProcess created: 53
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033EC7863_2_033EC786
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E25BB3_2_033E25BB
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E45903_2_033E4590
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E4BDD3_2_033E4BDD
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E7A3F3_2_033E7A3F
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0340A2423_2_0340A242
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033F42133_2_033F4213
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FA2E03_2_033FA2E0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033F32C03_2_033F32C0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FB1F23_2_033FB1F2
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E80603_2_033E8060
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0340975E3_2_0340975E
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FB6273_2_033FB627
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FF4BF3_2_033FF4BF
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FA4B13_2_033FA4B1
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033DD4CD3_2_033DD4CD
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033DBB9C3_2_033DBB9C
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FEAFE3_2_033FEAFE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E89263_2_033E8926
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FA9A53_2_033FA9A5
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0340A9EA3_2_0340A9EA
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E19F33_2_033E19F3
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033DA82A3_2_033DA82A
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_034018753_2_03401875
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_03406F643_2_03406F64
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E7F153_2_033E7F15
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033F2F723_2_033F2F72
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E7E693_2_033E7E69
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FADBD3_2_033FADBD
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033E7C373_2_033E7C37
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_03409CD03_2_03409CD0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0340BCAE3_2_0340BCAE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_054D33B03_2_054D33B0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_055433B04_2_055433B0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D945906_2_04D94590
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D925BB6_2_04D925BB
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D9C7866_2_04D9C786
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D97A3F6_2_04D97A3F
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D94BDD6_2_04D94BDD
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D8D4CD6_2_04D8D4CD
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAF4BF6_2_04DAF4BF
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAA4B16_2_04DAA4B1
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAB6276_2_04DAB627
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DB975E6_2_04DB975E
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D980606_2_04D98060
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAB1F26_2_04DAB1F2
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DA32C06_2_04DA32C0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAA2E06_2_04DAA2E0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DBA2426_2_04DBA242
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DA42136_2_04DA4213
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DB9CD06_2_04DB9CD0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DBBCAE6_2_04DBBCAE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D97C376_2_04D97C37
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAADBD6_2_04DAADBD
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D97E696_2_04D97E69
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DA2F726_2_04DA2F72
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DB6F646_2_04DB6F64
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D97F156_2_04D97F15
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DB18756_2_04DB1875
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D8A82A6_2_04D8A82A
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D919F36_2_04D919F3
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DBA9EA6_2_04DBA9EA
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAA9A56_2_04DAA9A5
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D989266_2_04D98926
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAEAFE6_2_04DAEAFE
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04D8BB9C6_2_04D8BB9C
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_052633B06_2_052633B0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 04DA8863 appears 43 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 033FE620 appears 41 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 04DA92B8 appears 137 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 033F92B8 appears 137 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 04DAE620 appears 41 times
Source: C:\Windows\SysWOW64\rundll32.exeCode function: String function: 033F8863 appears 43 times
Source: TsLvuUO.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: classification engineClassification label: mal100.phis.troj.spyw.evad.winDLL@101/4@1/1
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1_PhpuzIakkdPWqpI
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3664:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3128:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1_H135405890
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2104:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6444:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4308:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6456:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1644:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5616:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1876:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6784:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3920:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1_H140366885
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4332:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2072:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1_H98778193
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\2_PhpuzIakkdPWqpI
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1_H106729660
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1_H5174114
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5328:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1_H82944746
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5792:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exeMutant created: \Sessions\1\BaseNamedObjects\Global\1_H133321728
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2640:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2940:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4080:120:WilError_03
Source: TsLvuUO.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Program Files\Mozilla Firefox\application.iniJump to behavior
Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TsLvuUO.dll,#1
Source: TsLvuUO.dllReversingLabs: Detection: 31%
Source: TsLvuUO.dllVirustotal: Detection: 44%
Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\TsLvuUO.dll"
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TsLvuUO.dll,#1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT2"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "nfblQVJFwWHDFj"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "nfblQVJFwWHDFj"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "YGYYnsbMowvpr"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr2"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU2"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ2"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT2"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "nfblQVJFwWHDFj"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "nfblQVJFwWHDFj"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "YGYYnsbMowvpr"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "YGYYnsbMowvpr2"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU2"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2"
Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\TsLvuUO.dll,#1Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "nfblQVJFwWHDFj"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "nfblQVJFwWHDFj"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "YGYYnsbMowvpr"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "nfblQVJFwWHDFj"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "nfblQVJFwWHDFj"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "YGYYnsbMowvpr"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: C:\Windows\SysWOW64\rundll32.exeAutomated click: OK
Source: TsLvuUO.dllStatic file information: File size 6734848 > 1048576
Source: TsLvuUO.dllStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x5ebc00
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033F92B8 push eax; ret 3_2_033F92D6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FE665 push ecx; ret 3_2_033FE678
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_054E64F0 push eax; ret 3_2_054E650E
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_054D3395 push ecx; ret 3_2_054D33A8
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_055564F0 push eax; ret 4_2_0555650E
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_05543395 push ecx; ret 4_2_055433A8
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DAE665 push ecx; ret 6_2_04DAE678
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DA92B8 push eax; ret 6_2_04DA92D6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_052764F0 push eax; ret 6_2_0527650E
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_05263395 push ecx; ret 6_2_052633A8

Boot Survival

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT"
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FEAFE EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,3_2_033FEAFE
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_4-1364
Source: C:\Windows\SysWOW64\rundll32.exeAPI coverage: 3.8 %
Source: C:\Windows\SysWOW64\rundll32.exeAPI coverage: 2.2 %
Source: C:\Windows\SysWOW64\rundll32.exeAPI coverage: 8.6 %
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\schtasks.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\schtasks.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\schtasks.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\schtasks.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\System32\loaddll32.exeThread delayed: delay time: 120000Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ProfilesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\userJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\FirefoxJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\MozillaJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: rundll32.exe, 00000006.00000002.2291817732.0000000004C84000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWW,
Source: rundll32.exe, 00000003.00000003.2223174899.000000000352B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2223174899.00000000034EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2211208837.000000000352B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2212333363.000000000352B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2211208837.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2224250627.000000000352B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2211006123.000000000351D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2210277018.00000000034F2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2210893104.00000000034ED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2210033495.00000000034EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2224250627.00000000034EC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000003.00000002.2224875185.0000000004FC0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Windows\SysWOW64\rundll32.exeAPI call chain: ExitProcess graph end nodegraph_3-45737
Source: C:\Windows\SysWOW64\rundll32.exeAPI call chain: ExitProcess graph end nodegraph_4-1365
Source: C:\Windows\SysWOW64\rundll32.exeAPI call chain: ExitProcess graph end nodegraph_6-45783
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0340843C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,3_2_0340843C
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0340843C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,3_2_0340843C
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_03403440 GetProcessHeap,3_2_03403440
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_03405C54 SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_03405C54
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_054D11A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_054D11A4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_055411A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_055411A4
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_04DB5C54 SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_04DB5C54
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_052611A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_052611A4

HIPS / PFW / Operating System Protection Evasion

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 44.232.42.242 80Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "nfblQVJFwWHDFj"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "nfblQVJFwWHDFj"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "YGYYnsbMowvpr"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "nfblQVJFwWHDFj"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "nfblQVJFwWHDFj"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "YGYYnsbMowvpr"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "YGYYnsbMowvpr"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "WYKSCfYVrwsdWpT2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "SfQlcfTRPgaddFhgU2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_033FEDD9 cpuid 3_2_033FEDD9
Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoEx,GetLocaleInfoW,3_2_054D2C29
Source: C:\Windows\SysWOW64\rundll32.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,3_2_054DE1C6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __IsNonwritableInCurrentImage,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,_free,_free,_free,3_2_054D33B0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoEx,GetLocaleInfoW,4_2_05542C29
Source: C:\Windows\SysWOW64\rundll32.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,4_2_0554E1C6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __IsNonwritableInCurrentImage,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,_free,_free,_free,4_2_055433B0
Source: C:\Windows\SysWOW64\rundll32.exeCode function: GetLocaleInfoEx,GetLocaleInfoW,6_2_05262C29
Source: C:\Windows\SysWOW64\rundll32.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,6_2_0526E1C6
Source: C:\Windows\SysWOW64\rundll32.exeCode function: __IsNonwritableInCurrentImage,___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__calloc_crt,__invoke_watson,6_2_052633B0
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_0340578B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,3_2_0340578B

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Overwrites Mozilla Firefox settings
Source: C:\Windows\SysWOW64\rundll32.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempjgCdeXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempjgCdeXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempnwhObfJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempnwhObfJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempnShBdnJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempnShBdnJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempXMDGGlJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempXMDGGlJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKO\scriptCache-child-current.binJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ProfilesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKO\webext.sc.lz4Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKO\urlCache.binJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempjgCdeXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PreferencesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.jsJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKOJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKO\scriptCache-current.binJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempXMDGGlJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-releaseJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempnShBdnJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKO\scriptCache-child.binJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKO\urlCache-current.binJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKO\scriptCache.binJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempnwhObfJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCacheEYKKO\startupCache.8.littleJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Windows Management Instrumentation		1
Scheduled Task/Job		111
Process Injection		21
Virtualization/Sandbox Evasion		1
OS Credential Dumping		1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Scheduled Task/Job		1
DLL Side-Loading		1
Scheduled Task/Job		111
Process Injection		LSASS Memory51
Security Software Discovery		Remote Desktop Protocol1
Browser Session Hijacking		1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Native API		Logon Script (Windows)1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		Security Account Manager21
Virtualization/Sandbox Evasion		SMB/Windows Admin Shares1
Data from Local System		2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
Obfuscated Files or Information		NTDS2
File and Directory Discovery		Distributed Component Object ModelInput Capture12
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Rundll32		LSA Secrets53
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1502267 Sample: TsLvuUO.dll Startdate: 31/08/2024 Architecture: WINDOWS Score: 100 66 api4.check-data.xyz 2->66 68 checkdata-1114476139.us-west-2.elb.amazonaws.com 2->68 70 bg.microsoft.map.fastly.net 2->70 74 Multi AV Scanner detection for domain / URL 2->74 76 Antivirus detection for URL or domain 2->76 78 Antivirus / Scanner detection for submitted sample 2->78 82 2 other signatures 2->82 9 loaddll32.exe 1 2->9         started        signatures3 80 Performs DNS queries to domains with low reputation 66->80 process4 process5 11 rundll32.exe 1 18 9->11         started        16 rundll32.exe 14 9->16         started        18 cmd.exe 1 9->18         started        20 conhost.exe 9->20         started        dnsIp6 72 checkdata-1114476139.us-west-2.elb.amazonaws.com 44.232.42.242, 49705, 49709, 80 AMAZON-02US United States 11->72 58 C:\Users\user\AppData\...\prefs.js_tempnwhObf, ASCII 11->58 dropped 60 C:\Users\user\AppData\...\prefs.js_tempjgCdeX, ASCII 11->60 dropped 84 Overwrites Mozilla Firefox settings 11->84 86 Uses schtasks.exe or at.exe to add and modify task schedules 11->86 88 Tries to harvest and steal browser information (history, passwords, etc) 11->88 22 schtasks.exe 1 11->22         started        24 schtasks.exe 1 11->24         started        26 schtasks.exe 1 11->26         started        36 15 other processes 11->36 62 C:\Users\user\AppData\...\prefs.js_tempnShBdn, ASCII 16->62 dropped 64 C:\Users\user\AppData\...\prefs.js_tempXMDGGl, ASCII 16->64 dropped 90 System process connects to network (likely due to code injection or exploit) 16->90 28 schtasks.exe 1 16->28         started        30 schtasks.exe 16->30         started        32 schtasks.exe 16->32         started        38 14 other processes 16->38 34 rundll32.exe 1 18->34         started        file7 signatures8 process9 process10 40 conhost.exe 22->40         started        42 conhost.exe 24->42         started        44 conhost.exe 26->44         started        46 conhost.exe 28->46         started        48 conhost.exe 30->48         started        50 conhost.exe 32->50         started        52 conhost.exe 36->52         started        54 14 other processes 36->54 56 14 other processes 38->56

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
TsLvuUO.dll32%ReversingLabs
TsLvuUO.dll45%VirustotalBrowse
TsLvuUO.dll100%AviraHEUR/AGEN.1300638

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
bg.microsoft.map.fastly.net0%VirustotalBrowse
checkdata-1114476139.us-west-2.elb.amazonaws.com0%VirustotalBrowse
api4.check-data.xyz6%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.0%URL Reputationsafe
https://smartblock.firefox.etp/play.svg0%URL Reputationsafe
https://ads.stickyadstv.com/firefox-etp0%URL Reputationsafe
https://drive-staging.corp.google.com/0%URL Reputationsafe
https://crash-reports.mozilla.com/submit?id=0%URL Reputationsafe
https://screenshots.firefox.com/0%URL Reputationsafe
https://drive-daily-2.corp.google.com/0%URL Reputationsafe
https://drive-autopush.corp.google.com/0%URL Reputationsafe
https://drive-daily-4.corp.google.com/0%URL Reputationsafe
https://drive-daily-1.corp.google.com/0%URL Reputationsafe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta0%URL Reputationsafe
https://drive-daily-5.corp.google.com/0%URL Reputationsafe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg0%URL Reputationsafe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg0%URL Reputationsafe
https://drive-daily-6.corp.google.com/0%URL Reputationsafe
https://static.adsafeprotected.com/firefox-etp-pixel0%URL Reputationsafe
https://drive-daily-0.corp.google.com/0%URL Reputationsafe
https://static.adsafeprotected.com/firefox-etp-js0%URL Reputationsafe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref0%URL Reputationsafe
https://chromewebstore.google.com/0%URL Reputationsafe
https://drive-preprod.corp.google.com/0%URL Reputationsafe
http://api2.check-data.xyz100%Avira URL Cloudmalware
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi0%Avira URL Cloudsafe
https://sandbox.google.com/payments/v4/js/integrator.js0%Avira URL Cloudsafe
https://drive-daily-3.corp.google.com/0%URL Reputationsafe
http://api4.check-data.xyz/api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/97D99714-22C7-D2AF-3668-2A796B33DC65100%Avira URL Cloudmalware
https://payments.google.com/0%Avira URL Cloudsafe
http://api4.check-data.xyz/api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr100%Avira URL Cloudmalware
https://docs.google.com/0%Avira URL Cloudsafe
https://sandbox.google.com/payments/v4/js/integrator.js0%VirustotalBrowse
https://www.google.com/s/0%Avira URL Cloudsafe
https://payments.google.com/0%VirustotalBrowse
http://api4.check-data.xyz/api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/1D5E65EB-947C-7A0A-9CCF-076D85CAD35E100%Avira URL Cloudmalware
http://api4.check-data.xyz100%Avira URL Cloudmalware
https://drive.google.com/0%Avira URL Cloudsafe
https://www.amazon.com/exec/obidos/external-search/0%Avira URL Cloudsafe
https://hg.mozilla.org/releases/mozilla-release0%Avira URL Cloudsafe
https://github.com/mozilla-services/screenshots0%Avira URL Cloudsafe
http://api4.check-data.xyz6%VirustotalBrowse
https://drive.google.com/0%VirustotalBrowse
http://api5.check-data.xyz100%Avira URL Cloudmalware
https://hg.mozilla.org/releases/mozilla-release0%VirustotalBrowse
https://docs.google.com/0%VirustotalBrowse
http://api.check-data.xyz100%Avira URL Cloudmalware
https://github.com/mozilla-services/screenshots0%VirustotalBrowse
https://github.com/mozilla/webcompat-reporter0%Avira URL Cloudsafe
https://github.com/mozilla/webcompat-reporter0%VirustotalBrowse
https://chrome.google.com/webstore0%Avira URL Cloudsafe
https://www.amazon.com/exec/obidos/external-search/0%VirustotalBrowse
http://api2.check-data.xyz10%VirustotalBrowse
https://payments.google.com/payments/v4/js/integrator.js0%Avira URL Cloudsafe
http://api5.check-data.xyz6%VirustotalBrowse
https://docs.google.co0%Avira URL Cloudsafe
http://api3.check-data.xyz100%Avira URL Cloudmalware
http://api.check-data.xyz6%VirustotalBrowse
https://www.google.com/m/0%Avira URL Cloudsafe
https://static.adsafeprotected.com/firefox-etp-pixeli0%Avira URL Cloudsafe
https://payments.google.com/payments/v4/js/integrator.js0%VirustotalBrowse
https://drive-daily-2.c0%Avira URL Cloudsafe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde74770%Avira URL Cloudsafe
https://chrome.google.com/webstore/0%Avira URL Cloudsafe
https://static.adsafeprotected.com/firefox-etp-pixeli0%VirustotalBrowse
http://api4.check-data.xyz/api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr100%Avira URL Cloudmalware
https://sandbox.google.com/0%Avira URL Cloudsafe
https://www.google.com/0%Avira URL Cloudsafe
https://chrome.google.com/webstore/0%VirustotalBrowse
http://api3.check-data.xyz9%VirustotalBrowse
https://docs.google.co1%VirustotalBrowse
https://chrome.google.com/webstore0%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalseunknown
checkdata-1114476139.us-west-2.elb.amazonaws.com
44.232.42.242
truetrueunknown
api4.check-data.xyz
unknown
unknowntrueunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
http://api4.check-data.xyz/api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/97D99714-22C7-D2AF-3668-2A796B33DC65true
  • Avira URL Cloud: malware
unknown
http://api4.check-data.xyz/api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/1D5E65EB-947C-7A0A-9CCF-076D85CAD35Etrue
  • Avira URL Cloud: malware
unknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://api2.check-data.xyzrundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmptrue
  • 10%, Virustotal, Browse
  • Avira URL Cloud: malware
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYiprefs.js_tempnwhObf.3.drfalse
  • Avira URL Cloud: safe
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.prefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drfalse
  • URL Reputation: safe
unknown
https://smartblock.firefox.etp/play.svgrundll32.exe, 00000006.00000003.2290120533.0000000003161000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291382323.0000000003165000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290784410.0000000003161000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://payments.google.com/rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2265993673.00000000031AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280879303.00000000031CF000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://sandbox.google.com/payments/v4/js/integrator.jsrundll32.exe, 00000003.00000003.2210033495.00000000034D9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2196383980.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290120533.000000000311F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290221613.000000000312B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291320377.000000000312E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290544375.000000000312E000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://api4.check-data.xyz/api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzrrundll32.exe, 00000006.00000002.2291425440.000000000319C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291908337.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283310545.00000000031CB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291506390.00000000031D3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmptrue
  • Avira URL Cloud: malware
unknown
https://docs.google.com/rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.google.com/s/rundll32.exe, 00000003.00000003.2195972684.00000000034D7000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://ads.stickyadstv.com/firefox-etprundll32.exe, 00000003.00000003.2223174899.00000000034EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2224250627.00000000034EC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291506390.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283310545.00000000031CB000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-staging.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
http://api4.check-data.xyzrundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmptrue
  • 6%, Virustotal, Browse
  • Avira URL Cloud: malware
unknown
https://drive.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.amazon.com/exec/obidos/external-search/rundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291908337.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://hg.mozilla.org/releases/mozilla-releaserundll32.exe, 00000003.00000003.2212333363.000000000351D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283192574.0000000004CB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283339215.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282828895.0000000004C98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282587225.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282330261.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291455240.00000000031BA000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/mozilla-services/screenshotsrundll32.exe, 00000006.00000003.2290120533.0000000003161000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291382323.0000000003165000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290784410.0000000003161000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://api5.check-data.xyzrundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpfalse
  • 6%, Virustotal, Browse
  • Avira URL Cloud: malware
unknown
http://api.check-data.xyzrundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpfalse
  • 6%, Virustotal, Browse
  • Avira URL Cloud: malware
unknown
https://github.com/mozilla/webcompat-reporterrundll32.exe, 00000006.00000003.2290120533.0000000003161000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291382323.0000000003165000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2290784410.0000000003161000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://crash-reports.mozilla.com/submit?id=rundll32.exe, 00000003.00000003.2212333363.000000000351D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283192574.0000000004CB2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283339215.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282828895.0000000004C98000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282587225.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2282330261.0000000004C94000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.2291455240.00000000031BA000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://screenshots.firefox.com/rundll32.exe, 00000006.00000003.2282774739.00000000031D0000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://chrome.google.com/webstorerundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://drive-daily-2.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-autopush.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://payments.google.com/payments/v4/js/integrator.jsrundll32.exe, 00000003.00000003.2210033495.00000000034D9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000003.2196383980.00000000034D5000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://drive-daily-4.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://docs.google.corundll32.exe, 00000003.00000003.2195972684.00000000034D7000.00000004.00000020.00020000.00000000.sdmpfalse
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://api3.check-data.xyzrundll32.exe, 00000006.00000003.2283092527.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2283381715.0000000004C99000.00000004.00000020.00020000.00000000.sdmpfalse
  • 9%, Virustotal, Browse
  • Avira URL Cloud: malware
unknown
https://drive-daily-1.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&ctaprefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drfalse
  • URL Reputation: safe
unknown
https://www.google.com/m/rundll32.exe, 00000006.00000003.2266015010.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2265993673.00000000031AE000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-5.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://static.adsafeprotected.com/firefox-etp-pixelirundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpgprefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drfalse
  • URL Reputation: safe
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpgprefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drfalse
  • URL Reputation: safe
unknown
https://drive-daily-6.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://static.adsafeprotected.com/firefox-etp-pixelrundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-daily-0.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://static.adsafeprotected.com/firefox-etp-jsrundll32.exe, 00000006.00000003.2283092527.0000000004CB9000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-daily-2.crundll32.exe, 00000006.00000003.2266015010.00000000031B6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2265993673.00000000031AE000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&refprefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drfalse
  • URL Reputation: safe
unknown
https://chromewebstore.google.com/rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://drive-preprod.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477prefs.js_tempjgCdeX.3.dr, prefs.js_tempXMDGGl.6.dr, prefs.js_tempnShBdn.6.dr, prefs.js_tempnwhObf.3.drfalse
  • Avira URL Cloud: safe
unknown
https://chrome.google.com/webstore/rundll32.exe, 00000006.00000003.2281508795.00000000031CB000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://api4.check-data.xyz/api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzrrundll32.exe, 00000003.00000002.2224250627.00000000034EC000.00000004.00000020.00020000.00000000.sdmptrue
  • Avira URL Cloud: malware
unknown
https://sandbox.google.com/rundll32.exe, 00000006.00000003.2266394321.00000000031B2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280651031.00000000031CA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2280879303.00000000031CF000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://drive-daily-3.corp.google.com/rundll32.exe, 00000006.00000003.2280651031.00000000031B6000.00000004.00000020.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
44.232.42.242
checkdata-1114476139.us-west-2.elb.amazonaws.comUnited States
16509AMAZON-02UStrue

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1502267
Start date and time:2024-08-31 22:10:53 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 7m 37s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:Run with higher sleep bypass
Number of analysed new started processes analysed:77
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:TsLvuUO.dll
Detection:MAL
Classification:mal100.phis.troj.spyw.evad.winDLL@101/4@1/1
EGA Information:
  • Successful, ratio: 100%
HCA Information:Failed
Cookbook Comments:
  • Found application associated with file extension: .dll
  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
  • Stop behavior analysis, all processes terminated

Warnings

  • Exclude process from analysis (whitelisted): dllhost.exe
  • Excluded IPs from analysis (whitelisted): 142.250.186.138, 142.250.186.74, 172.217.16.202, 172.217.23.106, 172.217.18.10, 142.250.186.106, 142.250.186.42, 216.58.212.170, 172.217.18.106, 172.217.16.138, 142.250.184.202, 142.250.185.106, 216.58.212.138, 216.58.206.42, 142.250.185.74, 216.58.206.74, 13.85.23.86, 20.3.187.198, 20.242.39.171, 52.165.164.15
  • Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, www.googleapis.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtProtectVirtualMemory calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
checkdata-1114476139.us-west-2.elb.amazonaws.com3QKcKCEzYP.exeGet hashmaliciousLummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBCBrowse
  • 35.161.111.70
Install.exeGet hashmaliciousNeoreklamiBrowse
  • 35.167.197.26
setup.exeGet hashmaliciousNeoreklamiBrowse
  • 35.167.197.26
file.exeGet hashmaliciousLummaC, Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, StealcBrowse
  • 44.240.96.128
setup.exeGet hashmaliciousLummaC, Mars Stealer, PureLog Stealer, RedLine, Stealc, Stealerium, VidarBrowse
  • 44.237.52.63
1720605557.036432_setup.exeGet hashmaliciousLummaC Stealer, Mars Stealer, PureLog Stealer, Socks5Systemz, Stealc, Stealerium, VidarBrowse
  • 44.240.96.128
1719859269.0326595_setup.exeGet hashmaliciousLummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, XmrigBrowse
  • 44.240.96.128
1719520929.094843_setup.exeGet hashmaliciousLummaC Stealer, Mars Stealer, PrivateLoader, PureLog Stealer, Socks5Systemz, Stealc, VidarBrowse
  • 44.240.96.128
0J4lhZneA6.exeGet hashmaliciousUnknownBrowse
  • 44.237.26.169
bg.microsoft.map.fastly.nethttp://sin1.contabostorage.comGet hashmaliciousUnknownBrowse
  • 199.232.214.172
BankPaymAdviceVend.Report.docxGet hashmaliciousUnknownBrowse
  • 199.232.214.172
TradingStationPublisher.msiGet hashmaliciousUnknownBrowse
  • 199.232.214.172
DFweD7fjxj.exeGet hashmaliciousDCRatBrowse
  • 199.232.210.172
http://lobster.cloudserver1097.com/3f9vxbkr4q83r4aqGet hashmaliciousUnknownBrowse
  • 199.232.214.172
https://login.ap-financier.com/TaqWmoGvGet hashmaliciousHTMLPhisherBrowse
  • 199.232.210.172
http://find-phone.za.com/icloud2022-esp.phpGet hashmaliciousUnknownBrowse
  • 199.232.210.172
https://sharefile8.pages.dev/b08+zb2ylref0qaxGet hashmaliciousUnknownBrowse
  • 199.232.214.172
https://seoservicesiox.firebaseapp.com/?err=tdn8ci80q...~311~...1bab28021k78dd4g97a557ek2c2e4Get hashmaliciousHTMLPhisherBrowse
  • 199.232.210.172
https://xjp.steamproxy.vip/profiles/76561199276106401Get hashmaliciousUnknownBrowse
  • 199.232.214.172

ASNs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
AMAZON-02USPSqBbz.dllGet hashmaliciousUnknownBrowse
  • 108.156.60.94
PSqBbz.dllGet hashmaliciousUnknownBrowse
  • 13.225.78.36
COTIZACION 290824.exeGet hashmaliciousFormBookBrowse
  • 13.248.169.48
OmnqazpM3P.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, VidarBrowse
  • 52.212.52.84
play.exeGet hashmaliciousFormBookBrowse
  • 13.248.169.48
https://grand-pika-f642c4.netlify.app/#mthatha@africawsp.co.zaGet hashmaliciousUnknownBrowse
  • 99.86.8.175
SecuriteInfo.com.Linux.Siggen.9999.15938.22369.elfGet hashmaliciousMiraiBrowse
  • 13.226.40.92
SecuriteInfo.com.Linux.Siggen.9999.19003.7982.elfGet hashmaliciousMiraiBrowse
  • 35.183.153.119
http://security-azure.b-cdn.net/Get hashmaliciousUnknownBrowse
  • 18.245.60.57

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempXMDGGl

Download File
Process:C:\Windows\SysWOW64\rundll32.exe
File Type:ASCII text, with very long lines (1743), with CRLF, CR line terminators
Category:dropped
Size (bytes):9505
Entropy (8bit):5.512528074509136
Encrypted:false
SSDEEP:192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sy:PeegJUaJHEw9R
MD5:1EB7ADCDEBE99FC2B3606DA246898A89
SHA1:604A13087BDE1FB8109E83DBC4E6392EE187FBA6
SHA-256:9B127A041FB737D48BC12CB760C0F6835B3B469D8FA8D34334AB08B25ADE997E
SHA-512:BE4A4CDD3EED0E3280D535DD13A0565E1C4B4A59A7BD91B3C972BFB34A394B0AA332842F37A8446FE53A9775848F359B48B50729AE35238B3EDCE9EE39522708
Malicious:true
Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempjgCdeX

Download File
Process:C:\Windows\SysWOW64\rundll32.exe
File Type:ASCII text, with very long lines (1743), with CRLF, CR line terminators
Category:dropped
Size (bytes):9505
Entropy (8bit):5.512528074509136
Encrypted:false
SSDEEP:192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sy:PeegJUaJHEw9R
MD5:1EB7ADCDEBE99FC2B3606DA246898A89
SHA1:604A13087BDE1FB8109E83DBC4E6392EE187FBA6
SHA-256:9B127A041FB737D48BC12CB760C0F6835B3B469D8FA8D34334AB08B25ADE997E
SHA-512:BE4A4CDD3EED0E3280D535DD13A0565E1C4B4A59A7BD91B3C972BFB34A394B0AA332842F37A8446FE53A9775848F359B48B50729AE35238B3EDCE9EE39522708
Malicious:true
Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempnShBdn

Download File
Process:C:\Windows\SysWOW64\rundll32.exe
File Type:ASCII text, with very long lines (1743), with CRLF, CR line terminators
Category:dropped
Size (bytes):9505
Entropy (8bit):5.512528074509136
Encrypted:false
SSDEEP:192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sy:PeegJUaJHEw9R
MD5:1EB7ADCDEBE99FC2B3606DA246898A89
SHA1:604A13087BDE1FB8109E83DBC4E6392EE187FBA6
SHA-256:9B127A041FB737D48BC12CB760C0F6835B3B469D8FA8D34334AB08B25ADE997E
SHA-512:BE4A4CDD3EED0E3280D535DD13A0565E1C4B4A59A7BD91B3C972BFB34A394B0AA332842F37A8446FE53A9775848F359B48B50729AE35238B3EDCE9EE39522708
Malicious:true
Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js_tempnwhObf

Download File
Process:C:\Windows\SysWOW64\rundll32.exe
File Type:ASCII text, with very long lines (1743), with CRLF, CR line terminators
Category:dropped
Size (bytes):9505
Entropy (8bit):5.512528074509136
Encrypted:false
SSDEEP:192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sy:PeegJUaJHEw9R
MD5:1EB7ADCDEBE99FC2B3606DA246898A89
SHA1:604A13087BDE1FB8109E83DBC4E6392EE187FBA6
SHA-256:9B127A041FB737D48BC12CB760C0F6835B3B469D8FA8D34334AB08B25ADE997E
SHA-512:BE4A4CDD3EED0E3280D535DD13A0565E1C4B4A59A7BD91B3C972BFB34A394B0AA332842F37A8446FE53A9775848F359B48B50729AE35238B3EDCE9EE39522708
Malicious:true
Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

Static File Info

General

File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):7.801046032125333
TrID:
  • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
  • Generic Win/DOS Executable (2004/3) 0.20%
  • DOS Executable Generic (2002/1) 0.20%
  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:TsLvuUO.dll
File size:6'734'848 bytes
MD5:edd94a0a267df670b90f41c127f9dd6a
SHA1:bd0005769a9392a922030793b1e88900a808f22a
SHA256:00db74544ae4d92774a3008a5ee322577dab2a53bcb2eb9003e88af617f3b495
SHA512:f9168a60b0af17f7d53f80e1b906feb59d44a195b067f938b3925716b46a72279c71a40d8188f110e0d40318ba2a41bea78be4b63672a465cab98cf069f8291c
SSDEEP:98304:e4p5fRmhQ1orSk3GCK4J7vADNR6oXc0/8+x0bRtI4PPgbYhiLC9kEN6+/mu:eKfiQ15M2aIDS0i+SRi4samC9bN9O
TLSH:30660114F2009B1CD87702F16175EB99627C6530125426E376AEEA0F39B41D8BDAFEF2
File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......hA.!, .r, .r, .r..:r. .r!r"r2 .r!r.ro .r!r.r. .r..6r% .r, .r. .r...r* .r...r= .r..!r- .r..#r- .rRich, .r................PE..L..

File Icon

Icon Hash:7ae282899bbab082

Static PE Info

General

Entrypoint:0x10063100
Entrypoint Section:.text
Digitally signed:false
Imagebase:0x10000000
Subsystem:windows gui
Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:NX_COMPAT
Time Stamp:0x615F3ED9 [Thu Oct 7 18:39:21 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:6
OS Version Minor:0
File Version Major:6
File Version Minor:0
Subsystem Version Major:6
Subsystem Version Minor:0
Import Hash:080e9a7727d30a43ca5568c2e04b20cd

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F58347D8387h
call 00007F58347E3ABEh
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F58347D838Ch
add esp, 0Ch
pop ebp
retn 000Ch
push 0000000Ch
push 1007CC98h
call 00007F58347DD746h
xor eax, eax
inc eax
mov esi, dword ptr [ebp+0Ch]
test esi, esi
jne 00007F58347D838Eh
cmp dword ptr [10669DA8h], esi
je 00007F58347D846Ah
and dword ptr [ebp-04h], 00000000h
cmp esi, 01h
je 00007F58347D8387h
cmp esi, 02h
jne 00007F58347D83B7h
mov ecx, dword ptr [100024D0h]
test ecx, ecx
je 00007F58347D838Eh
push dword ptr [ebp+10h]
push esi
push dword ptr [ebp+08h]
call ecx
mov dword ptr [ebp-1Ch], eax
test eax, eax
je 00007F58347D8437h
push dword ptr [ebp+10h]
push esi
push dword ptr [ebp+08h]
call 00007F58347D8196h
mov dword ptr [ebp-1Ch], eax
test eax, eax
je 00007F58347D8420h
mov ebx, dword ptr [ebp+10h]
push ebx
push esi
push dword ptr [ebp+08h]
call 00007F58347E3AD3h
mov edi, eax
mov dword ptr [ebp-1Ch], edi
cmp esi, 01h
jne 00007F58347D83AAh
test edi, edi
jne 00007F58347D83A6h
push ebx
push eax
push dword ptr [ebp+08h]
call 00007F58347E3ABBh
push ebx
push edi
push dword ptr [ebp+08h]
call 00007F58347D815Ch
mov eax, dword ptr [100024D0h]
test eax, eax
je 00007F58347D8389h
push ebx
push edi
push dword ptr [ebp+08h]
call eax

Rich Headers

Programming Language:
  • [ASM] VS2013 build 21005
  • [C++] VS2013 build 21005
  • [ C ] VS2013 build 21005
  • [C++] VS2013 UPD5 build 40629
  • [EXP] VS2013 UPD5 build 40629
  • [LNK] VS2013 UPD5 build 40629

Data Directories

NameVirtual AddressVirtual Size Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT0x7d2b00x3c.text
IMAGE_DIRECTORY_ENTRY_IMPORT0x66c29c0x64.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
IMAGE_DIRECTORY_ENTRY_BASERELOC0x66e0000x2d48.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
IMAGE_DIRECTORY_ENTRY_TLS0x00x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x7db80x40.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_IAT0x66c0000x29c.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

Sections

NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
.text0x10000x7c2ec0x7c4005198dbea9a0124ae10eaf669881aaf74False0.4727584255533199data6.333149874686492IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data0x7e0000x5edeac0x5ebc00fd0d7d64d42f76f4b2bf445af0ff9882unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata0x66c0000x11480x12002cbce472adca631c5feef1545631e8b3False0.4398871527777778data5.423143313414181IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc0x66e0000x2d480x2e008f99bf1ea0d1a7ab38ec94aedbd8b67eFalse0.7133152173913043data6.509573588463001IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLLImport
KERNEL32.dllFillConsoleOutputAttribute, GetConsoleScreenBufferInfo, ReadConsoleInputA, PeekConsoleInputA, GetNumberOfConsoleInputEvents, OutputDebugStringW, ReadConsoleW, WriteConsoleW, SetStdHandle, LoadLibraryExW, GetModuleFileNameW, SetFilePointerEx, FillConsoleOutputCharacterA, GetConsoleMode, GetConsoleCP, WriteFile, FlushFileBuffers, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCurrentProcessId, GetFileType, GetOEMCP, GetACP, IsValidCodePage, IsDebuggerPresent, GetProcessHeap, HeapSize, GetModuleHandleExW, ExitProcess, SetConsoleTextAttribute, SetConsoleCursorPosition, Sleep, GetStdHandle, CreateThread, LocalFree, CloseHandle, CreateEventW, CreateFileMappingA, FindClose, EnterCriticalSection, IsDBCSLeadByteEx, FindFirstFileA, GetSystemDirectoryA, MulDiv, CreateEventA, GetLocaleInfoW, InitializeSListHead, SetCommTimeouts, GetSystemTimeAsFileTime, ConnectNamedPipe, SetCommBreak, SetDllDirectoryW, VirtualQuery, GetCPInfo, GetThreadTimes, GetModuleFileNameA, CreatePipe, GetLocalTime, GetStartupInfoW, CreateFileW, IsProcessorFeaturePresent, GetSystemTimeAdjustment, OpenProcess, GetCurrentThread, QueryPerformanceCounter, ReadFile, EncodePointer, DecodePointer, LeaveCriticalSection, DeleteCriticalSection, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, GetLastError, HeapReAlloc, RaiseException, RtlUnwind, GetCommandLineA, GetCurrentThreadId, HeapFree, HeapAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, InitializeCriticalSectionAndSpinCount, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, GetProcAddress, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, SetConsoleMode
USER32.dllCreateDialogParamA, SendDlgItemMessageA, SetFocus, GetWindowTextLengthA, DrawFocusRect, GetWindowTextA, FlashWindow, ReleaseCapture, InsertMenuA, DestroyMenu, LoadCursorA, DialogBoxParamA, SetCursor, HideCaret, PostQuitMessage, SetKeyboardState, GetDC, CreateDialogIndirectParamA, OffsetRect, GetScrollInfo, GetWindowLongA, GetDlgItem, DestroyCaret, GetDesktopWindow, SetMenu, MessageBoxW, GetSystemMetrics, ValidateRgn, CheckMenuItem, IsRectEmpty
GDI32.dllCreatePolygonRgn, GetMetaFileBitsEx, GetCharacterPlacementW, CreateHatchBrush, DeleteDC, GetDIBits, ExcludeClipRect, GdiFlush, RealizePalette, SetPolyFillMode, GetTextExtentPointW, CreateBitmapIndirect, GetTextExtentPointA, CreateDIBitmap, EndDoc, GetStockObject, UpdateColors, MoveToEx, ExtFloodFill, MaskBlt, Polygon, CreatePalette, GetRegionData, SelectObject, GetPaletteEntries, CreateRectRgnIndirect, RectInRegion, CreateRectRgn, RoundRect, SelectPalette
ADVAPI32.dllCopySid, OpenProcessToken, GetLengthSid, InitializeSecurityDescriptor, EqualSid

Network Behavior

Network Port Distribution

TCP Packets

TimestampSource PortDest PortSource IPDest IP
Aug 31, 2024 22:12:02.045289993 CEST4970580192.168.2.544.232.42.242
Aug 31, 2024 22:12:02.050088882 CEST804970544.232.42.242192.168.2.5
Aug 31, 2024 22:12:02.050203085 CEST4970580192.168.2.544.232.42.242
Aug 31, 2024 22:12:02.050537109 CEST4970580192.168.2.544.232.42.242
Aug 31, 2024 22:12:02.055466890 CEST804970544.232.42.242192.168.2.5
Aug 31, 2024 22:12:02.684412956 CEST804970544.232.42.242192.168.2.5
Aug 31, 2024 22:12:02.684495926 CEST4970580192.168.2.544.232.42.242
Aug 31, 2024 22:12:02.945787907 CEST4970580192.168.2.544.232.42.242
Aug 31, 2024 22:12:08.728751898 CEST4970980192.168.2.544.232.42.242
Aug 31, 2024 22:12:08.733643055 CEST804970944.232.42.242192.168.2.5
Aug 31, 2024 22:12:08.733721018 CEST4970980192.168.2.544.232.42.242
Aug 31, 2024 22:12:08.737373114 CEST4970980192.168.2.544.232.42.242
Aug 31, 2024 22:12:08.742177010 CEST804970944.232.42.242192.168.2.5
Aug 31, 2024 22:12:09.373626947 CEST804970944.232.42.242192.168.2.5
Aug 31, 2024 22:12:09.373817921 CEST4970980192.168.2.544.232.42.242
Aug 31, 2024 22:12:09.675431013 CEST4970980192.168.2.544.232.42.242

UDP Packets

TimestampSource PortDest PortSource IPDest IP
Aug 31, 2024 22:12:02.019076109 CEST6296553192.168.2.51.1.1.1
Aug 31, 2024 22:12:02.044173956 CEST53629651.1.1.1192.168.2.5
Aug 31, 2024 22:12:11.261497021 CEST53650011.1.1.1192.168.2.5

DNS Queries

TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
Aug 31, 2024 22:12:02.019076109 CEST192.168.2.51.1.1.10xdd1cStandard query (0)api4.check-data.xyzA (IP address)IN (0x0001)false

DNS Answers

TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
Aug 31, 2024 22:12:02.044173956 CEST1.1.1.1192.168.2.50xdd1cNo error (0)api4.check-data.xyzcheckdata-1114476139.us-west-2.elb.amazonaws.comCNAME (Canonical name)IN (0x0001)false
Aug 31, 2024 22:12:02.044173956 CEST1.1.1.1192.168.2.50xdd1cNo error (0)checkdata-1114476139.us-west-2.elb.amazonaws.com44.232.42.242A (IP address)IN (0x0001)false
Aug 31, 2024 22:12:02.044173956 CEST1.1.1.1192.168.2.50xdd1cNo error (0)checkdata-1114476139.us-west-2.elb.amazonaws.com35.160.60.134A (IP address)IN (0x0001)false
Aug 31, 2024 22:12:08.354293108 CEST1.1.1.1192.168.2.50x4c68No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
Aug 31, 2024 22:12:08.354293108 CEST1.1.1.1192.168.2.50x4c68No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false

HTTP Request Dependency Graph

  • api4.check-data.xyz

HTTP Packets

Session IDSource IPSource PortDestination IPDestination PortPIDProcess
0192.168.2.54970544.232.42.242807160C:\Windows\SysWOW64\rundll32.exe
TimestampBytes transferredDirectionData
Aug 31, 2024 22:12:02.050537109 CEST358OUTGET /api/uninstall/17511/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/97D99714-22C7-D2AF-3668-2A796B33DC65 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36
Host: api4.check-data.xyz
Connection: Keep-Alive
Cache-Control: no-cache
Aug 31, 2024 22:12:02.684412956 CEST404INHTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=UTF-8
Date: Sat, 31 Aug 2024 20:09:05 GMT
Server: nginx
Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200
Content-Length: 0
Connection: keep-alive


Session IDSource IPSource PortDestination IPDestination PortPIDProcess
1192.168.2.54970944.232.42.242802300C:\Windows\SysWOW64\rundll32.exe
TimestampBytes transferredDirectionData
Aug 31, 2024 22:12:08.737373114 CEST358OUTGET /api/uninstall/59078/2C6A44CB-AD42-4731-A544-3FBD3D83AB5B/2.0.0.3281/wrtzr_ytab_b_1/8E53D89817ED4B0291FBFA7D0F319D53/1D5E65EB-947C-7A0A-9CCF-076D85CAD35E HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36
Host: api4.check-data.xyz
Connection: Keep-Alive
Cache-Control: no-cache
Aug 31, 2024 22:12:09.373626947 CEST404INHTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=UTF-8
Date: Sat, 31 Aug 2024 20:09:12 GMT
Server: nginx
Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9820401D99493DFDF796F3DAB0062EEFB3E4A533F5B2753F2532FBA9D17E5754692E8600D254000879A4CE3001E279F1EF5;PATH=/;MAX-AGE=43200
Content-Length: 0
Connection: keep-alive


Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:16:11:51
Start date:31/08/2024
Path:C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):true
Commandline:loaddll32.exe "C:\Users\user\Desktop\TsLvuUO.dll"
Imagebase:0x660000
File size:126'464 bytes
MD5 hash:51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:1
Start time:16:11:51
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:2
Start time:16:11:51
Start date:31/08/2024
Path:C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):true
Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1
Imagebase:0x790000
File size:236'544 bytes
MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:3
Start time:16:11:51
Start date:31/08/2024
Path:C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):true
Commandline:rundll32.exe C:\Users\user\Desktop\TsLvuUO.dll,#1
Imagebase:0x790000
File size:61'440 bytes
MD5 hash:889B99C52A60DD49227C5E485A016679
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:4
Start time:16:11:51
Start date:31/08/2024
Path:C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):true
Commandline:rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1
Imagebase:0x790000
File size:61'440 bytes
MD5 hash:889B99C52A60DD49227C5E485A016679
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:6
Start time:16:11:54
Start date:31/08/2024
Path:C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):true
Commandline:rundll32.exe "C:\Users\user\Desktop\TsLvuUO.dll",#1
Imagebase:0x790000
File size:61'440 bytes
MD5 hash:889B99C52A60DD49227C5E485A016679
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:7
Start time:16:11:56
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "WYKSCfYVrwsdWpT"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:8
Start time:16:11:56
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:9
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:10
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:11
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "WYKSCfYVrwsdWpT2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:12
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true

General

Target ID:13
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:14
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:15
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "nfblQVJFwWHDFj"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:16
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:17
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "nfblQVJFwWHDFj"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:18
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:19
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "YGYYnsbMowvpr"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:20
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:21
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "YGYYnsbMowvpr"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:22
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:23
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "YGYYnsbMowvpr2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:24
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:25
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "YGYYnsbMowvpr2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:26
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:27
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "SfQlcfTRPgaddFhgU"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:28
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:29
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:30
Start time:16:11:57
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:31
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "SfQlcfTRPgaddFhgU2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:32
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:33
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:34
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:35
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "MBOKUVJttHMBWpgjMbJ"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:36
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:37
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:38
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:39
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:40
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:41
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:42
Start time:16:11:58
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:43
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "WYKSCfYVrwsdWpT"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:44
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:45
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:46
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:47
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "WYKSCfYVrwsdWpT2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:48
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:49
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "WYKSCfYVrwsdWpT2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:50
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:51
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "nfblQVJFwWHDFj"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:52
Start time:16:12:04
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:53
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "nfblQVJFwWHDFj"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:54
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:55
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "YGYYnsbMowvpr"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:56
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:57
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "YGYYnsbMowvpr"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:58
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:59
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "YGYYnsbMowvpr2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:60
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:61
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "YGYYnsbMowvpr2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:62
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:63
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "SfQlcfTRPgaddFhgU"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:64
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:65
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:66
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:67
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "SfQlcfTRPgaddFhgU2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:68
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:69
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "SfQlcfTRPgaddFhgU2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:70
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:71
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "MBOKUVJttHMBWpgjMbJ"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:72
Start time:16:12:05
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:73
Start time:16:12:06
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /DELETE /F /TN "MBOKUVJttHMBWpgjMbJ"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:74
Start time:16:12:06
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:75
Start time:16:12:06
Start date:31/08/2024
Path:C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):true
Commandline:schtasks /END /TN "MBOKUVJttHMBWpgjMbJ2"
Imagebase:0xe10000
File size:187'904 bytes
MD5 hash:48C2FE20575769DE916F48EF0676A965
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

General

Target ID:76
Start time:16:12:06
Start date:31/08/2024
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff6d64d0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Has exited:true

Disassembly

Reset < >

    Execution Graph

    Execution Coverage:4.4%
    Dynamic/Decrypted Code Coverage:100%
    Signature Coverage:19.6%
    Total number of Nodes:1238
    Total number of Limit Nodes:52
    execution_graph 45219 3404f40 45224 3404f45 45219->45224 45221 3404f4f 45232 3400efc 9 API calls __write 45221->45232 45223 3404f5a 45227 3404f4a 45224->45227 45233 3409436 60 API calls 2 library calls 45224->45233 45226 34050fe 45226->45227 45234 3409436 60 API calls 2 library calls 45226->45234 45227->45223 45231 33fbf95 58 API calls __getptd_noexit 45227->45231 45229 340511d 45229->45227 45235 3409436 60 API calls 2 library calls 45229->45235 45231->45221 45232->45223 45233->45226 45234->45229 45235->45227 46828 33fcecf 46829 33fcedc 46828->46829 46830 33fced8 46828->46830 46832 33fbf95 58 API calls __getptd_noexit 46829->46832 46832->46830 45236 3408f22 45237 3408f32 45236->45237 45238 3408f63 GetLastError 45236->45238 45237->45238 45252 3408b74 45237->45252 45258 33fbf74 58 API calls 2 library calls 45238->45258 45242 3408f88 45259 33fbf95 58 API calls __getptd_noexit 45242->45259 45243 3408f95 GetFileType 45246 3408fa0 GetLastError 45243->45246 45245 3408f8e 45260 33fbf74 58 API calls 2 library calls 45246->45260 45248 3408fc7 CloseHandle 45248->45242 45249 3408fd5 45248->45249 45261 33fbf95 58 API calls __getptd_noexit 45249->45261 45251 3408fda 45251->45242 45253 3408b7f ___crtIsPackagedApp 45252->45253 45254 3408b83 GetModuleHandleW GetProcAddress 45253->45254 45255 3408bda CreateFileW 45253->45255 45256 3408ba0 45254->45256 45257 3408bf8 45255->45257 45256->45257 45257->45238 45257->45243 45258->45242 45259->45245 45260->45248 45261->45251 45262 33e237a 45263 33e2384 __EH_prolog 45262->45263 45265 33e256d 45263->45265 45266 33eb965 45263->45266 45269 33ec786 45266->45269 45268 33eb984 45268->45265 45270 33ec790 __EH_prolog 45269->45270 45271 33ef5e9 45270->45271 45272 33ec7a1 45270->45272 45648 33ebd76 GetFileSize 45271->45648 45273 33ec7ac 45272->45273 45274 33ef5da ExtCreateRegion 45272->45274 45276 33ec7da 45273->45276 45544 33ebabf 62 API calls __EH_prolog 45273->45544 45294 33ef5bf 45274->45294 45280 33ec81f 45276->45280 45545 33ec0bc GetDesktopWindow GetDC DrawFocusRect GetSysColorBrush 45276->45545 45279 33ec8ef 45507 33efb8c 45279->45507 45280->45279 45546 33ebeaa GetFileSize 45280->45546 45282 33ec917 45513 33d0c05 45282->45513 45285 33ec928 45519 33c1868 45285->45519 45287 33ec947 45522 33ef8ab 45287->45522 45290 33ec9a5 Mailbox 45291 33eca64 Mailbox 45290->45291 45527 33c13c5 45290->45527 45535 33f7da6 45291->45535 45294->45268 45295 33c13c5 59 API calls 45314 33ecac8 Mailbox 45295->45314 45296 33c1868 59 API calls Mailbox 45296->45314 45297 33ecd73 Mailbox 45298 33ecdd7 45297->45298 45306 33ecde1 45297->45306 45549 33ef68b 7 API calls 45298->45549 45300 33ecddf 45300->45306 45301 33ece83 45302 33eceb0 45301->45302 45551 33f8bee 67 API calls __cinit 45301->45551 45307 33c1868 Mailbox 59 API calls 45302->45307 45327 33ef42e Mailbox 45302->45327 45306->45301 45309 33ec786 197 API calls 45306->45309 45550 33ef85f GetFileSize LookupPrivilegeValueW 45306->45550 45310 33ececf 45307->45310 45308 33c13c5 59 API calls 45308->45314 45309->45306 45552 33ef719 8 API calls 45310->45552 45313 33ecef1 45553 33ebc9f SetLastError 45313->45553 45314->45296 45314->45297 45314->45308 45547 33ec0bc GetDesktopWindow GetDC DrawFocusRect GetSysColorBrush 45314->45547 45548 33ebeaa GetFileSize 45314->45548 45317 33ecf0f 45319 33ecf67 Mailbox 45317->45319 45320 33ecf4a GetOverlappedResult 45317->45320 45554 33ef61e 10 API calls 45317->45554 45319->45319 45321 33c1868 Mailbox 59 API calls 45319->45321 45320->45317 45322 33ecfeb 45321->45322 45323 33c1868 Mailbox 59 API calls 45322->45323 45326 33ecffc 45323->45326 45555 33ef956 66 API calls 45326->45555 45327->45294 45644 33e08ac 65 API calls 45327->45644 45645 33eba77 59 API calls 45327->45645 45646 33ef85f GetFileSize LookupPrivilegeValueW 45327->45646 45647 33ef956 66 API calls 45327->45647 45330 33ed061 45335 33ed08b Mailbox 45330->45335 45556 33ebc9f SetLastError 45330->45556 45332 33c1868 Mailbox 59 API calls 45332->45335 45333 33ed1cc GetDesktopWindow SetWindowLongW 45333->45335 45335->45332 45335->45333 45336 33ed1f0 Mailbox 45335->45336 45557 33ebe07 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW GetSysColorBrush 45335->45557 45558 33c7c6d 45336->45558 45341 33ed22d 45347 33ed2d9 45341->45347 45563 33ef7b0 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW GetSysColorBrush 45341->45563 45564 33ec036 7 API calls 45341->45564 45344 33ed481 45346 33c1868 Mailbox 59 API calls 45344->45346 45345 33ed3ac 45345->45344 45566 33efa09 GetSysColorBrush 45345->45566 45349 33ed49b 45346->45349 45347->45345 45565 33ec036 7 API calls 45347->45565 45350 33ed50e 45349->45350 45351 33ed55b 45349->45351 45352 33ed559 Mailbox 45350->45352 45567 33ef9b7 7 API calls 45350->45567 45351->45352 45353 33ed560 45351->45353 45356 33c7c6d 59 API calls 45352->45356 45353->45351 45568 33ef68b 7 API calls 45353->45568 45357 33ed591 45356->45357 45569 33efa89 59 API calls 45357->45569 45359 33ed59d 45360 33c1868 Mailbox 59 API calls 45359->45360 45365 33ed607 Mailbox 45360->45365 45361 33c1868 Mailbox 59 API calls 45361->45365 45362 33ed6c6 Mailbox 45364 33c1868 Mailbox 59 API calls 45362->45364 45366 33ed793 45364->45366 45365->45361 45365->45362 45365->45365 45570 33efa09 GetSysColorBrush 45365->45570 45571 33ebc4d 7 API calls 45366->45571 45368 33ed7b3 45572 33ebeaa GetFileSize 45368->45572 45370 33eda25 45372 33c1868 Mailbox 59 API calls 45370->45372 45371 33ed803 Mailbox 45371->45370 45573 33ec20f 45371->45573 45605 33ef7b0 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW GetSysColorBrush 45371->45605 45379 33edb39 45372->45379 45375 33edcc6 Mailbox 45376 33c7c6d 59 API calls 45375->45376 45377 33edce3 45376->45377 45607 33efa89 59 API calls 45377->45607 45379->45375 45606 33ebc9f SetLastError 45379->45606 45382 33edf32 45383 33c7c6d 59 API calls 45382->45383 45385 33edf4a 45383->45385 45384 33edcf2 45384->45382 45608 33ebe5c 87 API calls 45384->45608 45609 33efa89 59 API calls 45385->45609 45387 33edf59 45387->45387 45388 33c7c6d 59 API calls 45387->45388 45389 33edfee 45388->45389 45610 33efa89 59 API calls 45389->45610 45391 33edffd 45392 33c7c6d 59 API calls 45391->45392 45393 33ee093 45392->45393 45611 33efa89 59 API calls 45393->45611 45395 33ee0a4 45395->45395 45396 33c7c6d 59 API calls 45395->45396 45397 33ee127 45396->45397 45612 33efa89 59 API calls 45397->45612 45399 33ee133 45399->45399 45400 33c7c6d 59 API calls 45399->45400 45401 33ee1af 45400->45401 45613 33efa89 59 API calls 45401->45613 45403 33ee1bb 45404 33c7c6d 59 API calls 45403->45404 45405 33ee25c 45404->45405 45614 33efa89 59 API calls 45405->45614 45407 33ee268 45409 33ee348 45407->45409 45615 33ebc9f SetLastError 45407->45615 45410 33c7c6d 59 API calls 45409->45410 45411 33ee360 45410->45411 45616 33efa89 59 API calls 45411->45616 45413 33ee36c 45414 33c7c6d 59 API calls 45413->45414 45415 33ee425 45414->45415 45617 33efa89 59 API calls 45415->45617 45417 33ee436 45418 33c7c6d 59 API calls 45417->45418 45419 33ee518 45418->45419 45618 33efa89 59 API calls 45419->45618 45421 33ee524 45422 33c7c6d 59 API calls 45421->45422 45423 33ee5f9 45422->45423 45619 33efa89 59 API calls 45423->45619 45425 33ee605 45426 33c7c6d 59 API calls 45425->45426 45427 33ee6e4 45426->45427 45620 33efa89 59 API calls 45427->45620 45429 33ee6f3 45430 33c7c6d 59 API calls 45429->45430 45431 33ee7a2 45430->45431 45621 33efa89 59 API calls 45431->45621 45433 33ee7b3 45435 33ee8c2 45433->45435 45622 33ebeaa GetFileSize 45433->45622 45436 33c7c6d 59 API calls 45435->45436 45437 33ee8da 45436->45437 45623 33efa89 59 API calls 45437->45623 45439 33ee8eb 45441 33ee9c5 45439->45441 45624 33ebe07 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW GetSysColorBrush 45439->45624 45442 33c7c6d 59 API calls 45441->45442 45443 33ee9dd 45442->45443 45625 33efa89 59 API calls 45443->45625 45445 33ee9e9 45447 33eea97 45445->45447 45626 33ebbf8 7 API calls 45445->45626 45448 33c7c6d 59 API calls 45447->45448 45449 33eeaa9 45448->45449 45627 33efa89 59 API calls 45449->45627 45451 33eeaba 45451->45451 45452 33c7c6d 59 API calls 45451->45452 45453 33eeb48 45452->45453 45628 33efa89 59 API calls 45453->45628 45455 33eeb54 45457 33eec20 45455->45457 45629 33ef76f 7 API calls 45455->45629 45458 33c7c6d 59 API calls 45457->45458 45459 33eec38 45458->45459 45630 33efa89 59 API calls 45459->45630 45461 33eec44 45461->45461 45462 33c7c6d 59 API calls 45461->45462 45463 33eecea 45462->45463 45631 33efa89 59 API calls 45463->45631 45465 33eecf9 45466 33c7c6d 59 API calls 45465->45466 45467 33eedb1 45466->45467 45632 33efa89 59 API calls 45467->45632 45469 33eedc0 45471 33eee89 45469->45471 45633 33ebc4d 7 API calls 45469->45633 45472 33c7c6d 59 API calls 45471->45472 45473 33eeea1 45472->45473 45634 33efa89 59 API calls 45473->45634 45475 33eeeb0 45476 33c7c6d 59 API calls 45475->45476 45477 33eef8f 45476->45477 45635 33efa89 59 API calls 45477->45635 45479 33eef9e 45481 33ef06c 45479->45481 45636 33ef80a 7 API calls 45479->45636 45482 33c7c6d 59 API calls 45481->45482 45483 33ef084 45482->45483 45637 33efa89 59 API calls 45483->45637 45485 33ef093 45486 33c7c6d 59 API calls 45485->45486 45487 33ef141 45486->45487 45638 33efa89 59 API calls 45487->45638 45489 33ef150 45491 33ef217 45489->45491 45639 33ef80a 7 API calls 45489->45639 45492 33c7c6d 59 API calls 45491->45492 45493 33ef22f 45492->45493 45640 33efa89 59 API calls 45493->45640 45495 33ef23e 45495->45495 45496 33c7c6d 59 API calls 45495->45496 45497 33ef2db 45496->45497 45641 33efa89 59 API calls 45497->45641 45499 33ef2ea 45499->45499 45500 33c7c6d 59 API calls 45499->45500 45501 33ef363 45500->45501 45642 33efa89 59 API calls 45501->45642 45503 33ef374 45504 33c7c6d 59 API calls 45503->45504 45505 33ef422 45504->45505 45643 33efa89 59 API calls 45505->45643 45508 33efb96 __EH_prolog 45507->45508 45649 33ef83d 45508->45649 45512 33efbd9 45512->45282 45514 33d0c0f __EH_prolog 45513->45514 45515 33d0b8a 59 API calls 45514->45515 45516 33d0c1e 45515->45516 45517 33d0c43 45516->45517 45682 33d189c 59 API calls 45516->45682 45517->45285 45683 33c315c 45519->45683 45521 33c1883 Mailbox 45521->45287 45523 33ef8b4 45522->45523 45526 33ef8c8 45522->45526 45693 33ec1f7 7 API calls 45523->45693 45525 33ef8c3 45525->45290 45526->45290 45528 33c13de 45527->45528 45534 33c141c _Ucopy 45527->45534 45529 33c1405 45528->45529 45530 33c14a3 45528->45530 45528->45534 45694 33dd594 59 API calls 3 library calls 45529->45694 45695 33f8863 59 API calls 2 library calls 45530->45695 45534->45290 45536 33c1868 Mailbox 59 API calls 45535->45536 45537 33f7dba 45536->45537 45538 33f7e56 Mailbox 45537->45538 45540 33f7e2a GetDesktopWindow GetDC GetTextExtentPointW 45537->45540 45696 33f7d6a 45538->45696 45540->45537 45541 33f7e64 45700 33f7b07 45541->45700 45544->45276 45545->45280 45546->45280 45547->45314 45548->45314 45549->45300 45550->45306 45551->45302 45552->45313 45553->45317 45554->45317 45555->45330 45556->45335 45557->45335 45559 33c7c89 45558->45559 45914 33c8068 45559->45914 45561 33c7c95 45562 33efa89 59 API calls 45561->45562 45562->45341 45563->45341 45564->45341 45565->45347 45566->45345 45567->45350 45568->45353 45569->45359 45570->45365 45571->45368 45572->45371 45574 33ec219 __EH_prolog 45573->45574 45575 33ec22a 45574->45575 45576 33ec731 45574->45576 45577 33ec244 45575->45577 45578 33ec230 QueryDosDeviceW 45575->45578 45948 33ebba8 SetLastError 45576->45948 45580 33c1868 Mailbox 59 API calls 45577->45580 45594 33ec720 45578->45594 45581 33ec253 45580->45581 45937 33efa09 GetSysColorBrush 45581->45937 45583 33ec281 45587 33ec2bf 45583->45587 45938 33ec1f7 7 API calls 45583->45938 45585 33ec316 Mailbox 45940 33d6456 59 API calls char_traits 45585->45940 45587->45585 45939 33ef916 SetLastError GetDesktopWindow GetDC GetTextExtentPointW 45587->45939 45589 33ec392 GetDesktopWindow GetDC SetViewportExtEx 45602 33ec32f char_traits Mailbox 45589->45602 45591 33ec6ca 45592 33ec70b 45591->45592 45947 33ef9b7 7 API calls 45591->45947 45592->45594 45597 33d1790 59 API calls 45592->45597 45594->45371 45595 33c1868 Mailbox 59 API calls 45595->45602 45597->45594 45599 33ec62d 45599->45591 45944 33efa09 GetSysColorBrush 45599->45944 45945 33ef6ff 7 API calls 45599->45945 45946 33ec081 87 API calls 45599->45946 45602->45589 45602->45595 45602->45599 45604 33ef8ab 7 API calls 45602->45604 45941 33ef61e 10 API calls 45602->45941 45942 33ef719 8 API calls 45602->45942 45943 33ebabf 62 API calls __EH_prolog 45602->45943 45604->45602 45605->45371 45606->45379 45607->45384 45608->45384 45609->45387 45610->45391 45611->45395 45612->45399 45613->45403 45614->45407 45615->45407 45616->45413 45617->45417 45618->45421 45619->45425 45620->45429 45621->45433 45622->45433 45623->45439 45624->45439 45625->45445 45626->45445 45627->45451 45628->45455 45629->45455 45630->45461 45631->45465 45632->45469 45633->45469 45634->45475 45635->45479 45636->45479 45637->45485 45638->45489 45639->45489 45640->45495 45641->45499 45642->45503 45643->45327 45644->45327 45645->45327 45646->45327 45647->45327 45648->45294 45650 33ec20f 87 API calls 45649->45650 45651 33ef85a 45650->45651 45652 33d0b8a 45651->45652 45655 33d1790 45652->45655 45654 33d0bab 45654->45512 45656 33d1818 45655->45656 45657 33d17a5 45655->45657 45675 33f8891 45656->45675 45658 33d17c9 45657->45658 45659 33d17b2 45657->45659 45674 33d1534 59 API calls std::_Xinvalid_argument 45658->45674 45672 33c3f2e 59 API calls 45659->45672 45663 33d17ba 45673 33d189c 59 API calls 45663->45673 45670 33d17c7 45670->45654 45672->45663 45673->45670 45674->45670 45680 33fbccd 58 API calls std::exception::_Copy_str 45675->45680 45677 33f88a9 45681 33f9254 RaiseException 45677->45681 45679 33f88be 45680->45677 45681->45679 45682->45517 45684 33c3178 45683->45684 45690 33c3174 45683->45690 45685 33c319c 45684->45685 45686 33c3180 45684->45686 45692 33f8863 59 API calls 2 library calls 45685->45692 45691 33dd594 59 API calls 3 library calls 45686->45691 45690->45521 45691->45690 45693->45525 45694->45534 45697 33f7d74 __EH_prolog 45696->45697 45708 33f8a6d 45697->45708 45699 33f7d7c 45699->45541 45701 33f7b26 45700->45701 45702 33f7baf 45701->45702 45703 33f7b52 GetSysColorBrush 45701->45703 45706 33f7b6a GetDesktopWindow SetWindowTextW 45701->45706 45707 33f7b80 FormatMessageW 45701->45707 45743 33f7be3 45702->45743 45703->45701 45705 33eca7f 45705->45294 45705->45295 45706->45701 45707->45701 45710 33f8a75 45708->45710 45711 33f8a8f 45710->45711 45713 33f8a93 std::exception::exception 45710->45713 45716 33fc44c 45710->45716 45733 33fe8b1 DecodePointer 45710->45733 45711->45699 45734 33f9254 RaiseException 45713->45734 45715 33f8abd 45717 33fc4c7 45716->45717 45721 33fc458 45716->45721 45741 33fe8b1 DecodePointer 45717->45741 45719 33fc4cd 45742 33fbf95 58 API calls __getptd_noexit 45719->45742 45720 33fc463 45720->45721 45735 340345d 58 API calls 2 library calls 45720->45735 45736 34034ba 58 API calls 6 library calls 45720->45736 45737 33fe918 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 45720->45737 45721->45720 45724 33fc48b RtlAllocateHeap 45721->45724 45727 33fc4b3 45721->45727 45731 33fc4b1 45721->45731 45738 33fe8b1 DecodePointer 45721->45738 45724->45721 45725 33fc4bf 45724->45725 45725->45710 45739 33fbf95 58 API calls __getptd_noexit 45727->45739 45740 33fbf95 58 API calls __getptd_noexit 45731->45740 45733->45710 45734->45715 45735->45720 45736->45720 45738->45721 45739->45731 45740->45725 45741->45719 45742->45725 45744 33f7bed __EH_prolog 45743->45744 45757 33d0bf0 45744->45757 45747 33f7c23 45748 33f7c7c 45747->45748 45760 33d11ba 45747->45760 45748->45705 45752 33f8a6d _Allocate 59 API calls 45753 33f7c48 45752->45753 45763 33f77d0 45753->45763 45755 33f7c70 45755->45748 45777 33f7aee 59 API calls 45755->45777 45758 33d0b8a 59 API calls 45757->45758 45759 33d0bfe 45758->45759 45759->45747 45776 33d0c9a 59 API calls 45759->45776 45778 33d11c2 45760->45778 45762 33d11c0 45762->45748 45762->45752 45764 33f77da __EH_prolog 45763->45764 45786 33f7508 45764->45786 45769 33f781b 45811 33f74ec 59 API calls 45769->45811 45770 33f7801 45773 33f780f 45770->45773 45810 33d24d8 65 API calls 2 library calls 45770->45810 45775 33f7865 45773->45775 45812 33d24d8 65 API calls 2 library calls 45773->45812 45775->45755 45776->45747 45777->45748 45781 33d0e75 45778->45781 45780 33d11cf 45780->45762 45782 33c1868 Mailbox 59 API calls 45781->45782 45783 33d0e89 45782->45783 45784 33d0ef9 GetDesktopWindow GetDC GetTextExtentPointW 45783->45784 45785 33d0f25 Mailbox 45783->45785 45784->45783 45785->45780 45813 33f7568 45786->45813 45788 33f7518 45789 33d25ac 45788->45789 45790 33c1868 Mailbox 59 API calls 45789->45790 45791 33d25c2 45790->45791 45792 33d2662 Mailbox 45791->45792 45793 33d2637 GetDesktopWindow GetDC GetTextExtentPointW 45791->45793 45794 33d2675 45792->45794 45817 33d0806 45792->45817 45793->45791 45794->45769 45794->45770 45796 33d273c 45831 33d2852 45796->45831 45797 33d26db GetSysColorBrush 45800 33d2688 Mailbox 45797->45800 45800->45794 45800->45796 45800->45797 45803 33d26f6 GetDesktopWindow SetWindowTextW 45800->45803 45807 33d270b FormatMessageW 45800->45807 45801 33d276d 45852 33d2800 65 API calls Mailbox 45801->45852 45802 33d2779 45805 33d27a9 45802->45805 45806 33d278a 45802->45806 45803->45800 45805->45794 45809 33d27b8 GetDesktopWindow GetDC SetViewportExtEx 45805->45809 45806->45794 45808 33d2792 GetDesktopWindow SetDlgItemInt 45806->45808 45807->45800 45808->45794 45809->45794 45810->45773 45811->45773 45812->45775 45814 33f7572 __EH_prolog 45813->45814 45815 33f8a6d _Allocate 59 API calls 45814->45815 45816 33f7581 45815->45816 45816->45788 45818 33c1868 Mailbox 59 API calls 45817->45818 45819 33d081d 45818->45819 45820 33d08ba Mailbox 45819->45820 45821 33d0891 GetDesktopWindow GetDC GetTextExtentPointW 45819->45821 45853 33d1268 45820->45853 45821->45819 45823 33d08ca 45824 33d098f 45823->45824 45828 33d08d2 45823->45828 45857 33d20be 45824->45857 45826 33d096c 45826->45800 45827 33d0913 GetSysColorBrush 45827->45828 45828->45826 45828->45827 45829 33d092b GetDesktopWindow SetWindowTextW 45828->45829 45830 33d093d FormatMessageW 45828->45830 45829->45828 45830->45828 45832 33c1868 Mailbox 59 API calls 45831->45832 45833 33d2869 45832->45833 45834 33d28d9 GetDesktopWindow GetDC GetTextExtentPointW 45833->45834 45836 33d2905 Mailbox 45833->45836 45834->45833 45835 33d2769 45835->45801 45835->45802 45836->45835 45837 33d2943 CreateFileMappingW 45836->45837 45838 33d09bd 65 API calls 45837->45838 45840 33d2950 45838->45840 45839 33d298f GetSysColorBrush 45839->45840 45840->45839 45841 33d29ec Mailbox 45840->45841 45842 33d29a7 GetDesktopWindow SetWindowTextW 45840->45842 45845 33d29bd FormatMessageW 45840->45845 45841->45835 45843 33d2a2d 45841->45843 45844 33d2a50 45841->45844 45842->45840 45846 33d2a35 GetDesktopWindow SetDlgItemInt 45843->45846 45848 33d2a7e 45843->45848 45847 33d2a5f GetDesktopWindow GetDC SetViewportExtEx 45844->45847 45844->45848 45845->45840 45846->45848 45847->45848 45850 33d2a97 45848->45850 45913 33d254a 74 API calls 45848->45913 45850->45835 45851 33d2b42 MapViewOfFile 45850->45851 45851->45835 45852->45794 45854 33d1272 __EH_prolog 45853->45854 45874 33d0f96 45854->45874 45856 33d128e char_traits 45856->45823 45858 33c1868 Mailbox 59 API calls 45857->45858 45859 33d20d5 45858->45859 45860 33d2145 GetDesktopWindow GetDC GetTextExtentPointW 45859->45860 45865 33d2173 Mailbox 45859->45865 45860->45859 45861 33d2239 45863 33d229a 45861->45863 45864 33d2276 45861->45864 45862 33d21d4 GetSysColorBrush 45862->45865 45867 33d22aa GetDesktopWindow GetDC SetViewportExtEx 45863->45867 45870 33d22c9 45863->45870 45866 33d227f GetDesktopWindow SetDlgItemInt 45864->45866 45864->45870 45865->45861 45865->45862 45868 33d21ef GetDesktopWindow SetWindowTextW 45865->45868 45869 33d2208 FormatMessageW 45865->45869 45866->45870 45867->45870 45868->45865 45869->45865 45871 33d23ac CreateFileW 45870->45871 45873 33d23b8 Mailbox 45870->45873 45905 33d09bd 45871->45905 45873->45826 45875 33d0fa0 __EH_prolog 45874->45875 45876 33d0bf0 59 API calls 45875->45876 45904 33d1171 45875->45904 45877 33d0fe4 45876->45877 45878 33d0d7f 62 API calls 45877->45878 45896 33d0ffc 45878->45896 45879 33d0cb8 78 API calls 45879->45896 45880 33d0cf6 62 API calls 45880->45896 45881 33d1091 45882 33d0c9a 59 API calls 45881->45882 45884 33d109e char_traits 45882->45884 45883 33d10ea 45886 33d0d7f 62 API calls 45883->45886 45884->45883 45887 33c917f 59 API calls 45884->45887 45885 33d0cd3 78 API calls 45885->45896 45890 33d1106 45886->45890 45892 33d10cd 45887->45892 45888 33d1f69 59 API calls 45888->45896 45889 33d0d7f 62 API calls 45889->45896 45891 33d0e75 62 API calls 45890->45891 45893 33d1113 45891->45893 45892->45883 45895 33d0cf6 62 API calls 45892->45895 45897 33d1790 59 API calls 45893->45897 45903 33d1148 45893->45903 45894 33d0c9a 59 API calls 45894->45896 45898 33d10dd 45895->45898 45896->45879 45896->45880 45896->45881 45896->45885 45896->45888 45896->45889 45896->45894 45900 33d1138 45897->45900 45901 33d1f69 59 API calls 45898->45901 45899 33d0a22 59 API calls 45899->45904 45902 33d1efc 59 API calls 45900->45902 45901->45883 45902->45903 45903->45899 45904->45856 45906 33d09cb 45905->45906 45907 33d09ed 45905->45907 45908 33d07d3 Mailbox 65 API calls 45906->45908 45907->45873 45909 33d09d0 Mailbox 45908->45909 45909->45907 45910 33d5ad9 Mailbox 62 API calls 45909->45910 45911 33d09e2 45910->45911 45912 33df401 62 API calls 45911->45912 45912->45907 45913->45850 45915 33c8078 45914->45915 45916 33c807c 45915->45916 45917 33c8098 45915->45917 45921 33c3a93 45916->45921 45933 33c36e6 59 API calls std::_Xinvalid_argument 45917->45933 45920 33c8096 _memmove 45920->45561 45922 33c3b1c 45921->45922 45923 33c3aa8 45921->45923 45924 33f8891 59 API calls 45922->45924 45925 33c3acc 45923->45925 45926 33c3ab5 45923->45926 45928 33c3b26 45924->45928 45936 33c36e6 59 API calls std::_Xinvalid_argument 45925->45936 45934 33c3eff 59 API calls 45926->45934 45930 33c3abd 45935 33c3e7d 59 API calls _memmove 45930->45935 45932 33c3aca _memmove 45932->45920 45933->45920 45934->45930 45935->45932 45936->45932 45937->45583 45938->45583 45939->45587 45940->45602 45941->45602 45942->45602 45943->45602 45944->45599 45945->45599 45946->45599 45947->45591 45948->45594 45949 54d2c29 45950 54d2c49 __except_handler4 45949->45950 45951 54d2c45 GetLocaleInfoEx 45949->45951 45952 54d2c4e GetLocaleInfoW 45950->45952 45953 3408c45 45954 3408c1e 45953->45954 45956 3408c54 45953->45956 45961 33fbf95 58 API calls __getptd_noexit 45954->45961 45963 3408c99 LeaveCriticalSection __unlock_fhandle 45956->45963 45957 3408c23 45962 3400efc 9 API calls __write 45957->45962 45960 3408c2d __write 45961->45957 45962->45960 45963->45960 45964 33e8ebb 45977 33e8ed5 Mailbox 45964->45977 45965 33ea1a9 45966 33c1868 Mailbox 59 API calls 45965->45966 45967 33ea210 45966->45967 46068 33eac9b 45967->46068 45972 33fca22 85 API calls _fseek 45972->45977 45973 33ea244 Mailbox 45977->45965 45977->45972 45980 33eb587 85 API calls 45977->45980 45983 33e6eae 59 API calls 45977->45983 45984 33c7c6d 59 API calls 45977->45984 45985 33c17a1 59 API calls 45977->45985 45986 33eb820 59 API calls 45977->45986 45987 33de3b4 59 API calls 45977->45987 45994 33ea2a8 45977->45994 45997 33c7c9c 45977->45997 46001 33e6ffc 45977->46001 46004 33e6fd5 45977->46004 46007 33fce35 45977->46007 46020 33d5c51 45977->46020 46027 33fc8e7 45977->46027 46030 33d49d0 45977->46030 46034 33fd30d 45977->46034 46041 33e741f 45977->46041 46044 33e04f7 45977->46044 46052 33e6eff 59 API calls __EH_prolog 45977->46052 46053 33e6f6a 59 API calls __EH_prolog 45977->46053 46054 33e08ac 65 API calls 45977->46054 46055 33eb30e 61 API calls __EH_prolog 45977->46055 46056 33e750b 59 API calls __EH_prolog 45977->46056 46057 33eb42f 63 API calls __EH_prolog 45977->46057 46058 33eb108 45977->46058 45980->45977 45983->45977 45984->45977 45985->45977 45986->45977 45987->45977 46048 33e0391 45994->46048 45998 33c7cba char_traits 45997->45998 46072 33c80e1 45998->46072 46000 33c7cc6 46000->45977 46081 33e7a2b 46001->46081 46003 33e7014 46003->45977 46211 33e777c 46004->46211 46006 33e6fec 46006->45977 46008 33fce41 __write 46007->46008 46009 33fce68 46008->46009 46010 33fce53 46008->46010 46223 3403959 46009->46223 46258 33fbf95 58 API calls __getptd_noexit 46010->46258 46013 33fce58 46259 3400efc 9 API calls __write 46013->46259 46019 33fce63 __write 46019->45977 46021 33d5c94 46020->46021 46022 33d5c60 46020->46022 46366 33f8863 59 API calls 2 library calls 46021->46366 46359 33c3749 46022->46359 46026 33d5c68 46026->45977 46379 33fc902 46027->46379 46029 33fc8fd 46029->45977 46031 33d49de 46030->46031 46032 33d49e2 46030->46032 46031->45977 46476 33d48bf 46032->46476 46036 33fd319 __write FindCompleteObject FindMITargetTypeInstance FindVITargetTypeInstance 46034->46036 46035 33fd320 PMDtoOffset __write 46035->45977 46036->46035 46503 33fbc7a 58 API calls std::exception::exception 46036->46503 46038 33fd3ad 46504 33f9254 RaiseException 46038->46504 46040 33fd3bb 46040->45977 46505 33e70c0 46041->46505 46043 33e7446 46043->45977 46045 33e0501 __EH_prolog 46044->46045 46519 33c17a1 46045->46519 46047 33e0556 46047->45977 46049 33e039a 46048->46049 46522 33e172d 46049->46522 46052->45977 46053->45977 46054->45977 46055->45977 46056->45977 46057->45977 46059 33eb155 46058->46059 46060 33eb111 46058->46060 46531 33eb53d 85 API calls 46059->46531 46062 33eb117 46060->46062 46063 33eb133 46060->46063 46530 33e7822 59 API calls 46062->46530 46064 33eb13d GetDesktopWindow GetDC DrawFocusRect 46063->46064 46065 33eb165 46063->46065 46064->45977 46065->45977 46067 33eb126 46067->45977 46069 33eaca4 46068->46069 46070 33eacaa 46068->46070 46069->46070 46071 33eacd9 SetLastError 46069->46071 46070->45973 46071->45973 46073 33c80f1 46072->46073 46074 33c80f5 46073->46074 46075 33c8113 46073->46075 46079 33c3c34 59 API calls 46074->46079 46080 33c37ac 59 API calls std::_Xinvalid_argument 46075->46080 46078 33c8111 46078->46000 46079->46078 46080->46078 46082 33e7b59 46081->46082 46083 33f8891 59 API calls 46082->46083 46084 33e7b63 __EH_prolog 46083->46084 46085 33e7bbd 46084->46085 46195 33eb42f 63 API calls __EH_prolog 46084->46195 46087 33eb108 88 API calls 46085->46087 46088 33e7be6 46087->46088 46174 33eaedf 46088->46174 46090 33e7bef 46091 33c1868 Mailbox 59 API calls 46090->46091 46094 33e7c9a Mailbox 46091->46094 46092 33c13c5 59 API calls 46092->46094 46094->46092 46095 33e7dcd Mailbox 46094->46095 46177 33eb1f1 46094->46177 46096 33c13c5 59 API calls 46095->46096 46097 33e7ff1 Mailbox 46096->46097 46098 33c7c6d 59 API calls 46097->46098 46099 33e82a2 46098->46099 46101 33e82ea 46099->46101 46196 33ead1c 84 API calls 46099->46196 46102 33e83b5 ExtCreateRegion 46101->46102 46103 33e83c7 46101->46103 46102->46101 46104 33c7c9c 59 API calls 46103->46104 46105 33e8481 46104->46105 46106 33c1868 Mailbox 59 API calls 46105->46106 46107 33e849f Mailbox 46106->46107 46108 33c7c6d 59 API calls 46107->46108 46109 33e8563 46108->46109 46110 33c1868 Mailbox 59 API calls 46109->46110 46111 33e8574 46110->46111 46112 33c1868 Mailbox 59 API calls 46111->46112 46113 33e8585 46112->46113 46184 33eaf12 46113->46184 46115 33e85bd 46116 33eac9b SetLastError 46115->46116 46120 33e860b Mailbox 46116->46120 46117 33c1868 Mailbox 59 API calls 46117->46120 46120->46117 46121 33e8769 Mailbox 46120->46121 46197 33eb255 89 API calls 46120->46197 46198 33eb4d2 90 API calls 46120->46198 46122 33c7c6d 59 API calls 46121->46122 46123 33e8806 46122->46123 46126 33e8882 46123->46126 46199 33eb255 89 API calls 46123->46199 46200 33eb4d2 90 API calls 46123->46200 46127 33c1868 Mailbox 59 API calls 46126->46127 46128 33e897b 46127->46128 46191 33ea56f 46128->46191 46130 33e89a4 46132 33e8a4b Mailbox 46130->46132 46201 33eae82 87 API calls 46130->46201 46133 33c1868 Mailbox 59 API calls 46132->46133 46137 33e8b38 Mailbox 46133->46137 46134 33c1868 Mailbox 59 API calls 46134->46137 46135 33e8beb Mailbox 46136 33c7c6d 59 API calls 46135->46136 46138 33e8c9f 46136->46138 46137->46134 46137->46135 46137->46137 46139 33c1868 Mailbox 59 API calls 46138->46139 46140 33e8d27 Mailbox 46139->46140 46141 33ea56f 63 API calls 46140->46141 46169 33e8e87 Mailbox 46141->46169 46142 33ea1a9 46143 33c1868 Mailbox 59 API calls 46142->46143 46144 33ea210 46143->46144 46146 33eac9b SetLastError 46144->46146 46145 33c7c9c 59 API calls 46145->46169 46173 33ea244 Mailbox 46146->46173 46147 33e6ffc 195 API calls 46147->46169 46148 33e6fd5 59 API calls 46148->46169 46149 33fce35 69 API calls 46149->46169 46150 33fca22 85 API calls _fseek 46150->46169 46151 33d5c51 59 API calls 46151->46169 46152 33fc8e7 __fread_nolock 62 API calls 46152->46169 46153 33eb587 85 API calls 46153->46169 46154 33d49d0 115 API calls 46154->46169 46155 33fd30d 59 API calls 46155->46169 46156 33e741f 59 API calls 46156->46169 46158 33c7c6d 59 API calls 46158->46169 46159 33de3b4 59 API calls 46159->46169 46160 33c17a1 59 API calls 46160->46169 46161 33eb820 59 API calls 46161->46169 46165 33e6eae 59 API calls 46165->46169 46166 33e04f7 59 API calls 46166->46169 46169->46142 46169->46145 46169->46147 46169->46148 46169->46149 46169->46150 46169->46151 46169->46152 46169->46153 46169->46154 46169->46155 46169->46156 46169->46158 46169->46159 46169->46160 46169->46161 46169->46165 46169->46166 46170 33ea2a8 46169->46170 46172 33eb108 88 API calls 46169->46172 46202 33e6eff 59 API calls __EH_prolog 46169->46202 46203 33e6f6a 59 API calls __EH_prolog 46169->46203 46204 33e08ac 65 API calls 46169->46204 46205 33eb30e 61 API calls __EH_prolog 46169->46205 46206 33e750b 59 API calls __EH_prolog 46169->46206 46207 33eb42f 63 API calls __EH_prolog 46169->46207 46171 33e0391 59 API calls 46170->46171 46171->46173 46172->46169 46173->46003 46175 33eaefe 46174->46175 46176 33eaee8 GetDesktopWindow SetDlgItemTextW 46174->46176 46175->46090 46176->46090 46178 33eb20f 46177->46178 46179 33eb1fa 46177->46179 46182 33eb21d GetOverlappedResult 46178->46182 46183 33eb22c 46178->46183 46208 33eb1c7 88 API calls 46179->46208 46181 33eb20a 46181->46094 46182->46094 46183->46094 46185 33eaf1b 46184->46185 46186 33eaf34 46184->46186 46209 33eac76 VariantClear 46185->46209 46188 33eaf61 GetFileSize 46186->46188 46190 33eaf3a 46186->46190 46188->46190 46189 33eaf2f 46189->46115 46190->46115 46192 33ea61a 46191->46192 46194 33ea57d 46191->46194 46210 33eb564 63 API calls 46192->46210 46194->46130 46195->46085 46196->46101 46197->46120 46198->46120 46199->46123 46200->46123 46201->46130 46202->46169 46203->46169 46204->46169 46205->46169 46206->46169 46207->46169 46208->46181 46209->46189 46210->46194 46212 33e780d 46211->46212 46213 33e7791 46211->46213 46216 33f8891 59 API calls 46212->46216 46214 33e77aa 46213->46214 46215 33e7817 46213->46215 46220 33e77bb 46214->46220 46221 33c37ac 59 API calls std::_Xinvalid_argument 46214->46221 46222 33f8863 59 API calls 2 library calls 46215->46222 46216->46215 46220->46006 46221->46220 46224 3403969 46223->46224 46225 340398b EnterCriticalSection 46223->46225 46224->46225 46226 3403971 46224->46226 46227 33fce6e 46225->46227 46261 3406073 58 API calls 2 library calls 46226->46261 46229 33fcaa5 46227->46229 46230 33fcab2 __ftell_nolock 46229->46230 46231 33fcaca 46230->46231 46232 33fcae2 46230->46232 46297 33fbf95 58 API calls __getptd_noexit 46231->46297 46262 3403895 46232->46262 46235 33fcacf 46298 3400efc 9 API calls __write 46235->46298 46236 33fcaea 46269 34047b0 46236->46269 46239 33fcb06 46242 33fcb89 46239->46242 46243 33fccf6 46239->46243 46256 33fcada 46239->46256 46241 33fce31 46260 33fce99 LeaveCriticalSection LeaveCriticalSection _fseek 46241->46260 46245 33fcbaf 46242->46245 46249 33fccb2 46242->46249 46244 33fccff 46243->46244 46243->46249 46300 33fbf95 58 API calls __getptd_noexit 46244->46300 46245->46256 46299 3404946 62 API calls 4 library calls 46245->46299 46248 33fcbe8 46251 33fcc14 ReadFile 46248->46251 46248->46256 46250 34047b0 __write 64 API calls 46249->46250 46249->46256 46252 33fcd63 46250->46252 46253 33fcc39 46251->46253 46251->46256 46254 34047b0 __write 64 API calls 46252->46254 46252->46256 46255 34047b0 __write 64 API calls 46253->46255 46254->46256 46257 33fcc4c 46255->46257 46301 33fd80b 6 API calls ___raise_securityfailure 46256->46301 46257->46256 46258->46013 46259->46019 46260->46019 46261->46227 46263 34038b4 46262->46263 46264 340389f 46262->46264 46263->46236 46302 33fbf95 58 API calls __getptd_noexit 46264->46302 46266 34038a4 46303 3400efc 9 API calls __write 46266->46303 46268 34038af 46268->46236 46270 34047bc __write 46269->46270 46271 34047e0 46270->46271 46272 34047c9 46270->46272 46273 340487f 46271->46273 46275 34047f4 46271->46275 46326 33fbf61 58 API calls __getptd_noexit 46272->46326 46332 33fbf61 58 API calls __getptd_noexit 46273->46332 46278 3404812 46275->46278 46279 340481c 46275->46279 46277 34047ce 46327 33fbf95 58 API calls __getptd_noexit 46277->46327 46328 33fbf61 58 API calls __getptd_noexit 46278->46328 46304 34086bf 46279->46304 46283 3404817 46333 33fbf95 58 API calls __getptd_noexit 46283->46333 46284 3404822 46286 3404835 46284->46286 46287 3404848 46284->46287 46313 340489f 46286->46313 46329 33fbf95 58 API calls __getptd_noexit 46287->46329 46288 340488b 46334 3400efc 9 API calls __write 46288->46334 46292 34047d5 __write 46292->46239 46293 3404841 46331 3404877 LeaveCriticalSection __unlock_fhandle 46293->46331 46294 340484d 46330 33fbf61 58 API calls __getptd_noexit 46294->46330 46297->46235 46298->46256 46299->46248 46300->46256 46301->46241 46302->46266 46303->46268 46305 34086cb __write 46304->46305 46306 340871a EnterCriticalSection 46305->46306 46335 3406073 58 API calls 2 library calls 46305->46335 46308 3408740 __write 46306->46308 46308->46284 46309 34086f0 46312 3408708 46309->46312 46336 3405938 InitializeCriticalSectionAndSpinCount 46309->46336 46337 3408744 LeaveCriticalSection _doexit 46312->46337 46338 340897c 46313->46338 46315 34048b0 46316 34048c7 SetFilePointerEx 46315->46316 46317 34048b8 46315->46317 46319 34048f3 GetLastError 46316->46319 46320 34048df SetFilePointerEx 46316->46320 46351 33fbf95 58 API calls __getptd_noexit 46317->46351 46352 33fbf74 58 API calls 2 library calls 46319->46352 46320->46319 46321 3404902 46320->46321 46323 3404908 SetFilePointerEx 46321->46323 46324 34048bd 46321->46324 46353 33fbf95 58 API calls __getptd_noexit 46323->46353 46324->46293 46326->46277 46327->46292 46328->46283 46329->46294 46330->46293 46331->46292 46332->46283 46333->46288 46334->46292 46335->46309 46336->46312 46337->46306 46339 3408987 46338->46339 46343 340899c 46338->46343 46354 33fbf61 58 API calls __getptd_noexit 46339->46354 46342 340898c 46355 33fbf95 58 API calls __getptd_noexit 46342->46355 46346 34089c1 46343->46346 46356 33fbf61 58 API calls __getptd_noexit 46343->46356 46344 34089cb 46357 33fbf95 58 API calls __getptd_noexit 46344->46357 46346->46315 46348 3408994 46348->46315 46349 34089d3 46358 3400efc 9 API calls __write 46349->46358 46351->46324 46352->46324 46353->46324 46354->46342 46355->46348 46356->46344 46357->46349 46358->46348 46360 33c3755 46359->46360 46361 33c37a1 46359->46361 46365 33c3763 Mailbox 46360->46365 46367 33c34a1 46360->46367 46371 33f8863 59 API calls 2 library calls 46361->46371 46365->46026 46368 33c34ab __EH_prolog 46367->46368 46372 33c1070 46368->46372 46370 33c3502 Mailbox _memmove 46370->46365 46373 33c107c 46372->46373 46374 33c1087 std::exception::exception 46372->46374 46373->46374 46375 33f8a6d _Allocate 59 API calls 46373->46375 46374->46370 46378 33f9254 RaiseException 46374->46378 46375->46374 46377 33f8862 46378->46377 46380 33fc90e __write 46379->46380 46381 33fc949 __write 46380->46381 46382 33fc924 _memset 46380->46382 46383 33fc951 46380->46383 46381->46029 46405 33fbf95 58 API calls __getptd_noexit 46382->46405 46384 3403959 __lock_file 59 API calls 46383->46384 46386 33fc957 46384->46386 46392 33fc722 46386->46392 46387 33fc93e 46406 3400efc 9 API calls __write 46387->46406 46396 33fc73d _memset 46392->46396 46404 33fc758 46392->46404 46393 33fc748 46428 33fbf95 58 API calls __getptd_noexit 46393->46428 46395 33fc74d 46429 3400efc 9 API calls __write 46395->46429 46396->46393 46403 33fc798 46396->46403 46396->46404 46399 33fc8a9 _memset 46431 33fbf95 58 API calls __getptd_noexit 46399->46431 46400 3403895 __ftell_nolock 58 API calls 46400->46403 46403->46399 46403->46400 46403->46404 46408 3403d6b 46403->46408 46430 3403e8c 58 API calls 3 library calls 46403->46430 46407 33fc98b LeaveCriticalSection LeaveCriticalSection _fseek 46404->46407 46405->46387 46406->46381 46407->46381 46409 3403d76 46408->46409 46414 3403d8b 46408->46414 46462 33fbf95 58 API calls __getptd_noexit 46409->46462 46411 3403d86 46411->46403 46412 3403d7b 46463 3400efc 9 API calls __write 46412->46463 46414->46411 46415 3403dc0 46414->46415 46464 34077c9 58 API calls __malloc_crt 46414->46464 46417 3403895 __ftell_nolock 58 API calls 46415->46417 46418 3403dd4 46417->46418 46432 3403f0b 46418->46432 46420 3403ddb 46420->46411 46421 3403895 __ftell_nolock 58 API calls 46420->46421 46422 3403dfe 46421->46422 46422->46411 46423 3403895 __ftell_nolock 58 API calls 46422->46423 46424 3403e0a 46423->46424 46424->46411 46425 3403895 __ftell_nolock 58 API calls 46424->46425 46426 3403e17 46425->46426 46427 3403895 __ftell_nolock 58 API calls 46426->46427 46427->46411 46428->46395 46429->46404 46430->46403 46431->46395 46433 3403f17 __write 46432->46433 46434 3403f24 46433->46434 46435 3403f3b 46433->46435 46465 33fbf61 58 API calls __getptd_noexit 46434->46465 46437 3403fff 46435->46437 46440 3403f4f 46435->46440 46473 33fbf61 58 API calls __getptd_noexit 46437->46473 46439 3403f29 46466 33fbf95 58 API calls __getptd_noexit 46439->46466 46442 3403f7a 46440->46442 46443 3403f6d 46440->46443 46446 3403f87 46442->46446 46447 3403f9c 46442->46447 46467 33fbf61 58 API calls __getptd_noexit 46443->46467 46444 3403f72 46474 33fbf95 58 API calls __getptd_noexit 46444->46474 46468 33fbf61 58 API calls __getptd_noexit 46446->46468 46448 34086bf ___lock_fhandle 59 API calls 46447->46448 46451 3403fa2 46448->46451 46459 3403fb5 46451->46459 46470 33fbf95 58 API calls __getptd_noexit 46451->46470 46452 3403f94 46475 3400efc 9 API calls __write 46452->46475 46453 3403f8c 46469 33fbf95 58 API calls __getptd_noexit 46453->46469 46455 3403f30 __write 46455->46420 46458 3403fcd 46471 33fbf61 58 API calls __getptd_noexit 46458->46471 46472 3403ff7 LeaveCriticalSection __unlock_fhandle 46459->46472 46462->46412 46463->46411 46464->46415 46465->46439 46466->46455 46467->46444 46468->46453 46469->46452 46470->46458 46471->46459 46472->46455 46473->46444 46474->46452 46475->46455 46477 33d48c9 __EH_prolog 46476->46477 46478 33d48df 46477->46478 46479 33d4902 46477->46479 46480 33d48e7 GetDesktopWindow SetDlgItemInt 46478->46480 46481 33d4930 46478->46481 46479->46481 46482 33d4911 GetDesktopWindow GetDC SetViewportExtEx 46479->46482 46480->46481 46487 33d3e8f 46481->46487 46482->46481 46484 33d4949 46486 33d4972 Mailbox 46484->46486 46500 33d3d54 59 API calls 2 library calls 46484->46500 46486->46031 46488 33d3e99 __EH_prolog 46487->46488 46489 33f8a6d _Allocate 59 API calls 46488->46489 46491 33d3eb4 46488->46491 46489->46491 46501 33d4027 110 API calls 46491->46501 46492 33d3f7b 46492->46484 46493 33d3f42 46493->46492 46494 33d3fc0 46493->46494 46495 33d3fe2 46493->46495 46496 33f8a6d _Allocate 59 API calls 46494->46496 46495->46492 46497 33f8a6d _Allocate 59 API calls 46495->46497 46498 33d3fc7 46496->46498 46497->46492 46498->46492 46502 33d2d22 59 API calls __EH_prolog 46498->46502 46500->46486 46501->46493 46502->46492 46503->46038 46504->46040 46506 33e70ca __EH_prolog 46505->46506 46508 33e711d 46506->46508 46509 33e71e5 46506->46509 46514 33e7163 46506->46514 46515 33f8863 59 API calls 2 library calls 46506->46515 46516 33d09f6 59 API calls 3 library calls 46508->46516 46509->46043 46512 33e7132 46517 33e7307 59 API calls __EH_prolog 46512->46517 46514->46509 46518 33e7307 59 API calls __EH_prolog 46514->46518 46516->46512 46517->46514 46518->46509 46520 33c3a93 59 API calls 46519->46520 46521 33c17c0 46520->46521 46521->46047 46523 33e176d 46522->46523 46524 33e173c 46522->46524 46529 33e15d5 59 API calls 2 library calls 46523->46529 46528 33c3e7d 59 API calls _memmove 46524->46528 46527 33e03be 46527->45973 46528->46527 46529->46527 46530->46067 46531->46065 46532 33e25bb 46534 33e25c5 __EH_prolog 46532->46534 46542 33e2647 46534->46542 46585 33e3353 LookupPrivilegeValueW GetDesktopWindow GetDC DrawFocusRect 46534->46585 46586 33e3cce 13 API calls 46534->46586 46535 33e2716 46566 33e373a 46535->46566 46538 33e2720 46539 33c1868 Mailbox 59 API calls 46538->46539 46540 33e2736 46539->46540 46573 33e368f 46540->46573 46542->46535 46587 33e3a16 61 API calls 46542->46587 46544 33e27a5 Mailbox 46579 33e3f6e 46544->46579 46545 33e2752 46545->46544 46546 33e368f 63 API calls 46545->46546 46546->46545 46548 33e2832 46549 33c1868 Mailbox 59 API calls 46548->46549 46550 33e2892 Mailbox 46549->46550 46551 33c1868 Mailbox 59 API calls 46550->46551 46555 33e293b 46550->46555 46551->46550 46552 33c1868 Mailbox 59 API calls 46553 33e2de1 46552->46553 46592 33e389a LookupPrivilegeValueW GetDesktopWindow GetDC DrawFocusRect GetOverlappedResult 46553->46592 46563 33e29db Mailbox 46555->46563 46588 33e3353 LookupPrivilegeValueW GetDesktopWindow GetDC DrawFocusRect 46555->46588 46556 33e2afc 46591 33e3d77 70 API calls 46556->46591 46559 33e2b14 46560 33c1868 Mailbox 59 API calls 46559->46560 46565 33e2b7d Mailbox 46560->46565 46563->46556 46563->46565 46589 33e3d77 70 API calls 46563->46589 46590 33e39ad 6 API calls 46563->46590 46564 33e2e21 Mailbox 46565->46552 46567 33e3778 46566->46567 46568 33e3743 46566->46568 46593 33e37d6 8 API calls 46567->46593 46569 33e375d GetDesktopWindow SetDlgItemInt 46568->46569 46570 33e3749 46568->46570 46569->46538 46570->46538 46572 33e377f 46572->46538 46574 33e36d8 46573->46574 46575 33e3698 46573->46575 46594 33e3827 61 API calls 46574->46594 46576 33e369e GetDesktopWindow SetDlgItemTextW 46575->46576 46578 33e36b4 46575->46578 46576->46545 46578->46545 46580 33e3f78 __EH_prolog 46579->46580 46595 33e5b6b 46580->46595 46582 33e3fb3 46613 33d06c7 46582->46613 46584 33e3fc2 46584->46548 46585->46534 46586->46534 46587->46542 46588->46555 46589->46563 46590->46563 46591->46559 46592->46564 46593->46572 46594->46578 46596 33e5b75 __EH_prolog 46595->46596 46597 33e5b84 46596->46597 46598 33e5c82 46596->46598 46600 33e5b8f 46597->46600 46601 33e5c65 GetDesktopWindow GetDC GetTextExtentPoint32W 46597->46601 46629 33e5435 62 API calls 46598->46629 46603 33e5bc0 46600->46603 46619 33f8bee 67 API calls __cinit 46600->46619 46602 33e5be2 46601->46602 46602->46582 46605 33e5bc9 46603->46605 46606 33e5be7 46603->46606 46605->46602 46620 33c3b27 46605->46620 46616 33e402b 46606->46616 46611 33e5c22 46611->46602 46612 33c3b27 59 API calls 46611->46612 46612->46602 46614 33c3b27 59 API calls 46613->46614 46615 33d06e6 46614->46615 46615->46584 46630 33e4bdd 46616->46630 46619->46603 46621 33c3bb0 46620->46621 46622 33f8891 59 API calls 46621->46622 46623 33c3bba 46622->46623 46624 33c3beb 46623->46624 46626 33c3b27 59 API calls 46623->46626 46625 33c3749 59 API calls 46624->46625 46627 33c3bf9 _memmove 46625->46627 46626->46624 46627->46602 46628 33e3fe9 150 API calls 46628->46611 46629->46602 46631 33e4be7 __EH_prolog 46630->46631 46632 33e4bfa 46631->46632 46633 33e53f2 46631->46633 46634 33e53e8 RegUnLoadKeyW 46632->46634 46635 33e4c05 46632->46635 46636 33e541e EndMenu 46633->46636 46668 33e404e 46633->46668 46634->46668 46637 33c1868 Mailbox 59 API calls 46635->46637 46636->46668 46641 33e4c63 Mailbox 46637->46641 46638 33c1868 Mailbox 59 API calls 46638->46641 46639 33e4db8 Mailbox 46642 33c1868 Mailbox 59 API calls 46639->46642 46640 33e4bdd 148 API calls 46640->46641 46641->46638 46641->46640 46644 33e4d26 46641->46644 46643 33e4e5d 46642->46643 46669 33e5dd0 46643->46669 46644->46639 46706 33e5f1f 150 API calls 46644->46706 46647 33e4e86 46675 33e6824 46647->46675 46649 33e4ea7 Mailbox 46682 33e42fc 46649->46682 46651 33e4f8e 46652 33e501f 46651->46652 46653 33e42fc 148 API calls 46651->46653 46707 33e5f8e 150 API calls 46651->46707 46659 33e5071 46652->46659 46689 33e3f47 46652->46689 46653->46651 46655 33c1868 Mailbox 59 API calls 46665 33e50f0 Mailbox 46655->46665 46659->46655 46662 33e53ad 46703 33e4058 46662->46703 46692 33e5ece 46665->46692 46667 33e5264 46699 33e5483 46667->46699 46668->46602 46668->46628 46670 33e5e27 46669->46670 46671 33e5dd9 46669->46671 46710 33e5da7 150 API calls 46670->46710 46673 33e5e0e GetDesktopWindow SetWindowLongW 46671->46673 46674 33e5ddf 46671->46674 46673->46647 46674->46647 46676 33e682d 46675->46676 46677 33e683b 46675->46677 46711 33e454c 150 API calls 46676->46711 46679 33e6891 VariantClear 46677->46679 46680 33e6841 46677->46680 46679->46649 46680->46649 46681 33e6837 46681->46649 46683 33e4309 46682->46683 46684 33e4394 46682->46684 46685 33e430f QueryDosDeviceW 46683->46685 46688 33e4320 46683->46688 46712 33e44d4 150 API calls 46684->46712 46685->46651 46687 33e43b0 46687->46651 46688->46651 46713 33e5b40 46689->46713 46693 33e5f08 46692->46693 46694 33e5ed7 46692->46694 46757 33e5528 61 API calls 46693->46757 46696 33e5edd 46694->46696 46697 33e5ee7 FormatMessageW 46694->46697 46696->46667 46697->46667 46698 33e5f1a 46698->46667 46700 33e54d8 46699->46700 46702 33e548c 46699->46702 46701 33e54e6 GetDesktopWindow GetDC DrawFocusRect 46700->46701 46700->46702 46701->46662 46702->46662 46758 33e600c 46703->46758 46705 33e4078 46705->46668 46709 33e5f8e 150 API calls 46705->46709 46706->46644 46707->46651 46708 33e3eb9 150 API calls __EH_prolog 46708->46659 46709->46668 46710->46674 46711->46681 46712->46687 46716 33e4590 46713->46716 46715 33e3f64 46715->46659 46715->46708 46717 33e459a __EH_prolog 46716->46717 46718 33e4b4e 46717->46718 46719 33e45ac 46717->46719 46756 33e4527 150 API calls 46718->46756 46721 33c1868 Mailbox 59 API calls 46719->46721 46749 33e45b2 46719->46749 46722 33e45da 46721->46722 46723 33e5483 3 API calls 46722->46723 46724 33e460c 46723->46724 46725 33e5483 3 API calls 46724->46725 46726 33e4661 46724->46726 46725->46724 46727 33e467f GetDesktopWindow GetDC GetTextExtentPointW 46726->46727 46736 33e46ab Mailbox 46726->46736 46727->46726 46728 33e4765 46730 33e479b 46728->46730 46731 33e47c0 46728->46731 46729 33e470e GetSysColorBrush 46729->46736 46738 33e47be 46730->46738 46751 33e5e79 76 API calls 46730->46751 46752 33e5e39 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW SetLastError 46731->46752 46735 33e47d0 46735->46738 46753 33e5f1f 150 API calls 46735->46753 46736->46728 46736->46729 46739 33e5ece 62 API calls 46736->46739 46750 33e5fc5 65 API calls 46736->46750 46740 33c1868 Mailbox 59 API calls 46738->46740 46739->46736 46745 33e4834 46740->46745 46741 33e4a4c Mailbox 46742 33e4abb 46741->46742 46741->46749 46754 33e689b 62 API calls _abort 46741->46754 46743 33e4ad6 46742->46743 46755 33e454c 150 API calls 46742->46755 46747 33e5483 3 API calls 46743->46747 46744 33e4bdd 146 API calls 46744->46745 46745->46741 46745->46744 46747->46749 46749->46715 46750->46736 46751->46738 46752->46735 46753->46738 46754->46742 46755->46743 46756->46749 46757->46698 46759 33e6016 __EH_prolog 46758->46759 46760 33e6656 46759->46760 46765 33e6029 46759->46765 46761 33e665e ExtCreateRegion 46760->46761 46762 33e666c GetFileSize 46760->46762 46797 33e60b5 Mailbox 46761->46797 46762->46797 46763 33e60ae 46766 33c1868 Mailbox 59 API calls 46763->46766 46763->46797 46764 33e555e 62 API calls 46764->46765 46765->46763 46765->46764 46768 33e600c 147 API calls 46765->46768 46765->46797 46767 33e60cd 46766->46767 46798 33e555e 46767->46798 46768->46765 46771 33e60f4 46773 33e6156 Mailbox 46771->46773 46814 33e5da7 150 API calls 46771->46814 46815 33e5fc5 65 API calls 46771->46815 46774 33c1868 Mailbox 59 API calls 46773->46774 46773->46797 46775 33e61a7 46774->46775 46776 33c1868 Mailbox 59 API calls 46775->46776 46777 33e61ba 46776->46777 46805 33e4b73 46777->46805 46779 33e61ea 46783 33e6225 Mailbox 46779->46783 46816 33e5e39 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW SetLastError 46779->46816 46782 33c1868 Mailbox 59 API calls 46782->46783 46783->46782 46786 33e6366 Mailbox 46783->46786 46811 33e456b 46783->46811 46784 33e63e6 46787 33e6406 GetVolumeInformationW 46784->46787 46786->46784 46788 33e4b73 147 API calls 46786->46788 46817 33e5f6e GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW 46786->46817 46795 33e6412 46787->46795 46787->46797 46788->46786 46789 33e64fa 46790 33c1868 Mailbox 59 API calls 46789->46790 46791 33e6512 46790->46791 46819 33e5ca7 61 API calls char_traits 46791->46819 46793 33e654c 46793->46797 46820 33e5ca7 61 API calls char_traits 46793->46820 46795->46789 46818 33e43b5 150 API calls 46795->46818 46797->46705 46799 33e5567 46798->46799 46800 33e5580 46798->46800 46821 33e5528 61 API calls 46799->46821 46803 33e55b5 LookupPrivilegeValueW 46800->46803 46804 33e5586 46800->46804 46802 33e557b 46802->46771 46803->46804 46804->46771 46806 33e4b7c 46805->46806 46807 33e4bc2 46805->46807 46809 33e4b9b 46806->46809 46810 33e4b8c ExtCreateRegion 46806->46810 46822 33e43db 150 API calls 46807->46822 46809->46779 46810->46779 46812 33e5dd0 150 API calls 46811->46812 46813 33e458b 46812->46813 46813->46783 46814->46771 46815->46771 46816->46783 46817->46786 46818->46795 46819->46793 46820->46793 46821->46802 46822->46809 46823 54c8bc4 46824 54c8bcd RtlFreeHeap 46823->46824 46825 54c8bf6 _free 46823->46825 46824->46825 46826 54c8be2 46824->46826 46827 54c8be8 GetLastError 46826->46827 46827->46825 46833 33fcf86 46836 33fcfa8 LeaveCriticalSection LeaveCriticalSection _fseek 46833->46836 46835 33fcf9a __write 46836->46835 46837 33e7843 46838 33e78a0 46837->46838 46839 33e7850 _memcmp 46837->46839 46840 33f8891 59 API calls 46838->46840 46841 33e78aa 46840->46841

    Executed Functions

    Function 033E7A3F Relevance: 84.5, APIs: 6, Strings: 41, Instructions: 2223COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prologXinvalid_argumentstd::_
    • String ID: C@$'`5x$2$>$D$DwKoYBuJCEyytDi$PO$PhOg$Sh;l$Y$Y$]K$^$e$f$f$h8$h";$h&}$h4R$hL4$hPQ$ht$h}?$h1$hS$i$n$r$r$r$r$t$t$x($xbftzkZErMGIHumMcosuOxQ$|h=1$"5$S4$W$r8
    • API String ID: 4014091808-959085074
    • Opcode ID: 46905a0a2b181afca9046ee8058e7fdded348f0d9e6dacdb2937fece99c965ec
    • Instruction ID: 75c71d8a163fae18a0933ee6d8ef5d52dcfda2d3cb0d223cb8ee6db35f23dd5c
    • Opcode Fuzzy Hash: 46905a0a2b181afca9046ee8058e7fdded348f0d9e6dacdb2937fece99c965ec
    • Instruction Fuzzy Hash: B52387B4D042699EDB21DF64CC94BEEBBB8AB05304F1040E9E549BB281DB755F88CF91
    Function 033EC786 Relevance: 83.5, APIs: 5, Strings: 41, Instructions: 2976COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033EC78B
    • ExtCreateRegion.GDI32(00000000,0000254C,00000000), ref: 033EF5E1
      • Part of subcall function 033EBABF: __EH_prolog.LIBCMT ref: 033EBAC4
    • GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000001,00000003,00000000,00000002,00000000,?,?,0DFE9F48,?,00000000,?,?,00000002), ref: 033ECF4F
    • GetDesktopWindow.USER32 ref: 033ED1D6
    • SetWindowLongW.USER32(00000000), ref: 033ED1DD
      • Part of subcall function 033C38F8: _memmove.LIBCMT ref: 033C3918
      • Part of subcall function 033D4630: __EH_prolog.LIBCMT ref: 033D4635
      • Part of subcall function 033C3943: _memmove.LIBCMT ref: 033C3963
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog$Window_memmove$CreateDesktopLongOverlappedRegionResult
    • String ID: $ $!$!$!'E$'`5x$($*$*$*$:$<$<$AA$G$H$PO$R$[$b$e$e$h&}$l$m$m$n$p$p$p$r$s$t$t$t$t$u$v$v${$#
    • API String ID: 4063478863-2971129802
    • Opcode ID: e858f285400d7d4ffb65f846191b432d1a1c16ad37466317d26c007e2f6baaa5
    • Instruction ID: 6dbe0e0c714107005048f02ecb2391b8d42f95f496a8f578ad337beb085e15d5
    • Opcode Fuzzy Hash: e858f285400d7d4ffb65f846191b432d1a1c16ad37466317d26c007e2f6baaa5
    • Instruction Fuzzy Hash: 1D539D74D443A99EEB21DF98CC95BEDBBB8AB05304F5440E9E548BB2C1C7B50A88CF51
    Function 033E7C37 Relevance: 44.9, APIs: 4, Strings: 21, Instructions: 1189COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$Allocate
    • String ID: C@$#$'`5x$2$PO$PhOg$Y$]K$e$f$f$h";$h&}$ht$h1$r$r$t$x($|h=1$S4
    • API String ID: 1811393872-1841768753
    • Opcode ID: 51d7fcb94b557962e1673eb90b8d45471d48652782109d30b33828aa7fa9a01b
    • Instruction ID: d30461541b3da8922b127e69d122afda5558e0b6f14ba9149cdd1713ed70fa0e
    • Opcode Fuzzy Hash: 51d7fcb94b557962e1673eb90b8d45471d48652782109d30b33828aa7fa9a01b
    • Instruction Fuzzy Hash: 58C254B4D043699EDF21DF94CC85BEEBBB8AB08304F1441E9E549BB281DB745A84CF91
    Function 033E7E69 Relevance: 41.4, APIs: 4, Strings: 19, Instructions: 1135COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID: C@$#$'`5x$2$PO$PhOg$Y$]K$e$f$f$h";$h&}$h1$r$r$t$x($|h=1
    • API String ID: 0-247542439
    • Opcode ID: 2f7d43b88e4747c2f7d5ede1d71be01711c12bcee4ed666ed1d4e16cbaa38be5
    • Instruction ID: 5db330a27725c654d8a719bdea4f6beb544cbfdec715e37efd312b2c84dd7df1
    • Opcode Fuzzy Hash: 2f7d43b88e4747c2f7d5ede1d71be01711c12bcee4ed666ed1d4e16cbaa38be5
    • Instruction Fuzzy Hash: 1BB266B4D04269DEDF21DFA8CC85BEEBBB8AB08304F1440E9D549BB281DB755A84CF51
    Function 033E7F15 Relevance: 41.3, APIs: 4, Strings: 19, Instructions: 1079COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 033C13C5: _Allocate.LIBCPMT ref: 033C1417
      • Part of subcall function 033C13C5: _Ucopy.LIBCPMT ref: 033C1428
      • Part of subcall function 033C13C5: _Ucopy.LIBCPMT ref: 033C1436
      • Part of subcall function 033C13C5: _Ucopy.LIBCPMT ref: 033C1444
    • ExtCreateRegion.GDI32(00000000,0000254C,00000000), ref: 033E83BC
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$AllocateCreateRegion
    • String ID: C@$#$'`5x$2$PO$PhOg$Y$]K$e$f$f$h";$h&}$h1$r$r$t$x($|h=1
    • API String ID: 2216468127-247542439
    • Opcode ID: 57c4e1bbd6a2f55fcfacfafab7e0365f4392c7302fbe6ebb07054987a1b2daa5
    • Instruction ID: 4ff1c2789e1df2d88d9fc3b2ca7fc829c5218a7b54bd88dcc50fc36ba8497ea4
    • Opcode Fuzzy Hash: 57c4e1bbd6a2f55fcfacfafab7e0365f4392c7302fbe6ebb07054987a1b2daa5
    • Instruction Fuzzy Hash: 27B254B4D043699EDF21DFA8CC85BEEBBB8AB04304F1440E9E549BB281DB755A84CF51
    Function 033E8060 Relevance: 39.7, APIs: 4, Strings: 18, Instructions: 1178COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$Allocate
    • String ID: C@$#$'`5x$PO$PhOg$Y$]K$e$f$f$h";$h&}$h1$r$r$t$x($|h=1
    • API String ID: 1811393872-3020287246
    • Opcode ID: 2d9722a022fd3eb360820279f84c7ca3567f7643049c834082cb6a34a0dbd51c
    • Instruction ID: e8dd375d414dd57a68e5761797c46ceebd484718e786a9458e6c0b1ea6cb93cd
    • Opcode Fuzzy Hash: 2d9722a022fd3eb360820279f84c7ca3567f7643049c834082cb6a34a0dbd51c
    • Instruction Fuzzy Hash: 69B255B4D00269DEDF21DF94CC95BEEBBB8AB04304F1441EAE509BB281DB755A84CF51
    Function 033E8926 Relevance: 28.7, APIs: 3, Strings: 13, Instructions: 716COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID: C@$#$'`5x$PO$PhOg$Y$]K$e$f$f$h&}$r$t
    • API String ID: 0-446310366
    • Opcode ID: d8ccd4536fdd793834d08276f2a498e1b571badcd6446bc2ce9feb51cfd619eb
    • Instruction ID: dbd1609cc9403c55cd62142a5389d992bc71349dba78d72469ed6c5732399a3f
    • Opcode Fuzzy Hash: d8ccd4536fdd793834d08276f2a498e1b571badcd6446bc2ce9feb51cfd619eb
    • Instruction Fuzzy Hash: 086244B4D002699EDF20DF94CC85BEEBBB8AB19304F5440EAD549BB281DB745B84CF91
    Function 033E4BDD Relevance: 14.6, APIs: 3, Strings: 5, Instructions: 598registrywindowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5085 33e4bdd-33e4bf4 call 33f92b8 5088 33e4bfa-33e4bff 5085->5088 5089 33e53f2-33e53f6 5085->5089 5090 33e53e8-33e53f0 RegUnLoadKeyW 5088->5090 5091 33e4c05-33e4c73 call 33c1868 5088->5091 5092 33e541e EndMenu 5089->5092 5093 33e53f8-33e5406 5089->5093 5095 33e5424-33e5434 5090->5095 5099 33e4c82-33e4c86 5091->5099 5092->5095 5093->5095 5096 33e5408 5093->5096 5098 33e540b-33e541a 5096->5098 5098->5098 5100 33e541c 5098->5100 5101 33e4c88-33e4c8b 5099->5101 5102 33e4c75-33e4c7f 5099->5102 5100->5095 5103 33e4ca0-33e4ca4 5101->5103 5102->5099 5104 33e4c8d-33e4c9d 5103->5104 5105 33e4ca6-33e4cb2 5103->5105 5104->5103 5106 33e4d29-33e4d2f 5105->5106 5107 33e4cb4-33e4cf2 call 33c1868 call 33e4bdd 5105->5107 5108 33e4daf-33e4db2 5106->5108 5120 33e4d0c-33e4d14 5107->5120 5110 33e4db8-33e4ec5 call 33c39d4 call 33c1868 call 33e5dd0 call 33e6824 5108->5110 5111 33e4d31-33e4d5d 5108->5111 5137 33e4ec7-33e4eca 5110->5137 5138 33e4ed0-33e4ed2 5110->5138 5115 33e4d70-33e4d74 5111->5115 5118 33e4d5f-33e4d6d 5115->5118 5119 33e4d76-33e4d79 5115->5119 5118->5115 5122 33e4d8c-33e4d8f 5119->5122 5123 33e4d16-33e4d24 call 33c39d4 5120->5123 5124 33e4cf4-33e4d09 5120->5124 5126 33e4d7b-33e4d89 5122->5126 5127 33e4d91-33e4dae call 33e5f1f 5122->5127 5123->5107 5134 33e4d26-33e4d28 5123->5134 5124->5120 5126->5122 5127->5108 5134->5106 5137->5138 5139 33e4ecc-33e4ece 5137->5139 5140 33e4ed3-33e4ede 5138->5140 5139->5140 5141 33e4ee5 5140->5141 5142 33e4ee0-33e4ee3 5140->5142 5143 33e4ee7-33e4f21 5141->5143 5142->5143 5144 33e4f2f 5143->5144 5145 33e4f23-33e4f28 5143->5145 5147 33e4f31-33e4f98 call 33c39d4 call 33e42fc 5144->5147 5145->5144 5146 33e4f2a-33e4f2d 5145->5146 5146->5147 5152 33e5015-33e5019 5147->5152 5153 33e501f-33e5040 call 33c9122 5152->5153 5154 33e4f9a-33e4fa4 5152->5154 5168 33e508a-33e50f5 call 33c1868 5153->5168 5169 33e5042-33e5052 call 33e3f47 5153->5169 5156 33e500c-33e5010 5154->5156 5157 33e4fa6-33e4fb0 5156->5157 5158 33e5012 5156->5158 5160 33e4fb9-33e4fc0 5157->5160 5161 33e4fb2-33e4fb5 5157->5161 5158->5152 5162 33e4fe7-33e5009 call 33e5f8e 5160->5162 5163 33e4fc2-33e4fe4 call 33e42fc 5160->5163 5161->5158 5165 33e4fb7 5161->5165 5162->5156 5163->5162 5165->5162 5177 33e50f6-33e50f9 5168->5177 5174 33e5057-33e505c 5169->5174 5174->5168 5176 33e505e-33e5085 call 33e3eb9 call 33d2e58 call 33d16c1 5174->5176 5176->5168 5179 33e510c-33e510f 5177->5179 5180 33e50fb-33e510a 5177->5180 5182 33e5238-33e523c 5179->5182 5180->5177 5183 33e5114-33e515c 5182->5183 5184 33e5242-33e52af call 33c39d4 call 33e5ece 5182->5184 5188 33e516b-33e516e 5183->5188 5199 33e537f-33e5383 5184->5199 5189 33e515e-33e5168 5188->5189 5190 33e5170-33e5173 5188->5190 5189->5188 5193 33e5186-33e5189 5190->5193 5195 33e518b-33e5192 5193->5195 5196 33e5175-33e5183 5193->5196 5198 33e5217-33e521b 5195->5198 5196->5193 5202 33e5197-33e51b6 5198->5202 5203 33e5221-33e5235 5198->5203 5200 33e5389-33e53b0 call 33e5483 call 33e4058 5199->5200 5201 33e52b4-33e52be 5199->5201 5215 33e53b5-33e53ba 5200->5215 5205 33e52d1-33e52d4 5201->5205 5204 33e51c5-33e51c8 5202->5204 5203->5182 5207 33e51ca-33e51d3 5204->5207 5208 33e51b8-33e51c2 5204->5208 5209 33e52d6-33e52d9 5205->5209 5210 33e52c0-33e52ce 5205->5210 5212 33e520e-33e5212 5207->5212 5208->5204 5213 33e52e9-33e52ec 5209->5213 5210->5205 5218 33e5214 5212->5218 5219 33e51d5-33e51f0 5212->5219 5216 33e52ee-33e52f1 5213->5216 5217 33e52db-33e52e6 5213->5217 5220 33e53bc-33e53dd call 33e5f8e 5215->5220 5221 33e53e0-33e53e6 5215->5221 5223 33e533f 5216->5223 5224 33e52f3-33e5305 5216->5224 5217->5213 5218->5198 5222 33e5203-33e5206 5219->5222 5220->5221 5221->5095 5227 33e5208-33e520b 5222->5227 5228 33e51f2-33e5200 5222->5228 5226 33e5341-33e5366 5223->5226 5229 33e530f-33e5318 5224->5229 5230 33e5307-33e530d 5224->5230 5233 33e5368-33e536b 5226->5233 5234 33e5374-33e5378 5226->5234 5227->5212 5228->5222 5229->5223 5231 33e531a-33e531d 5229->5231 5235 33e533a-33e533d 5230->5235 5236 33e531f-33e5324 5231->5236 5237 33e5326 5231->5237 5233->5234 5238 33e536d-33e5372 5233->5238 5239 33e5379-33e537c 5234->5239 5235->5223 5235->5226 5236->5237 5240 33e5328-33e5338 5236->5240 5237->5240 5238->5239 5239->5199 5240->5223 5240->5235
    APIs
    • __EH_prolog.LIBCMT ref: 033E4BE2
    • RegUnLoadKeyW.ADVAPI32(00000000,00000000,033C19D1,00000001,00000000), ref: 033E53EA
      • Part of subcall function 033E42FC: QueryDosDeviceW.KERNEL32(00000000,00000000,00000752), ref: 033E4318
    • EndMenu.USER32(033C19D1,00000001,00000000), ref: 033E541E
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DeviceH_prologLoadMenuQuery
    • String ID: '`5x$PO$Xx$h&}$#
    • API String ID: 2890571477-3551381960
    • Opcode ID: f915be176cf0aa8606942d16d24c9f8ed34cc6759b457b375b4486dea8e8f4a3
    • Instruction ID: 0f5dc5f2e40a9ebd32e38083fafa1ecec34394b17151fe17ee3cce2cbd9a909c
    • Opcode Fuzzy Hash: f915be176cf0aa8606942d16d24c9f8ed34cc6759b457b375b4486dea8e8f4a3
    • Instruction Fuzzy Hash: B64246B5D01229DFEF10CF98C981AEDBBB5FB09308F1142AAE919BA280D7749D41CF54
    Function 033E25BB Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 664COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5241 33e25bb-33e25dc call 33f92b8 5244 33e25ef-33e25f2 5241->5244 5245 33e25de-33e25ec 5244->5245 5246 33e25f4-33e25fa 5244->5246 5245->5244 5247 33e25fc-33e2625 call 33e3353 5246->5247 5248 33e2647-33e2653 5246->5248 5254 33e263f-33e2645 5247->5254 5255 33e2627-33e263d call 33e3cce 5247->5255 5250 33e2663-33e2666 5248->5250 5252 33e2668-33e2672 5250->5252 5253 33e2655-33e2660 5250->5253 5256 33e270d-33e2710 5252->5256 5253->5250 5254->5247 5254->5248 5255->5254 5257 33e2716-33e2762 call 33e373a call 33c1868 call 33e368f 5256->5257 5258 33e2677-33e2681 5256->5258 5280 33e278c 5257->5280 5281 33e2764-33e2786 5257->5281 5260 33e26ed-33e26f0 5258->5260 5264 33e26f2-33e26f5 5260->5264 5265 33e2683-33e2686 5260->5265 5268 33e2705-33e2708 5264->5268 5266 33e2699-33e269d 5265->5266 5271 33e269f-33e26a2 5266->5271 5272 33e2688-33e2696 5266->5272 5269 33e270a 5268->5269 5270 33e26f7-33e2702 5268->5270 5269->5256 5270->5268 5274 33e26b2-33e26b5 5271->5274 5272->5266 5276 33e26b7-33e26d7 call 33e3a16 5274->5276 5277 33e26a4-33e26af 5274->5277 5285 33e26ea 5276->5285 5286 33e26d9-33e26e3 5276->5286 5277->5274 5284 33e278e-33e27a3 5280->5284 5281->5280 5283 33e2788-33e278a 5281->5283 5283->5284 5287 33e27a5-33e27ad 5284->5287 5288 33e27e3-33e27ea 5284->5288 5285->5260 5286->5285 5290 33e26e5-33e26e8 5286->5290 5291 33e27dc-33e27df 5287->5291 5289 33e2814-33e2818 5288->5289 5294 33e27ec-33e27f4 5289->5294 5295 33e281a-33e282d call 33c39d4 call 33e3f6e 5289->5295 5290->5285 5290->5286 5292 33e27af-33e27bb 5291->5292 5293 33e27e1 5291->5293 5299 33e27bd-33e27c3 5292->5299 5300 33e27c6-33e27da 5292->5300 5293->5295 5296 33e27f6-33e280e call 33e368f 5294->5296 5297 33e2811 5294->5297 5305 33e2832-33e28a5 call 33c1868 5295->5305 5296->5297 5297->5289 5299->5300 5300->5291 5308 33e28b4-33e28b8 5305->5308 5309 33e28ba-33e28bd 5308->5309 5310 33e28a7-33e28b1 5308->5310 5311 33e28d2-33e28d6 5309->5311 5310->5308 5312 33e28bf-33e28cf 5311->5312 5313 33e28d8-33e28e4 5311->5313 5312->5311 5314 33e28e6-33e28e8 5313->5314 5315 33e2940-33e2946 5313->5315 5317 33e28e9-33e28f9 call 33c1868 5314->5317 5316 33e29d2-33e29d5 5315->5316 5319 33e294b-33e2977 5316->5319 5320 33e29db-33e29f1 call 33c39d4 5316->5320 5327 33e2907-33e290a 5317->5327 5321 33e298a-33e298e 5319->5321 5328 33e2d5c-33e2de8 call 33c1868 5320->5328 5329 33e29f7-33e2a2e 5320->5329 5325 33e2979-33e2987 5321->5325 5326 33e2990-33e2993 5321->5326 5325->5321 5330 33e29a6-33e29a9 5326->5330 5331 33e290c-33e290f 5327->5331 5332 33e28fb-33e2904 5327->5332 5347 33e2dfa-33e2dfd 5328->5347 5333 33e2a33-33e2a51 5329->5333 5334 33e2a30 5329->5334 5336 33e29ab-33e29d1 call 33e3353 5330->5336 5337 33e2995-33e29a3 5330->5337 5338 33e2912-33e292c 5331->5338 5332->5327 5339 33e2a5d 5333->5339 5340 33e2a53-33e2a56 5333->5340 5334->5333 5336->5316 5337->5330 5338->5338 5343 33e292e-33e2939 call 33c39d4 5338->5343 5346 33e2a5f-33e2a8e 5339->5346 5340->5339 5345 33e2a58-33e2a5b 5340->5345 5343->5317 5353 33e293b-33e293f 5343->5353 5345->5346 5350 33e2af6-33e2afa 5346->5350 5351 33e2dff-33e2e3f call 33e389a 5347->5351 5352 33e2dea-33e2df7 5347->5352 5354 33e2afc-33e2be0 call 33e3d77 call 33c1868 call 33e34ce 5350->5354 5355 33e2a90-33e2a9a 5350->5355 5363 33e2e4a-33e2e4c 5351->5363 5364 33e2e41-33e2e44 5351->5364 5352->5347 5353->5315 5387 33e2d41-33e2d45 5354->5387 5358 33e2aed-33e2af1 5355->5358 5360 33e2a9c-33e2aa6 5358->5360 5361 33e2af3 5358->5361 5367 33e2aaf-33e2ab5 5360->5367 5368 33e2aa8-33e2aab 5360->5368 5361->5350 5365 33e2e4d-33e2e5a 5363->5365 5364->5363 5369 33e2e46-33e2e48 5364->5369 5370 33e2e5c 5365->5370 5371 33e2e5d-33e2e97 5365->5371 5374 33e2ab7-33e2ace call 33e3d77 5367->5374 5375 33e2ad1-33e2aea call 33e39ad 5367->5375 5368->5361 5373 33e2aad 5368->5373 5369->5365 5370->5371 5377 33e2e99-33e2e9f 5371->5377 5378 33e2ea6 5371->5378 5373->5375 5374->5375 5375->5358 5377->5378 5382 33e2ea1-33e2ea4 5377->5382 5383 33e2ea8-33e2ee9 call 33c39d4 call 33c3943 5378->5383 5382->5383 5388 33e2d4b-33e2d5a call 33c39d4 5387->5388 5389 33e2be5-33e2c2e 5387->5389 5388->5328 5393 33e2c3d-33e2c41 5389->5393 5394 33e2c43-33e2c46 5393->5394 5395 33e2c30-33e2c3a 5393->5395 5398 33e2c59-33e2c5c 5394->5398 5395->5393 5399 33e2c5e-33e2c65 5398->5399 5400 33e2c48-33e2c56 5398->5400 5401 33e2d1c-33e2d20 5399->5401 5400->5398 5402 33e2c6a-33e2c89 5401->5402 5403 33e2d26-33e2d3e 5401->5403 5404 33e2c9c-33e2ca0 5402->5404 5403->5387 5405 33e2c8b-33e2c99 5404->5405 5406 33e2ca2-33e2cab 5404->5406 5405->5404 5407 33e2d13-33e2d17 5406->5407 5408 33e2cad-33e2ccc 5407->5408 5409 33e2d19 5407->5409 5410 33e2cdf-33e2ce3 5408->5410 5409->5401 5411 33e2cce-33e2cdc 5410->5411 5412 33e2ce5-33e2d10 call 33e3bc2 5410->5412 5411->5410 5412->5407
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID: !$'`5x$PO$Xx$h&}$#
    • API String ID: 3519838083-2769257566
    • Opcode ID: c7d87aedad0fcbd69a343c79ee1425f1601d4b65a59835d5b21ef0ffb428a8a1
    • Instruction ID: 814cb1922c186ce2b60acbee70081c5e4874814bac2ef1e19a891d3f130032ea
    • Opcode Fuzzy Hash: c7d87aedad0fcbd69a343c79ee1425f1601d4b65a59835d5b21ef0ffb428a8a1
    • Instruction Fuzzy Hash: 255249B4E0022ADFDF14DF98C885AEEBBB9FB44315F208529E515BB2C0D7754A81CB91
    Function 033E4590 Relevance: 8.0, APIs: 5, Instructions: 485COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5735 33e4590-33e45a6 call 33f92b8 5738 33e4b4e-33e4b60 call 33e4527 5735->5738 5739 33e45ac-33e45b0 5735->5739 5747 33e4b63-33e4b72 5738->5747 5740 33e45cb-33e4612 call 33c1868 call 33e5483 5739->5740 5741 33e45b2-33e45c0 5739->5741 5751 33e4622-33e4625 5740->5751 5743 33e45c4-33e45c6 5741->5743 5744 33e45c2 5741->5744 5743->5747 5744->5743 5752 33e4627-33e462e 5751->5752 5753 33e4614-33e461f 5751->5753 5754 33e465c-33e465f 5752->5754 5753->5751 5755 33e4630-33e4659 call 33e5483 5754->5755 5756 33e4661-33e4664 5754->5756 5755->5754 5757 33e46a5-33e46a9 5756->5757 5760 33e46ab-33e46df call 33c39d4 call 33f8913 5757->5760 5761 33e4666-33e4675 5757->5761 5771 33e46ef-33e46f3 5760->5771 5762 33e469d-33e46a0 5761->5762 5764 33e4677-33e467d 5762->5764 5765 33e46a2 5762->5765 5767 33e467f-33e4694 GetDesktopWindow GetDC GetTextExtentPointW 5764->5767 5768 33e469a 5764->5768 5765->5757 5767->5768 5768->5762 5772 33e46f5-33e46fc 5771->5772 5773 33e46e1-33e46ec 5771->5773 5774 33e475f-33e4763 5772->5774 5773->5771 5775 33e46fe-33e470c 5774->5775 5776 33e4765-33e476b 5774->5776 5779 33e470e-33e4713 GetSysColorBrush 5775->5779 5780 33e4719-33e471c 5775->5780 5777 33e476d-33e4784 5776->5777 5778 33e4786-33e4799 5776->5778 5777->5777 5777->5778 5781 33e479b-33e47a2 5778->5781 5782 33e47c0-33e47da call 33e5e39 5778->5782 5779->5780 5783 33e4756-33e475a 5780->5783 5784 33e47a4-33e47be call 33e5e79 5781->5784 5785 33e47f5-33e481b call 33c9122 5781->5785 5782->5785 5795 33e47dc-33e47ed call 33e5f1f 5782->5795 5787 33e471e-33e4737 call 33e5fc5 5783->5787 5788 33e475c 5783->5788 5797 33e47f2 5784->5797 5801 33e481e-33e4842 call 33c1868 5785->5801 5798 33e4739-33e4750 call 33e5ece 5787->5798 5799 33e4753 5787->5799 5788->5774 5795->5797 5797->5785 5798->5799 5799->5783 5806 33e4854-33e4858 5801->5806 5807 33e485a-33e4864 5806->5807 5808 33e4844-33e4851 5806->5808 5809 33e4a4f-33e4a5c call 33c39d4 5807->5809 5810 33e486a-33e486c 5807->5810 5808->5806 5817 33e4a62-33e4a78 call 33c9122 5809->5817 5818 33e4b33 5809->5818 5811 33e486d-33e488f 5810->5811 5813 33e489f-33e48a2 5811->5813 5815 33e48a4-33e48a7 5813->5815 5816 33e4891-33e489c 5813->5816 5820 33e48b7-33e48ba 5815->5820 5816->5813 5817->5818 5834 33e4a7e-33e4a84 5817->5834 5819 33e4b36-33e4b3e 5818->5819 5822 33e4b40-33e4b43 5819->5822 5823 33e48bc-33e48bf 5820->5823 5824 33e48a9-33e48b4 5820->5824 5822->5747 5826 33e4b45-33e4b4c call 33fc63a 5822->5826 5827 33e48d2-33e48d5 5823->5827 5824->5820 5826->5747 5828 33e48d7-33e48dd 5827->5828 5829 33e48c1-33e48cf 5827->5829 5832 33e48df-33e48f2 5828->5832 5833 33e48f8-33e48fa 5828->5833 5829->5827 5832->5833 5836 33e48f4-33e48f6 5832->5836 5839 33e48fb-33e4924 5833->5839 5837 33e4a86-33e4a8e 5834->5837 5838 33e4a93-33e4a9b 5834->5838 5836->5839 5837->5822 5840 33e4a9d-33e4ab6 call 33f8913 call 33e689b 5838->5840 5841 33e4abb-33e4ac9 5838->5841 5842 33e4926-33e492d 5839->5842 5843 33e4975-33e4982 5839->5843 5840->5841 5847 33e4acb-33e4ad7 call 33e454c 5841->5847 5848 33e4ad8-33e4b31 call 33e5483 call 33c9122 5841->5848 5845 33e492f-33e4952 call 33e4bdd 5842->5845 5846 33e4955-33e495c 5842->5846 5849 33e4987-33e49ae 5843->5849 5850 33e4984 5843->5850 5845->5846 5854 33e496d-33e4971 5846->5854 5847->5848 5848->5819 5851 33e49b0-33e49dd 5849->5851 5850->5849 5857 33e49df-33e49e2 5851->5857 5858 33e49e5-33e4a16 5851->5858 5862 33e495e-33e4968 5854->5862 5863 33e4973 5854->5863 5857->5858 5865 33e4a18-33e4a1e 5858->5865 5866 33e4a24-33e4a26 5858->5866 5862->5851 5867 33e496a 5862->5867 5863->5851 5865->5866 5870 33e4a20-33e4a22 5865->5870 5871 33e4a27-33e4a46 5866->5871 5867->5854 5870->5871 5871->5811 5872 33e4a4c 5871->5872 5872->5809
    APIs
    • __EH_prolog.LIBCMT ref: 033E4595
    • GetDesktopWindow.USER32 ref: 033E4686
    • GetDC.USER32(00000000), ref: 033E468D
    • GetTextExtentPointW.GDI32(00000000), ref: 033E4694
    • GetSysColorBrush.USER32(0000196A), ref: 033E4713
      • Part of subcall function 033E5FC5: GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000001,?,033E6141), ref: 033E5FDB
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: BrushColorDesktopExtentH_prologOverlappedPointResultTextWindow
    • String ID:
    • API String ID: 251452265-0
    • Opcode ID: b5032529ff25e3c54ebbe3a9b56c32de6ddcef4827e830e420207f5bb3e548f5
    • Instruction ID: 0755098b915e563cf3fbcaabce74e214593a3da35f08240e3acd4dcd82d4e081
    • Opcode Fuzzy Hash: b5032529ff25e3c54ebbe3a9b56c32de6ddcef4827e830e420207f5bb3e548f5
    • Instruction Fuzzy Hash: 03126AB5E4435A9FDB14CFA9DC81AEEB7B9FB09305F140519F921AB2C0D7709A50CBA0
    Function 054D2C29 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetLocaleInfoEx.KERNEL32(?,?,00000002,?,?,054D36FA,?,?,?,00000002,?,?,?), ref: 054D2C45
    • GetLocaleInfoW.KERNEL32(00000000,?,00000002,?,?,054D36FA,?,?,?,00000002,?,?,?), ref: 054D2C50
    Memory Dump Source
    • Source File: 00000003.00000002.2225059714.00000000053B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053B0000, based on PE: true
    • Associated: 00000003.00000002.2225041734.00000000053B0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2225178708.000000000550A000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2225480615.000000000597D000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2225501466.000000000597F000.00000040.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_53b0000_rundll32.jbxd
    Similarity
    • API ID: InfoLocale
    • String ID:
    • API String ID: 2299586839-0
    • Opcode ID: 8260114073be6e898b295944d0f6e74121f718663b98b548d29f38d2cdf98b3f
    • Instruction ID: 0a4b9a1c072336226b7a6575b46ae3461645c9033b52a4865fc5b7a5b7b272be
    • Opcode Fuzzy Hash: 8260114073be6e898b295944d0f6e74121f718663b98b548d29f38d2cdf98b3f
    • Instruction Fuzzy Hash: A3D09E7651820DBF8F059FE1F80ACAA7F7AFF4C724B084846F91885110EA72E5709B65
    Function 033E8A5B Relevance: 28.7, APIs: 3, Strings: 13, Instructions: 657COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 3797 33e8a5b-33e8aa4 call 33eaedf call 33c39d4 3803 33e8aa5-33e8ad8 3797->3803 3803->3803 3804 33e8ada-33e8b85 call 33c1868 3803->3804 3811 33e8bee-33e8d6e call 33c39d4 call 33c7c6d call 33c1868 3804->3811 3812 33e8b87-33e8b97 call 33c1868 3804->3812 3833 33e8d79-33e8d7b 3811->3833 3834 33e8d70-33e8d73 3811->3834 3818 33e8bac-33e8bb0 3812->3818 3820 33e8b99-33e8ba9 3818->3820 3821 33e8bb2-33e8bb8 3818->3821 3820->3818 3823 33e8bbf-33e8bd9 3821->3823 3823->3823 3825 33e8bdb-33e8be9 call 33c39d4 3823->3825 3825->3812 3831 33e8beb-33e8bed 3825->3831 3831->3811 3835 33e8d7c-33e8dad 3833->3835 3834->3833 3836 33e8d75-33e8d77 3834->3836 3837 33e8daf-33e8db2 3835->3837 3838 33e8db8-33e8dba 3835->3838 3836->3835 3837->3838 3840 33e8db4-33e8db6 3837->3840 3839 33e8dbb-33e8e07 3838->3839 3843 33e8e18 3839->3843 3844 33e8e09-33e8e11 3839->3844 3840->3839 3845 33e8e1a-33e8f00 call 33c39d4 call 33ea56f 3843->3845 3844->3843 3846 33e8e13-33e8e16 3844->3846 3853 33ea1a9-33ea24e call 33c1868 call 33eac9b 3845->3853 3854 33e8f06 3845->3854 3846->3845 3864 33ea46f-33ea47d call 33c39d4 3853->3864 3865 33ea254-33ea256 3853->3865 3856 33e8f0f-33e8f78 call 33c7c9c call 33e6ffc call 33e6fd5 call 33c3987 * 2 3854->3856 3882 33e8f7d-33e8fb4 call 33fcea1 3856->3882 3874 33ea47f-33ea54e call 33c38f8 * 3 call 33c3987 call 33c38f8 3864->3874 3868 33ea257-33ea469 3865->3868 3868->3864 3887 33e8fb9-33e8fbe 3882->3887 3889 33ea188-33ea195 call 33c3987 3887->3889 3890 33e8fc4-33e8fc7 3887->3890 3896 33ea19a-33ea1a3 3889->3896 3890->3889 3893 33e8fcd-33e8fe7 call 33fca22 call 33fce35 call 33fca22 3890->3893 3905 33e8fec-33e900d call 33d5c51 3893->3905 3896->3853 3896->3856 3907 33e9012-33e90af call 33fc8e7 call 33eb587 call 33d49d0 3905->3907 3913 33e90b4-33e90c5 3907->3913 3914 33ea14d-33ea153 3913->3914 3915 33e90cb-33e90cf 3913->3915 3917 33ea15d-33ea183 call 33c3943 call 33d49a6 call 33c3943 3914->3917 3918 33ea155-33ea159 3914->3918 3915->3914 3916 33e90d5-33e918d call 33fd30d 3915->3916 3924 33e9193-33e9196 3916->3924 3917->3889 3918->3917 3926 33e91ae-33e920c call 33eb587 3924->3926 3927 33e9198-33e91ac 3924->3927 3930 33e920f-33e9215 3926->3930 3927->3930 3930->3924 3931 33e921b-33e92b4 3930->3931 3933 33e92b5-33e92b8 3931->3933 3934 33e92ca-33e92f6 3933->3934 3935 33e92ba-33e92c8 3933->3935 3936 33e92fd-33e9303 3934->3936 3935->3936 3936->3933 3937 33e9305-33e938a 3936->3937 3938 33e938b-33e938e 3937->3938 3939 33e93a0-33e93cc 3938->3939 3940 33e9390-33e939e 3938->3940 3941 33e93d3-33e93d9 3939->3941 3940->3941 3941->3938 3942 33e93db-33e9500 call 33c7c6d * 3 call 33e741f call 33f897e 3941->3942 3953 33e9501-33e9504 3942->3953 3954 33e9516-33e9544 3953->3954 3955 33e9506-33e9514 3953->3955 3956 33e954b-33e9551 3954->3956 3955->3956 3956->3953 3957 33e9553-33e9582 call 33c7c6d 3956->3957 3960 33e9585-33e958b 3957->3960 3961 33e9779-33e97eb 3960->3961 3962 33e9591-33e95ff call 33e6eff call 33e08e6 call 33c38f8 call 33de3b4 3960->3962 3963 33e97ec-33e981f 3961->3963 3979 33e9605-33e974c call 33e6eae call 33c17a1 * 3 call 33eb820 call 33e74e3 call 33c17a1 * 3 call 33eb820 call 33e74e3 call 33e7b64 call 33c38f8 3962->3979 3980 33e9751-33e9774 call 33c3943 call 33d16c1 3962->3980 3963->3963 3965 33e9821-33e9886 call 33c7c6d call 33e08e6 call 33de379 call 33c3943 call 33c38f8 3963->3965 3992 33e988c-33e9904 3965->3992 3993 33e9c43-33e9cb4 3965->3993 3979->3980 3980->3960 3995 33e9905-33e9908 3992->3995 3996 33e9cb5-33e9cb8 3993->3996 3998 33e991a-33e9946 3995->3998 3999 33e990a-33e9918 3995->3999 4000 33e9cca-33e9cf6 3996->4000 4001 33e9cba-33e9cc8 3996->4001 4003 33e994d-33e9953 3998->4003 3999->4003 4004 33e9cfd-33e9d03 4000->4004 4001->4004 4003->3995 4006 33e9955-33e9a47 call 33c7c6d call 33e6ed7 call 33e08e6 call 33c38f8 * 2 4003->4006 4004->3996 4007 33e9d05-33e9dcd call 33c7c6d call 33e08e6 call 33c38f8 4004->4007 4040 33e9a48-33e9a4b 4006->4040 4027 33e9dce-33e9dd1 4007->4027 4030 33e9de3-33e9e0f 4027->4030 4031 33e9dd3-33e9de1 4027->4031 4035 33e9e16-33e9e1c 4030->4035 4031->4035 4035->4027 4039 33e9e1e-33e9ea2 call 33c7c6d call 33e08e6 call 33c38f8 call 33de3b4 4035->4039 4066 33e9ea8-33e9ebf call 33de379 4039->4066 4067 33e9f65-33e9f75 4039->4067 4043 33e9a5d-33e9a8b 4040->4043 4044 33e9a4d-33e9a5b 4040->4044 4047 33e9a92-33e9a98 4043->4047 4044->4047 4047->4040 4050 33e9a9a-33e9ae8 call 33c7c6d call 33dd984 4047->4050 4064 33e9aee 4050->4064 4065 33e9c14-33e9c3e call 33c1a13 call 33c38f8 call 33c3943 4050->4065 4070 33e9af1-33e9af8 4064->4070 4065->3993 4066->4067 4079 33e9ec5-33e9f60 call 33e750b call 33e6eae call 33eb42f call 33c38f8 * 2 4066->4079 4071 33ea0ad-33ea14b call 33d16c1 call 33c3943 * 2 call 33c38f8 call 33e1897 call 33e7748 call 33c3943 call 33d49a6 call 33c3943 call 33c3987 4067->4071 4072 33e9f7b-33e9f81 4067->4072 4076 33e9afe-33e9bef call 33e6f6a call 33e08ac call 33e6ed7 call 33c38f8 call 33eb30e call 33d16c1 call 33c38f8 call 33c3943 4070->4076 4077 33e9bf4-33e9c0e call 33d4c7b 4070->4077 4071->3896 4078 33e9f87-33e9f89 4072->4078 4076->4077 4077->4065 4077->4070 4084 33ea09f-33ea0a7 4078->4084 4085 33e9f8f-33ea001 call 33c17a1 call 33e057d call 33e04f7 call 33c38f8 call 33eb587 4078->4085 4079->4067 4084->4071 4084->4078 4129 33ea2a8-33ea2af 4085->4129 4130 33ea007-33ea00e 4085->4130 4131 33ea2b5 4129->4131 4132 33ea2b1-33ea2b3 4129->4132 4135 33ea070-33ea087 call 33c38f8 4130->4135 4136 33ea010-33ea06a call 33eaf6d call 33eb108 4130->4136 4137 33ea2b7-33ea2c0 4131->4137 4132->4137 4135->4085 4148 33ea08d-33ea09c 4135->4148 4136->4129 4136->4135 4143 33ea2c4-33ea32b call 33e0391 call 33c38f8 call 33d16c1 call 33c3943 * 2 call 33c38f8 call 33e1897 call 33e7748 4137->4143 4144 33ea2c2 4137->4144 4172 33ea330-33ea33e call 33d2e7d 4143->4172 4144->4143 4148->4084 4173 33ea340-33ea379 call 33c3943 call 33d49a6 call 33c3943 call 33c3987 4172->4173 4173->3874
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopItemTextWindow
    • String ID: C@$!$#$'`5x$PO$Y$]K$e$f$f$h&}$r$t
    • API String ID: 2254304967-3921538676
    • Opcode ID: 7c5db17764e51ec0183eda63a456619c7eff79bf5fbf1e605f53d217db8fb3f4
    • Instruction ID: c27a71b76469c547c62b18c3b00a4f009c474a4d2404ae31978579874b9938bb
    • Opcode Fuzzy Hash: 7c5db17764e51ec0183eda63a456619c7eff79bf5fbf1e605f53d217db8fb3f4
    • Instruction Fuzzy Hash: 6E6254B4D0026D9EDB21DF94CC85BEEBBB8AB19304F5080E9D549BB281DB745B84CF91
    Function 033D2852 Relevance: 21.3, APIs: 14, Instructions: 260filewindowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 4183 33d2852-33d2875 call 33c1868 4186 33d2887-33d288a 4183->4186 4187 33d288c-33d288f 4186->4187 4188 33d2877-33d2884 4186->4188 4189 33d289f-33d28a2 4187->4189 4188->4186 4190 33d28a4-33d28aa 4189->4190 4191 33d2891-33d289c 4189->4191 4192 33d28b6-33d28b9 4190->4192 4191->4189 4193 33d28ac-33d28b3 4192->4193 4194 33d28bb-33d28be 4192->4194 4193->4192 4195 33d28ff-33d2903 4194->4195 4196 33d2905-33d2916 call 33c39d4 call 33d2421 4195->4196 4197 33d28c0-33d28cf 4195->4197 4207 33d291c-33d2961 call 33c1d3a call 33c9122 CreateFileMappingW call 33d09bd 4196->4207 4208 33d2b59 4196->4208 4198 33d28f7-33d28fa 4197->4198 4200 33d28fc 4198->4200 4201 33d28d1-33d28d7 4198->4201 4200->4195 4203 33d28d9-33d28ee GetDesktopWindow GetDC GetTextExtentPointW 4201->4203 4204 33d28f4 4201->4204 4203->4204 4204->4198 4216 33d2971-33d2975 4207->4216 4209 33d2b5b-33d2b61 4208->4209 4217 33d2977-33d297e 4216->4217 4218 33d2963-33d296e 4216->4218 4219 33d29e6-33d29ea 4217->4219 4218->4216 4220 33d29ec-33d29f2 4219->4220 4221 33d2980-33d298d 4219->4221 4222 33d2a0d-33d2a18 call 33d09a5 4220->4222 4223 33d29f4-33d2a0b 4220->4223 4224 33d298f-33d2994 GetSysColorBrush 4221->4224 4225 33d299a-33d299d 4221->4225 4222->4208 4231 33d2a1e-33d2a2b 4222->4231 4223->4222 4223->4223 4224->4225 4227 33d29dd-33d29e1 4225->4227 4228 33d299f-33d29a5 4227->4228 4229 33d29e3 4227->4229 4232 33d29b5-33d29bb 4228->4232 4233 33d29a7-33d29af GetDesktopWindow SetWindowTextW 4228->4233 4229->4219 4234 33d2a2d-33d2a33 4231->4234 4235 33d2a50-33d2a5d 4231->4235 4236 33d29bd-33d29d4 FormatMessageW 4232->4236 4237 33d29da 4232->4237 4233->4232 4238 33d2a7e-33d2a95 call 33d251b 4234->4238 4239 33d2a35-33d2a4e GetDesktopWindow SetDlgItemInt 4234->4239 4235->4238 4240 33d2a5f-33d2a78 GetDesktopWindow GetDC SetViewportExtEx 4235->4240 4236->4237 4237->4227 4243 33d2a97-33d2aa8 call 33d208b 4238->4243 4244 33d2ac1-33d2b04 call 33d254a 4238->4244 4239->4238 4240->4238 4243->4208 4249 33d2aae 4243->4249 4244->4208 4250 33d2b06 4244->4250 4251 33d2abc-33d2abf 4249->4251 4252 33d2ab0-33d2ab6 4249->4252 4253 33d2b0d-33d2b0f 4250->4253 4254 33d2b08-33d2b0b 4250->4254 4255 33d2b28-33d2b4b call 33c9122 MapViewOfFile 4251->4255 4252->4208 4252->4251 4253->4208 4256 33d2b11 4253->4256 4254->4208 4254->4253 4255->4208 4265 33d2b4d-33d2b57 4255->4265 4258 33d2b19 4256->4258 4259 33d2b13-33d2b15 4256->4259 4258->4208 4262 33d2b1b 4258->4262 4259->4208 4261 33d2b17 4259->4261 4261->4258 4263 33d2b1d-33d2b20 4262->4263 4264 33d2b22-33d2b25 4262->4264 4263->4208 4263->4264 4264->4255 4265->4209
    APIs
    • GetDesktopWindow.USER32 ref: 033D28E0
    • GetDC.USER32(00000000), ref: 033D28E7
    • GetTextExtentPointW.GDI32(00000000), ref: 033D28EE
    • CreateFileMappingW.KERNELBASE(00000000,00000002,00000000,00000000,00000000,00000003,75A89CE0,?,00000000), ref: 033D2945
    • GetSysColorBrush.USER32(0000196A), ref: 033D2994
    • GetDesktopWindow.USER32 ref: 033D29A8
    • SetWindowTextW.USER32(00000000), ref: 033D29AF
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000000), ref: 033D29D4
    • GetDesktopWindow.USER32 ref: 033D2A41
    • SetDlgItemInt.USER32(00000000), ref: 033D2A48
    • GetDesktopWindow.USER32 ref: 033D2A6A
    • GetDC.USER32(00000000), ref: 033D2A71
    • SetViewportExtEx.GDI32(00000000), ref: 033D2A78
    • MapViewOfFile.KERNEL32(00000004,033D2769,?,?,?,?,?,?,?,0341CF60,00000000), ref: 033D2B44
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$FileText$BrushColorCreateExtentFormatItemMappingMessagePointViewViewport
    • String ID:
    • API String ID: 2213085167-0
    • Opcode ID: 3a52c3050ddecc77a9906c5e30c0db3debcef1422e61f9c73f8c14fb45d22f2c
    • Instruction ID: 74dcdc9c03e2028d890022faf11b6d20b22c51c805958ce61ff91bd6eb35d5c3
    • Opcode Fuzzy Hash: 3a52c3050ddecc77a9906c5e30c0db3debcef1422e61f9c73f8c14fb45d22f2c
    • Instruction Fuzzy Hash: 1CA18DB6D04749EFDB10DFA4E8D49AEFBB9FF04315F088999E511AB280C7314A85CB90
    Function 033D20BE Relevance: 19.8, APIs: 13, Instructions: 288filewindowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 4266 33d20be-33d20e1 call 33c1868 4269 33d20f3-33d20f6 4266->4269 4270 33d20f8-33d20fb 4269->4270 4271 33d20e3-33d20f0 4269->4271 4272 33d210b-33d210e 4270->4272 4271->4269 4273 33d20fd-33d2108 4272->4273 4274 33d2110-33d2119 4272->4274 4273->4272 4275 33d2121-33d2124 4274->4275 4276 33d211b-33d211e 4275->4276 4277 33d2126-33d2129 4275->4277 4276->4275 4278 33d216d-33d2171 4277->4278 4279 33d212b-33d213a 4278->4279 4280 33d2173-33d21a6 call 33c39d4 4278->4280 4282 33d2165-33d2168 4279->4282 4286 33d21b6-33d21b9 4280->4286 4283 33d213c-33d2143 4282->4283 4284 33d216a 4282->4284 4287 33d2145-33d2160 GetDesktopWindow GetDC GetTextExtentPointW 4283->4287 4288 33d2162 4283->4288 4284->4278 4289 33d21a8-33d21b3 4286->4289 4290 33d21bb-33d21c2 4286->4290 4287->4288 4288->4282 4289->4286 4291 33d2233-33d2237 4290->4291 4292 33d2239-33d223f 4291->4292 4293 33d21c4-33d21d2 4291->4293 4294 33d225a-33d2274 4292->4294 4295 33d2241-33d2258 4292->4295 4296 33d21d4-33d21df GetSysColorBrush 4293->4296 4297 33d21e1-33d21e4 4293->4297 4298 33d229a-33d22a8 4294->4298 4299 33d2276-33d227d 4294->4299 4295->4294 4295->4295 4296->4297 4300 33d222a-33d222e 4297->4300 4304 33d22ce-33d22e5 4298->4304 4305 33d22aa-33d22c3 GetDesktopWindow GetDC SetViewportExtEx 4298->4305 4303 33d227f-33d2298 GetDesktopWindow SetDlgItemInt 4299->4303 4299->4304 4301 33d21e6-33d21ed 4300->4301 4302 33d2230 4300->4302 4307 33d21ff-33d2206 4301->4307 4308 33d21ef-33d21fd GetDesktopWindow SetWindowTextW 4301->4308 4302->4291 4306 33d22c9-33d22cc 4303->4306 4309 33d2418-33d241e 4304->4309 4310 33d22eb-33d2302 4304->4310 4305->4306 4306->4304 4313 33d2208-33d2225 FormatMessageW 4307->4313 4314 33d2227 4307->4314 4308->4307 4311 33d230a-33d2310 4310->4311 4312 33d2304 4310->4312 4315 33d2318-33d231e 4311->4315 4316 33d2312 4311->4316 4312->4311 4313->4314 4314->4300 4317 33d2326-33d2339 4315->4317 4318 33d2320 4315->4318 4316->4315 4319 33d233d-33d2343 4317->4319 4320 33d233b 4317->4320 4318->4317 4321 33d2348-33d235b 4319->4321 4322 33d2345 4319->4322 4320->4319 4323 33d235d 4321->4323 4324 33d2362-33d2368 4321->4324 4322->4321 4323->4324 4325 33d236c-33d2372 4324->4325 4326 33d236a 4324->4326 4327 33d2379-33d237f 4325->4327 4328 33d2374 4325->4328 4326->4325 4329 33d2386-33d238d 4327->4329 4330 33d2381 4327->4330 4328->4327 4331 33d238f 4329->4331 4332 33d2391-33d23b3 call 33c9122 CreateFileW call 33d09bd 4329->4332 4330->4329 4331->4332 4336 33d23b8-33d23c2 call 33d09a5 4332->4336 4339 33d23ff-33d2415 call 33c9122 call 33d242a 4336->4339 4340 33d23c4-33d23d6 4336->4340 4339->4309 4342 33d23d8-33d23f2 call 33c9122 4340->4342 4343 33d23f4-33d23f7 4340->4343 4342->4309 4343->4309 4346 33d23f9-33d23fd 4343->4346 4346->4309
    APIs
    • GetDesktopWindow.USER32 ref: 033D214C
    • GetDC.USER32(00000000), ref: 033D2153
    • GetTextExtentPointW.GDI32(00000000), ref: 033D215A
    • GetSysColorBrush.USER32(0000196A), ref: 033D21D9
    • GetDesktopWindow.USER32 ref: 033D21F0
    • SetWindowTextW.USER32(00000000), ref: 033D21F7
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,75A89CE0,?,00000000), ref: 033D221F
    • GetDesktopWindow.USER32 ref: 033D228B
    • SetDlgItemInt.USER32(00000000), ref: 033D2292
    • GetDesktopWindow.USER32 ref: 033D22B5
    • GetDC.USER32(00000000), ref: 033D22BC
    • SetViewportExtEx.GDI32(00000000), ref: 033D22C3
    • CreateFileW.KERNEL32(000000F2,00000000,5C6F1BF5,8F93905C,00000000,00000003,75A89CE0,?,00000000), ref: 033D23AE
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorCreateExtentFileFormatItemMessagePointViewport
    • String ID:
    • API String ID: 349340697-0
    • Opcode ID: f4d4daaec228cdae9e5e2b9660a20abcfc0fc408bd3697f53036f2fc737b8957
    • Instruction ID: 5f2d6b1f5fa45a48ad067e81810b03928095dba6d59e2a1414faeb9b6eec45c7
    • Opcode Fuzzy Hash: f4d4daaec228cdae9e5e2b9660a20abcfc0fc408bd3697f53036f2fc737b8957
    • Instruction Fuzzy Hash: 09A19172E04309EEEB14DF99EC897AEBBB5EF44311F18C869E915AE1C1C7748680CB50
    Function 033E8EBB Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 446COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 4352 33e8ebb-33e8f00 call 33ea693 4359 33ea1a9-33ea24e call 33c1868 call 33eac9b 4352->4359 4360 33e8f06 4352->4360 4370 33ea46f-33ea47d call 33c39d4 4359->4370 4371 33ea254-33ea256 4359->4371 4362 33e8f0f-33e8fbe call 33c7c9c call 33e6ffc call 33e6fd5 call 33c3987 * 2 call 33fcea1 4360->4362 4395 33ea188-33ea195 call 33c3987 4362->4395 4396 33e8fc4-33e8fc7 4362->4396 4380 33ea47f-33ea54e call 33c38f8 * 3 call 33c3987 call 33c38f8 4370->4380 4374 33ea257-33ea469 4371->4374 4374->4370 4402 33ea19a-33ea1a3 4395->4402 4396->4395 4399 33e8fcd-33e90c5 call 33fca22 call 33fce35 call 33fca22 call 33d5c51 call 33fc8e7 call 33eb587 call 33d49d0 4396->4399 4420 33ea14d-33ea153 4399->4420 4421 33e90cb-33e90cf 4399->4421 4402->4359 4402->4362 4423 33ea15d-33ea183 call 33c3943 call 33d49a6 call 33c3943 4420->4423 4424 33ea155-33ea159 4420->4424 4421->4420 4422 33e90d5-33e918d call 33fd30d 4421->4422 4430 33e9193-33e9196 4422->4430 4423->4395 4424->4423 4432 33e91ae-33e920c call 33eb587 4430->4432 4433 33e9198-33e91ac 4430->4433 4436 33e920f-33e9215 4432->4436 4433->4436 4436->4430 4437 33e921b-33e92b4 4436->4437 4439 33e92b5-33e92b8 4437->4439 4440 33e92ca-33e92f6 4439->4440 4441 33e92ba-33e92c8 4439->4441 4442 33e92fd-33e9303 4440->4442 4441->4442 4442->4439 4443 33e9305-33e938a 4442->4443 4444 33e938b-33e938e 4443->4444 4445 33e93a0-33e93cc 4444->4445 4446 33e9390-33e939e 4444->4446 4447 33e93d3-33e93d9 4445->4447 4446->4447 4447->4444 4448 33e93db-33e9500 call 33c7c6d * 3 call 33e741f call 33f897e 4447->4448 4459 33e9501-33e9504 4448->4459 4460 33e9516-33e9544 4459->4460 4461 33e9506-33e9514 4459->4461 4462 33e954b-33e9551 4460->4462 4461->4462 4462->4459 4463 33e9553-33e9582 call 33c7c6d 4462->4463 4466 33e9585-33e958b 4463->4466 4467 33e9779-33e97eb 4466->4467 4468 33e9591-33e95ff call 33e6eff call 33e08e6 call 33c38f8 call 33de3b4 4466->4468 4469 33e97ec-33e981f 4467->4469 4485 33e9605-33e974c call 33e6eae call 33c17a1 * 3 call 33eb820 call 33e74e3 call 33c17a1 * 3 call 33eb820 call 33e74e3 call 33e7b64 call 33c38f8 4468->4485 4486 33e9751-33e9774 call 33c3943 call 33d16c1 4468->4486 4469->4469 4471 33e9821-33e9886 call 33c7c6d call 33e08e6 call 33de379 call 33c3943 call 33c38f8 4469->4471 4498 33e988c-33e9904 4471->4498 4499 33e9c43-33e9cb4 4471->4499 4485->4486 4486->4466 4501 33e9905-33e9908 4498->4501 4502 33e9cb5-33e9cb8 4499->4502 4504 33e991a-33e9946 4501->4504 4505 33e990a-33e9918 4501->4505 4506 33e9cca-33e9cf6 4502->4506 4507 33e9cba-33e9cc8 4502->4507 4509 33e994d-33e9953 4504->4509 4505->4509 4510 33e9cfd-33e9d03 4506->4510 4507->4510 4509->4501 4512 33e9955-33e9a47 call 33c7c6d call 33e6ed7 call 33e08e6 call 33c38f8 * 2 4509->4512 4510->4502 4513 33e9d05-33e9dcd call 33c7c6d call 33e08e6 call 33c38f8 4510->4513 4546 33e9a48-33e9a4b 4512->4546 4533 33e9dce-33e9dd1 4513->4533 4536 33e9de3-33e9e0f 4533->4536 4537 33e9dd3-33e9de1 4533->4537 4541 33e9e16-33e9e1c 4536->4541 4537->4541 4541->4533 4545 33e9e1e-33e9ea2 call 33c7c6d call 33e08e6 call 33c38f8 call 33de3b4 4541->4545 4572 33e9ea8-33e9ebf call 33de379 4545->4572 4573 33e9f65-33e9f75 4545->4573 4549 33e9a5d-33e9a8b 4546->4549 4550 33e9a4d-33e9a5b 4546->4550 4553 33e9a92-33e9a98 4549->4553 4550->4553 4553->4546 4556 33e9a9a-33e9ae8 call 33c7c6d call 33dd984 4553->4556 4570 33e9aee 4556->4570 4571 33e9c14-33e9c3e call 33c1a13 call 33c38f8 call 33c3943 4556->4571 4576 33e9af1-33e9af8 4570->4576 4571->4499 4572->4573 4585 33e9ec5-33e9f60 call 33e750b call 33e6eae call 33eb42f call 33c38f8 * 2 4572->4585 4577 33ea0ad-33ea14b call 33d16c1 call 33c3943 * 2 call 33c38f8 call 33e1897 call 33e7748 call 33c3943 call 33d49a6 call 33c3943 call 33c3987 4573->4577 4578 33e9f7b-33e9f81 4573->4578 4582 33e9afe-33e9bef call 33e6f6a call 33e08ac call 33e6ed7 call 33c38f8 call 33eb30e call 33d16c1 call 33c38f8 call 33c3943 4576->4582 4583 33e9bf4-33e9c0e call 33d4c7b 4576->4583 4577->4402 4584 33e9f87-33e9f89 4578->4584 4582->4583 4583->4571 4583->4576 4590 33ea09f-33ea0a7 4584->4590 4591 33e9f8f-33ea001 call 33c17a1 call 33e057d call 33e04f7 call 33c38f8 call 33eb587 4584->4591 4585->4573 4590->4577 4590->4584 4635 33ea2a8-33ea2af 4591->4635 4636 33ea007-33ea00e 4591->4636 4637 33ea2b5 4635->4637 4638 33ea2b1-33ea2b3 4635->4638 4641 33ea070-33ea087 call 33c38f8 4636->4641 4642 33ea010-33ea06a call 33eaf6d call 33eb108 4636->4642 4643 33ea2b7-33ea2c0 4637->4643 4638->4643 4641->4591 4654 33ea08d-33ea09c 4641->4654 4642->4635 4642->4641 4649 33ea2c4-33ea33e call 33e0391 call 33c38f8 call 33d16c1 call 33c3943 * 2 call 33c38f8 call 33e1897 call 33e7748 call 33d2e7d 4643->4649 4650 33ea2c2 4643->4650 4679 33ea340-33ea379 call 33c3943 call 33d49a6 call 33c3943 call 33c3987 4649->4679 4650->4649 4654->4590 4679->4380
    APIs
      • Part of subcall function 033C7C9C: char_traits.LIBCPMT ref: 033C7CB5
    • _fseek.LIBCMT ref: 033E8FD3
    • _fseek.LIBCMT ref: 033E8FE7
      • Part of subcall function 033FCA22: __lock_file.LIBCMT ref: 033FCA67
      • Part of subcall function 033FCA22: __fseek_nolock.LIBCMT ref: 033FCA76
    • __fread_nolock.LIBCMT ref: 033E902D
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _fseek$__fread_nolock__fseek_nolock__lock_filechar_traits
    • String ID: C@$#$Y$]K$e$f$r$t
    • API String ID: 15111844-2411602883
    • Opcode ID: 10e7e700d5feeee4420f39db90fefb89327f85880e8089cd08075d2ffcac49d7
    • Instruction ID: a081a68044bdfbb65ea523a5a708db931025d5837d7837e4495779f779a6f255
    • Opcode Fuzzy Hash: 10e7e700d5feeee4420f39db90fefb89327f85880e8089cd08075d2ffcac49d7
    • Instruction Fuzzy Hash: D51265B5C0126CAEEB21DB54CC88BDEBBB8AB15304F4440E9D5497B281EB755F88CF51
    Function 033E8EAB Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 441COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 4689 33e8eab-33e8eae 4690 33e8ee7-33e8f00 4689->4690 4691 33e8eb0-33e8ee5 4689->4691 4695 33ea1a9-33ea24e call 33c1868 call 33eac9b 4690->4695 4696 33e8f06 4690->4696 4691->4690 4706 33ea46f-33ea47d call 33c39d4 4695->4706 4707 33ea254-33ea256 4695->4707 4698 33e8f0f-33e8f78 call 33c7c9c call 33e6ffc call 33e6fd5 call 33c3987 * 2 4696->4698 4724 33e8f7d-33e8fb4 call 33fcea1 4698->4724 4716 33ea47f-33ea54e call 33c38f8 * 3 call 33c3987 call 33c38f8 4706->4716 4710 33ea257-33ea469 4707->4710 4710->4706 4729 33e8fb9-33e8fbe 4724->4729 4731 33ea188-33ea195 call 33c3987 4729->4731 4732 33e8fc4-33e8fc7 4729->4732 4738 33ea19a-33ea1a3 4731->4738 4732->4731 4735 33e8fcd-33e8fe7 call 33fca22 call 33fce35 call 33fca22 4732->4735 4747 33e8fec-33e900d call 33d5c51 4735->4747 4738->4695 4738->4698 4749 33e9012-33e90af call 33fc8e7 call 33eb587 call 33d49d0 4747->4749 4755 33e90b4-33e90c5 4749->4755 4756 33ea14d-33ea153 4755->4756 4757 33e90cb-33e90cf 4755->4757 4759 33ea15d-33ea183 call 33c3943 call 33d49a6 call 33c3943 4756->4759 4760 33ea155-33ea159 4756->4760 4757->4756 4758 33e90d5-33e918d call 33fd30d 4757->4758 4766 33e9193-33e9196 4758->4766 4759->4731 4760->4759 4768 33e91ae-33e920c call 33eb587 4766->4768 4769 33e9198-33e91ac 4766->4769 4772 33e920f-33e9215 4768->4772 4769->4772 4772->4766 4773 33e921b-33e92b4 4772->4773 4775 33e92b5-33e92b8 4773->4775 4776 33e92ca-33e92f6 4775->4776 4777 33e92ba-33e92c8 4775->4777 4778 33e92fd-33e9303 4776->4778 4777->4778 4778->4775 4779 33e9305-33e938a 4778->4779 4780 33e938b-33e938e 4779->4780 4781 33e93a0-33e93cc 4780->4781 4782 33e9390-33e939e 4780->4782 4783 33e93d3-33e93d9 4781->4783 4782->4783 4783->4780 4784 33e93db-33e9500 call 33c7c6d * 3 call 33e741f call 33f897e 4783->4784 4795 33e9501-33e9504 4784->4795 4796 33e9516-33e9544 4795->4796 4797 33e9506-33e9514 4795->4797 4798 33e954b-33e9551 4796->4798 4797->4798 4798->4795 4799 33e9553-33e9582 call 33c7c6d 4798->4799 4802 33e9585-33e958b 4799->4802 4803 33e9779-33e97eb 4802->4803 4804 33e9591-33e95ff call 33e6eff call 33e08e6 call 33c38f8 call 33de3b4 4802->4804 4805 33e97ec-33e981f 4803->4805 4821 33e9605-33e974c call 33e6eae call 33c17a1 * 3 call 33eb820 call 33e74e3 call 33c17a1 * 3 call 33eb820 call 33e74e3 call 33e7b64 call 33c38f8 4804->4821 4822 33e9751-33e9774 call 33c3943 call 33d16c1 4804->4822 4805->4805 4807 33e9821-33e9886 call 33c7c6d call 33e08e6 call 33de379 call 33c3943 call 33c38f8 4805->4807 4834 33e988c-33e9904 4807->4834 4835 33e9c43-33e9cb4 4807->4835 4821->4822 4822->4802 4837 33e9905-33e9908 4834->4837 4838 33e9cb5-33e9cb8 4835->4838 4840 33e991a-33e9946 4837->4840 4841 33e990a-33e9918 4837->4841 4842 33e9cca-33e9cf6 4838->4842 4843 33e9cba-33e9cc8 4838->4843 4845 33e994d-33e9953 4840->4845 4841->4845 4846 33e9cfd-33e9d03 4842->4846 4843->4846 4845->4837 4848 33e9955-33e9a47 call 33c7c6d call 33e6ed7 call 33e08e6 call 33c38f8 * 2 4845->4848 4846->4838 4849 33e9d05-33e9dcd call 33c7c6d call 33e08e6 call 33c38f8 4846->4849 4882 33e9a48-33e9a4b 4848->4882 4869 33e9dce-33e9dd1 4849->4869 4872 33e9de3-33e9e0f 4869->4872 4873 33e9dd3-33e9de1 4869->4873 4877 33e9e16-33e9e1c 4872->4877 4873->4877 4877->4869 4881 33e9e1e-33e9ea2 call 33c7c6d call 33e08e6 call 33c38f8 call 33de3b4 4877->4881 4908 33e9ea8-33e9ebf call 33de379 4881->4908 4909 33e9f65-33e9f75 4881->4909 4885 33e9a5d-33e9a8b 4882->4885 4886 33e9a4d-33e9a5b 4882->4886 4889 33e9a92-33e9a98 4885->4889 4886->4889 4889->4882 4892 33e9a9a-33e9ae8 call 33c7c6d call 33dd984 4889->4892 4906 33e9aee 4892->4906 4907 33e9c14-33e9c3e call 33c1a13 call 33c38f8 call 33c3943 4892->4907 4912 33e9af1-33e9af8 4906->4912 4907->4835 4908->4909 4921 33e9ec5-33e9f60 call 33e750b call 33e6eae call 33eb42f call 33c38f8 * 2 4908->4921 4913 33ea0ad-33ea14b call 33d16c1 call 33c3943 * 2 call 33c38f8 call 33e1897 call 33e7748 call 33c3943 call 33d49a6 call 33c3943 call 33c3987 4909->4913 4914 33e9f7b-33e9f81 4909->4914 4918 33e9afe-33e9bef call 33e6f6a call 33e08ac call 33e6ed7 call 33c38f8 call 33eb30e call 33d16c1 call 33c38f8 call 33c3943 4912->4918 4919 33e9bf4-33e9c0e call 33d4c7b 4912->4919 4913->4738 4920 33e9f87-33e9f89 4914->4920 4918->4919 4919->4907 4919->4912 4926 33ea09f-33ea0a7 4920->4926 4927 33e9f8f-33ea001 call 33c17a1 call 33e057d call 33e04f7 call 33c38f8 call 33eb587 4920->4927 4921->4909 4926->4913 4926->4920 4971 33ea2a8-33ea2af 4927->4971 4972 33ea007-33ea00e 4927->4972 4973 33ea2b5 4971->4973 4974 33ea2b1-33ea2b3 4971->4974 4977 33ea070-33ea087 call 33c38f8 4972->4977 4978 33ea010-33ea06a call 33eaf6d call 33eb108 4972->4978 4979 33ea2b7-33ea2c0 4973->4979 4974->4979 4977->4927 4990 33ea08d-33ea09c 4977->4990 4978->4971 4978->4977 4985 33ea2c4-33ea32b call 33e0391 call 33c38f8 call 33d16c1 call 33c3943 * 2 call 33c38f8 call 33e1897 call 33e7748 4979->4985 4986 33ea2c2 4979->4986 5014 33ea330-33ea33e call 33d2e7d 4985->5014 4986->4985 4990->4926 5015 33ea340-33ea379 call 33c3943 call 33d49a6 call 33c3943 call 33c3987 5014->5015 5015->4716
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _fseek$__fread_nolock
    • String ID: C@$#$Y$]K$e$f$r$t
    • API String ID: 1795926144-2411602883
    • Opcode ID: 2d528e74903ec87688e47f8fd3febbdd5604fa3de356d65049178ff95b72cd0a
    • Instruction ID: 91046c48aefad347707926ed72068acab3d09422144978a416caa1fdb1742891
    • Opcode Fuzzy Hash: 2d528e74903ec87688e47f8fd3febbdd5604fa3de356d65049178ff95b72cd0a
    • Instruction Fuzzy Hash: A91255B5C0126CAEEB21DB54CC88BDEBBB8AB19304F4440E9D5497B281EB755F88CF51
    Function 033D25AC Relevance: 18.2, APIs: 12, Instructions: 178windowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5025 33d25ac-33d25ce call 33c1868 5028 33d25e0-33d25e3 5025->5028 5029 33d25e5-33d25e8 5028->5029 5030 33d25d0-33d25dd 5028->5030 5031 33d25f8-33d25fb 5029->5031 5030->5028 5032 33d25fd-33d2600 5031->5032 5033 33d25ea-33d25f5 5031->5033 5034 33d260c-33d2610 5032->5034 5033->5031 5035 33d2602-33d2609 5034->5035 5036 33d2612-33d261b 5034->5036 5035->5034 5037 33d265c-33d2660 5036->5037 5038 33d261d-33d262c 5037->5038 5039 33d2662-33d2673 call 33c39d4 call 33d27dd 5037->5039 5041 33d2653-33d2657 5038->5041 5049 33d267c-33d2691 call 33d0806 call 33d2421 5039->5049 5050 33d2675-33d2677 5039->5050 5042 33d262e-33d2635 5041->5042 5043 33d2659 5041->5043 5046 33d2637-33d264e GetDesktopWindow GetDC GetTextExtentPointW 5042->5046 5047 33d2650 5042->5047 5043->5037 5046->5047 5047->5041 5049->5050 5056 33d2693-33d26aa 5049->5056 5051 33d27d5-33d27da 5050->5051 5057 33d26ac-33d26be 5056->5057 5058 33d26c2-33d26c9 5056->5058 5057->5057 5060 33d26c0 5057->5060 5059 33d2736-33d273a 5058->5059 5061 33d273c-33d2742 5059->5061 5062 33d26cb-33d26d9 5059->5062 5060->5058 5065 33d275d-33d2764 call 33d2852 5061->5065 5066 33d2744-33d275b 5061->5066 5063 33d26e8-33d26eb 5062->5063 5064 33d26db-33d26e6 GetSysColorBrush 5062->5064 5067 33d272d-33d2731 5063->5067 5064->5063 5069 33d2769-33d276b 5065->5069 5066->5065 5066->5066 5070 33d26ed-33d26f4 5067->5070 5071 33d2733 5067->5071 5072 33d276d-33d2774 call 33d2800 5069->5072 5073 33d2779-33d2788 5069->5073 5074 33d26f6-33d2700 GetDesktopWindow SetWindowTextW 5070->5074 5075 33d2702-33d2709 5070->5075 5071->5059 5072->5050 5077 33d27a9-33d27b6 5073->5077 5078 33d278a-33d2790 5073->5078 5074->5075 5079 33d270b-33d2728 FormatMessageW 5075->5079 5080 33d272a 5075->5080 5082 33d27d3 5077->5082 5084 33d27b8-33d27cd GetDesktopWindow GetDC SetViewportExtEx 5077->5084 5078->5082 5083 33d2792-33d27a7 GetDesktopWindow SetDlgItemInt 5078->5083 5079->5080 5080->5067 5082->5051 5083->5082 5084->5082
    APIs
    • GetDesktopWindow.USER32 ref: 033D263E
    • GetDC.USER32(00000000), ref: 033D2641
    • GetTextExtentPointW.GDI32(00000000,?,?), ref: 033D2648
    • GetSysColorBrush.USER32(0000196A), ref: 033D26E0
    • GetDesktopWindow.USER32 ref: 033D26F7
    • SetWindowTextW.USER32(00000000), ref: 033D26FA
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000002,00000021,00000003,?,?,?,00000000,00000000), ref: 033D2722
    • GetDesktopWindow.USER32 ref: 033D279E
    • SetDlgItemInt.USER32(00000000,?,?), ref: 033D27A1
    • GetDesktopWindow.USER32 ref: 033D27C3
    • GetDC.USER32(00000000), ref: 033D27C6
    • SetViewportExtEx.GDI32(00000000,?,?), ref: 033D27CD
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatItemMessagePointViewport
    • String ID:
    • API String ID: 1998102902-0
    • Opcode ID: 41d02364c48ae0e2af7f6be911e99b15eb297632d47d7151a69028877b20a146
    • Instruction ID: 7905e72bcd7de4db87279d84d07f8aec7a32dfd488f539c6dfd8d6ccb6bb85ca
    • Opcode Fuzzy Hash: 41d02364c48ae0e2af7f6be911e99b15eb297632d47d7151a69028877b20a146
    • Instruction Fuzzy Hash: 37617D75E00348FEDB10EFA4E9886AEBFB5AF44315F14C89AE815EA281D7748681CB50
    Function 03404F40 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 194COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5415 3404f40-3404f43 5416 3404f45-3404f48 5415->5416 5417 3404f68-3404f6d 5415->5417 5419 3404f61-3404f74 5416->5419 5420 3404f4a-3404f55 call 33fbf95 call 3400efc 5416->5420 5418 3404f77-3404f83 5417->5418 5422 3405150-3405162 5418->5422 5423 3404f89 5418->5423 5419->5418 5432 3404f5a-3404f5c 5420->5432 5422->5420 5433 3405168-3405178 call 3409418 5422->5433 5427 3404f90-3404f92 5423->5427 5430 3404f98-3404f9e 5427->5430 5431 340509f-34050a4 5427->5431 5434 3404fa4 5430->5434 5435 340502e-3405031 5430->5435 5431->5422 5436 34050aa-34050ad 5431->5436 5437 34051a7-34051ad 5432->5437 5446 340517d-3405182 5433->5446 5439 3404fa6-3404fa9 5434->5439 5440 340501c-3405020 5434->5440 5441 3405083-3405088 5435->5441 5442 3405033-3405036 5435->5442 5443 34050b2-34050b5 5436->5443 5450 3405090-3405099 5439->5450 5451 3404faf-3404fb2 5439->5451 5447 340508a-340508c 5440->5447 5449 3405022-340502c 5440->5449 5441->5447 5448 340508e 5441->5448 5452 3405073-3405079 5442->5452 5453 3405038-3405039 5442->5453 5444 34050b7-34050c9 call 34082ce 5443->5444 5445 34050af 5443->5445 5444->5420 5469 34050cf-34050d5 5444->5469 5445->5443 5446->5432 5456 3405188-34051a4 5446->5456 5447->5450 5448->5450 5449->5450 5450->5427 5450->5431 5457 3404fb4-3404fb5 5451->5457 5458 3405006-3405009 5451->5458 5452->5447 5455 340507b-3405081 5452->5455 5459 3405066-3405068 5453->5459 5460 340503b-340503e 5453->5460 5455->5450 5456->5437 5464 3404fb7-3404fba 5457->5464 5465 3404ffa-3405001 5457->5465 5458->5447 5463 340500b-340501a 5458->5463 5459->5447 5462 340506a-3405071 5459->5462 5466 3405040-3405043 5460->5466 5467 3405059-340505b 5460->5467 5462->5450 5463->5450 5471 3404fe9-3404fec 5464->5471 5472 3404fbc-3404fbf 5464->5472 5465->5447 5466->5420 5468 3405049-340504f 5466->5468 5467->5447 5470 340505d-3405064 5467->5470 5468->5447 5475 3405051-3405057 5468->5475 5476 34050da-34050dd 5469->5476 5470->5450 5471->5447 5477 3404ff2-3404ff5 5471->5477 5473 3404fc1-3404fc4 5472->5473 5474 3404fde-3404fe4 5472->5474 5473->5420 5478 3404fc6-3404fc9 5473->5478 5474->5450 5475->5450 5479 34050d7 5476->5479 5480 34050df-34050e3 5476->5480 5477->5450 5478->5447 5481 3404fcf-3404fd9 5478->5481 5479->5476 5480->5420 5482 34050e9-34050ef 5480->5482 5481->5450 5482->5482 5483 34050f1-3405103 call 3409436 5482->5483 5486 3405110-3405122 call 3409436 5483->5486 5487 3405105-340510e 5483->5487 5490 3405124-340512d 5486->5490 5491 340512f-3405141 call 3409436 5486->5491 5487->5422 5490->5422 5491->5420 5494 3405147-340514a 5491->5494 5494->5422
    APIs
    • __wcsnicmp.LIBCMT ref: 034050F9
    • __wcsnicmp.LIBCMT ref: 03405118
      • Part of subcall function 033FBF95: __getptd_noexit.LIBCMT ref: 033FBF95
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: __wcsnicmp$__getptd_noexit
    • String ID: UNICODE$UTF-16LE$UTF-8$ccs
    • API String ID: 78897640-3573488595
    • Opcode ID: 30dfa22233bfe585a210d3f05e97a122eeeb6c96ea4f97510eef58a2d81be311
    • Instruction ID: 9e27bbc66d8fe3b9f0eb6425f48658220f5b48a4ccaa07da69aafbbbacc4f5c5
    • Opcode Fuzzy Hash: 30dfa22233bfe585a210d3f05e97a122eeeb6c96ea4f97510eef58a2d81be311
    • Instruction Fuzzy Hash: FA51E576F0830299EB34DE668A0977F6694EB02310F1C44FBEE559E3C1E67485418EDD
    Function 033E600C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 495COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5495 33e600c-33e6023 call 33f92b8 5498 33e6029-33e602d 5495->5498 5499 33e6656-33e665c 5495->5499 5502 33e6033-33e603f 5498->5502 5503 33e6631-33e663d 5498->5503 5500 33e665e-33e666a ExtCreateRegion 5499->5500 5501 33e666c-33e666d GetFileSize 5499->5501 5504 33e6673-33e6683 5500->5504 5501->5504 5505 33e6052-33e6056 5502->5505 5503->5504 5506 33e663f 5503->5506 5507 33e6058-33e605e 5505->5507 5508 33e6041-33e604f 5505->5508 5509 33e6642-33e6652 5506->5509 5510 33e60ae-33e60b3 5507->5510 5511 33e6060-33e6086 call 33e555e 5507->5511 5508->5505 5509->5509 5512 33e6654 5509->5512 5514 33e60bf-33e6103 call 33c1868 call 33e555e 5510->5514 5515 33e60b5-33e60ba 5510->5515 5518 33e6088-33e60a6 call 33e600c 5511->5518 5519 33e60a9-33e60ac 5511->5519 5512->5504 5525 33e6150-33e6154 5514->5525 5515->5504 5518->5519 5519->5510 5519->5511 5526 33e6156-33e6183 call 33c39d4 call 33c9122 5525->5526 5527 33e6105-33e6113 5525->5527 5526->5515 5544 33e6189-33e61f0 call 33fc540 call 33c1868 * 2 call 33e4b73 5526->5544 5528 33e6125-33e6128 5527->5528 5529 33e6115-33e6122 call 33e5da7 5527->5529 5533 33e6147-33e614b 5528->5533 5529->5528 5536 33e614d 5533->5536 5537 33e612a-33e6131 5533->5537 5536->5525 5539 33e6144 5537->5539 5540 33e6133-33e6141 call 33e5fc5 5537->5540 5539->5533 5540->5539 5553 33e6205-33e6208 5544->5553 5554 33e620a-33e6211 5553->5554 5555 33e61f2-33e6202 5553->5555 5556 33e6228-33e622e 5554->5556 5557 33e6213-33e6225 call 33e5e39 5554->5557 5555->5553 5559 33e6231-33e6242 5556->5559 5557->5556 5561 33e6252-33e6256 5559->5561 5562 33e6258-33e6262 5561->5562 5563 33e6244-33e624f 5561->5563 5564 33e633f-33e6360 call 33e456b 5562->5564 5565 33e6268-33e629e call 33c1868 5562->5565 5563->5561 5564->5559 5570 33e6366-33e637f call 33c39d4 * 2 5564->5570 5571 33e62b3-33e62b6 5565->5571 5583 33e6387-33e6393 5570->5583 5584 33e6381-33e6383 5570->5584 5573 33e62b8-33e62bb 5571->5573 5574 33e62a0-33e62b0 5571->5574 5576 33e62cb-33e62ce 5573->5576 5574->5571 5577 33e62bd-33e62c8 5576->5577 5578 33e62d0-33e6339 call 33c39d4 5576->5578 5577->5576 5578->5564 5578->5565 5585 33e63a6-33e63aa 5583->5585 5584->5583 5586 33e63ac-33e63b2 5585->5586 5587 33e6395-33e63a3 5585->5587 5588 33e63e6-33e640c call 33c9122 GetVolumeInformationW 5586->5588 5589 33e63b4-33e63e4 call 33e5f6e call 33e4b73 5586->5589 5587->5585 5588->5515 5595 33e6412-33e641f 5588->5595 5589->5588 5597 33e642f-33e6432 5595->5597 5598 33e6434-33e643e 5597->5598 5599 33e6421-33e642c 5597->5599 5600 33e64f1-33e64f4 5598->5600 5599->5597 5601 33e64fa-33e655c call 33c1868 call 33e5ca7 5600->5601 5602 33e6443-33e644d 5600->5602 5617 33e655e-33e6581 5601->5617 5618 33e6587-33e6589 5601->5618 5604 33e64cd-33e64d0 5602->5604 5606 33e644f-33e6452 5604->5606 5607 33e64d6-33e64d9 5604->5607 5610 33e6465-33e6469 5606->5610 5609 33e64e9-33e64ec 5607->5609 5611 33e64ee 5609->5611 5612 33e64db-33e64e6 5609->5612 5613 33e646b-33e646e 5610->5613 5614 33e6454-33e6462 5610->5614 5611->5600 5612->5609 5616 33e647e-33e6481 5613->5616 5614->5610 5619 33e6483-33e648a 5616->5619 5620 33e6470-33e647b 5616->5620 5617->5618 5621 33e6583-33e6585 5617->5621 5622 33e658a-33e659f 5618->5622 5623 33e648c-33e64b0 call 33e43b5 5619->5623 5624 33e64b1-33e64b7 5619->5624 5620->5616 5621->5622 5625 33e65db-33e65de 5622->5625 5626 33e65a1-33e65a7 5622->5626 5623->5624 5629 33e64ca 5624->5629 5630 33e64b9-33e64c3 5624->5630 5627 33e661b-33e661f 5625->5627 5631 33e65d4-33e65d7 5626->5631 5634 33e65e0-33e6618 call 33e5ca7 5627->5634 5635 33e6621-33e662f call 33c39d4 5627->5635 5629->5604 5630->5629 5637 33e64c5-33e64c8 5630->5637 5632 33e65a9-33e65b5 5631->5632 5633 33e65d9 5631->5633 5640 33e65b7-33e65bd 5632->5640 5641 33e65c0-33e65d1 5632->5641 5633->5635 5634->5627 5635->5504 5637->5629 5637->5630 5640->5641 5641->5631
    APIs
    • __EH_prolog.LIBCMT ref: 033E6011
    • GetVolumeInformationW.KERNEL32(00000002,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000003,00000003), ref: 033E6408
    • ExtCreateRegion.GDI32(00000000,0000254C,00000000), ref: 033E6664
    • GetFileSize.KERNEL32(00000000,00000000,00000002,00000004,00000000), ref: 033E666D
      • Part of subcall function 033E5CA7: GetDesktopWindow.USER32 ref: 033E5CC6
      • Part of subcall function 033E5CA7: SetDlgItemTextW.USER32(00000000,?,033E5559), ref: 033E5CCD
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: CreateDesktopFileH_prologInformationItemRegionSizeTextVolumeWindow
    • String ID: !$x(
    • API String ID: 2925256546-3571294847
    • Opcode ID: 7bfedaf0007e4ed70da26c16447f16b01edf41831b8d27dc08b6ae31825052a4
    • Instruction ID: 540677343304d7f0855543f6e19d716240a0d0daf89e2d9ed0501456c615ebe3
    • Opcode Fuzzy Hash: 7bfedaf0007e4ed70da26c16447f16b01edf41831b8d27dc08b6ae31825052a4
    • Instruction Fuzzy Hash: 191256B8E4022ADFDB10DF98C982AEEB7B9FF14304F104469E915BB2C1D7B59A44CB51
    Function 033D0806 Relevance: 10.6, APIs: 7, Instructions: 135windowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5644 33d0806-33d0829 call 33c1868 5647 33d083b-33d083e 5644->5647 5648 33d082b-33d0838 5647->5648 5649 33d0840-33d0843 5647->5649 5648->5647 5650 33d0853-33d0856 5649->5650 5651 33d0858-33d085b 5650->5651 5652 33d0845-33d0850 5650->5652 5653 33d0867-33d086b 5651->5653 5652->5650 5654 33d085d-33d0864 5653->5654 5655 33d086d-33d0876 5653->5655 5654->5653 5656 33d08b4-33d08b8 5655->5656 5657 33d0878-33d0887 5656->5657 5658 33d08ba-33d08cc call 33c39d4 call 33d1268 5656->5658 5659 33d08ab-33d08af 5657->5659 5668 33d098f-33d0997 call 33d20be 5658->5668 5669 33d08d2-33d08e5 5658->5669 5661 33d0889-33d088f 5659->5661 5662 33d08b1 5659->5662 5664 33d08a8 5661->5664 5665 33d0891-33d08a2 GetDesktopWindow GetDC GetTextExtentPointW 5661->5665 5662->5656 5664->5659 5665->5664 5674 33d099c-33d09a2 5668->5674 5671 33d08f5-33d08f9 5669->5671 5672 33d08fb-33d0902 5671->5672 5673 33d08e7-33d08f2 5671->5673 5675 33d0966-33d096a 5672->5675 5673->5671 5676 33d096c-33d0972 5675->5676 5677 33d0904-33d0911 5675->5677 5676->5674 5680 33d0974-33d098b 5676->5680 5678 33d091e-33d0921 5677->5678 5679 33d0913-33d0918 GetSysColorBrush 5677->5679 5681 33d095d-33d0961 5678->5681 5679->5678 5680->5680 5682 33d098d 5680->5682 5683 33d0923-33d0929 5681->5683 5684 33d0963 5681->5684 5682->5674 5685 33d092b-33d092f GetDesktopWindow SetWindowTextW 5683->5685 5686 33d0935-33d093b 5683->5686 5684->5675 5685->5686 5687 33d093d-33d0954 FormatMessageW 5686->5687 5688 33d095a 5686->5688 5687->5688 5688->5681
    APIs
    • GetDesktopWindow.USER32 ref: 033D0898
    • GetDC.USER32(00000000), ref: 033D089B
    • GetTextExtentPointW.GDI32(00000000), ref: 033D08A2
    • GetSysColorBrush.USER32(0000196A), ref: 033D0918
    • GetDesktopWindow.USER32 ref: 033D092C
    • SetWindowTextW.USER32(00000000), ref: 033D092F
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,75A89CE0,?,00000000), ref: 033D0954
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$DesktopText$BrushColorExtentFormatMessagePoint
    • String ID:
    • API String ID: 627555471-0
    • Opcode ID: b5c3524db1ed135f908ea8c895254eb973346ee09b22cd963dc5018fa85c479a
    • Instruction ID: 6af9f975b15830c497f10783340bedf0e444ee0972be696f71a7444823ef970c
    • Opcode Fuzzy Hash: b5c3524db1ed135f908ea8c895254eb973346ee09b22cd963dc5018fa85c479a
    • Instruction Fuzzy Hash: 6B5149B5D04248EFDB14DFA9E8C44ADBFB8FB04715F14C49AE96AAA251C3348681CF90
    Function 03408F22 Relevance: 10.6, APIs: 7, Instructions: 62fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5689 3408f22-3408f30 5690 3408f32-3408f36 5689->5690 5691 3408f63-3408f88 GetLastError call 33fbf74 5689->5691 5690->5691 5692 3408f38-3408f61 call 3408b74 5690->5692 5697 3408f89-3409408 call 33fbf95 5691->5697 5692->5691 5698 3408f95-3408f9e GetFileType 5692->5698 5701 3408fa0-3408fd3 GetLastError call 33fbf74 CloseHandle 5698->5701 5701->5697 5705 3408fd5-3408fe0 call 33fbf95 5701->5705 5705->5697
    APIs
    • ___createFile.LIBCMT ref: 03408F53
      • Part of subcall function 03408B74: ___crtIsPackagedApp.LIBCMT ref: 03408B7A
      • Part of subcall function 03408B74: GetModuleHandleW.KERNEL32(kernel32.dll,CreateFile2,00000001,?,00000001,?,00000000,00000109), ref: 03408B8D
      • Part of subcall function 03408B74: GetProcAddress.KERNEL32(00000000), ref: 03408B94
    • GetLastError.KERNEL32 ref: 03408F7C
    • __dosmaperr.LIBCMT ref: 03408F83
    • GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 03408F96
    • GetLastError.KERNEL32 ref: 03408FB9
    • __dosmaperr.LIBCMT ref: 03408FC2
    • CloseHandle.KERNEL32(?), ref: 03408FCB
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: ErrorFileHandleLast__dosmaperr$AddressCloseModulePackagedProcType___create___crt
    • String ID:
    • API String ID: 569456945-0
    • Opcode ID: c31f53a29872941688d3ff5b98ac973b000b2dd1e2239e58d3611f1233a99c94
    • Instruction ID: 564d8e66eb4ad3cc42f7c170fa9f69d2150bd5a7e81900b4541b2a6f0d922ab6
    • Opcode Fuzzy Hash: c31f53a29872941688d3ff5b98ac973b000b2dd1e2239e58d3611f1233a99c94
    • Instruction Fuzzy Hash: 2311D271B003119FD709EFB4DE44A6DBB65BB01224B184769F9219F3D0DB70D851CB50
    Function 033D48BF Relevance: 9.1, APIs: 6, Instructions: 73COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5708 33d48bf-33d48dd call 33f92b8 5711 33d48df-33d48e5 5708->5711 5712 33d4902-33d490f 5708->5712 5713 33d48e7-33d4900 GetDesktopWindow SetDlgItemInt 5711->5713 5714 33d4930-33d4944 call 33d2d69 call 33d3e8f 5711->5714 5712->5714 5715 33d4911-33d492a GetDesktopWindow GetDC SetViewportExtEx 5712->5715 5713->5714 5719 33d4949-33d494d 5714->5719 5715->5714 5720 33d494f-33d4954 5719->5720 5721 33d4988-33d49a5 call 33c1a13 5719->5721 5722 33d4956-33d495e call 33d46c2 5720->5722 5723 33d4960-33d4964 5720->5723 5722->5723 5726 33d4986 5723->5726 5727 33d4966-33d4981 call 33d3d54 call 33d47fe call 33c3943 5723->5727 5726->5721 5727->5726
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: 8512147849c2680f8ff7e11077a60dfed255c10a5f1ee2a41187390a08b00cd8
    • Instruction ID: ec0a31db43ef14607579dceb75ff975a6b01fd3c860fda36d94fed92b6154333
    • Opcode Fuzzy Hash: 8512147849c2680f8ff7e11077a60dfed255c10a5f1ee2a41187390a08b00cd8
    • Instruction Fuzzy Hash: 2B21AE76D04259EBCB10EFE5E8C8AEDFB78AF00300F088558E5527F294DB304A44CB91
    Function 033FC722 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5874 33fc722-33fc73b 5875 33fc73d-33fc742 5874->5875 5876 33fc758 5874->5876 5875->5876 5877 33fc744-33fc746 5875->5877 5878 33fc75a-33fc760 5876->5878 5879 33fc748-33fc74d call 33fbf95 5877->5879 5880 33fc761-33fc766 5877->5880 5892 33fc753 call 3400efc 5879->5892 5882 33fc768-33fc772 5880->5882 5883 33fc774-33fc778 5880->5883 5882->5883 5885 33fc798-33fc7a7 5882->5885 5886 33fc77a-33fc785 call 33f9d20 5883->5886 5887 33fc788-33fc78a 5883->5887 5890 33fc7ae 5885->5890 5891 33fc7a9-33fc7ac 5885->5891 5886->5887 5887->5879 5889 33fc78c-33fc796 5887->5889 5889->5879 5889->5885 5894 33fc7b3-33fc7b8 5890->5894 5891->5894 5892->5876 5896 33fc7be-33fc7c5 5894->5896 5897 33fc8a1-33fc8a4 5894->5897 5898 33fc7c7-33fc7cf 5896->5898 5899 33fc806-33fc808 5896->5899 5897->5878 5898->5899 5902 33fc7d1 5898->5902 5900 33fc80a-33fc80c 5899->5900 5901 33fc872-33fc873 call 3403d6b 5899->5901 5903 33fc80e-33fc816 5900->5903 5904 33fc830-33fc83b 5900->5904 5911 33fc878-33fc87c 5901->5911 5906 33fc8cf 5902->5906 5907 33fc7d7-33fc7d9 5902->5907 5909 33fc818-33fc824 5903->5909 5910 33fc826-33fc82a 5903->5910 5912 33fc83f-33fc842 5904->5912 5913 33fc83d 5904->5913 5908 33fc8d3-33fc8dc 5906->5908 5914 33fc7db-33fc7dd 5907->5914 5915 33fc7e0-33fc7e5 5907->5915 5908->5878 5916 33fc82c-33fc82e 5909->5916 5910->5916 5911->5908 5917 33fc87e-33fc883 5911->5917 5918 33fc8a9-33fc8ad 5912->5918 5919 33fc844-33fc850 call 3403895 call 340401f 5912->5919 5913->5912 5914->5915 5915->5918 5920 33fc7eb-33fc804 call 3403e8c 5915->5920 5916->5912 5917->5918 5921 33fc885-33fc896 5917->5921 5922 33fc8bf-33fc8ca call 33fbf95 5918->5922 5923 33fc8af-33fc8bc call 33f9d20 5918->5923 5935 33fc855-33fc85a 5919->5935 5931 33fc867-33fc870 5920->5931 5927 33fc899-33fc89b 5921->5927 5922->5892 5923->5922 5927->5896 5927->5897 5931->5927 5936 33fc8e1-33fc8e5 5935->5936 5937 33fc860-33fc863 5935->5937 5936->5908 5937->5906 5938 33fc865 5937->5938 5938->5931
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
    • String ID:
    • API String ID: 3877424927-0
    • Opcode ID: 489aa8885060dc1f206dc58b40215f1e2c3fff13f482bd878ea38537d7812e47
    • Instruction ID: 1a9ff46059f52cfd907b43873a6301cab0887c8052a0a743a83baf37cab5357e
    • Opcode Fuzzy Hash: 489aa8885060dc1f206dc58b40215f1e2c3fff13f482bd878ea38537d7812e47
    • Instruction Fuzzy Hash: FF51C575A4030DEFDB24CF69CCC066EF7A5AF40321F98976DFA259A2D0D77099548B80
    Function 033E5B6B Relevance: 6.1, APIs: 4, Instructions: 100COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentH_prologPoint32TextWindow
    • String ID:
    • API String ID: 4235267150-0
    • Opcode ID: de51f07d78f1bc1c136ab6d3971637bcbb293becdbd358a8ff2715d8af51bdbe
    • Instruction ID: 3565f41af7129814fe745cd910ac5a79c89bfed9118ea017dfcff9f0e3429d7d
    • Opcode Fuzzy Hash: de51f07d78f1bc1c136ab6d3971637bcbb293becdbd358a8ff2715d8af51bdbe
    • Instruction Fuzzy Hash: 8331E3B5D09268AFEB00EFA4D9D0ABE7BA8EB06258F140159E8056F2C0C7359D448BA5
    Function 033F7B07 Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033F7B57
    • GetDesktopWindow.USER32 ref: 033F7B6B
    • SetWindowTextW.USER32(00000000), ref: 033F7B72
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000002,00000000), ref: 033F7B97
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: ec381c79863f8ff1a5fd144056163766d2bbdc93f01972540d1b422e1ad37440
    • Instruction ID: ff8be41fb5264c36a1b722136d12d707cd908e0017086368e5c8dafe25245793
    • Opcode Fuzzy Hash: ec381c79863f8ff1a5fd144056163766d2bbdc93f01972540d1b422e1ad37440
    • Instruction Fuzzy Hash: C6212AB4D4434CBFEB10DF98D8849ADFFB8AB06355F8485E9EA507A381C3710A85CB50
    Function 033E7843 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memcmp
    • String ID: h.I$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 2931989736-3166254412
    • Opcode ID: 7f515139bcfe7c43c98cded32006b589a8ae7c16d6792ad0efd9c54a3ca80e6a
    • Instruction ID: 1583cdbfc60219a3f410b68e3e7c12f1af336fac7454a8081bdbe3af94fea4a4
    • Opcode Fuzzy Hash: 7f515139bcfe7c43c98cded32006b589a8ae7c16d6792ad0efd9c54a3ca80e6a
    • Instruction Fuzzy Hash: B011E631A0431EBFDF14DE689C82DEE376AAB04701F504124FE14AB5D1E272E9618AD5
    Function 033C34A1 Relevance: 4.6, APIs: 3, Instructions: 82memoryCOMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AllocateH_prolog_memmove
    • String ID:
    • API String ID: 3429787499-0
    • Opcode ID: 658074708cdc4eae649a0db26b8cd169f83442387c90a9b62b2c73c3739ac409
    • Instruction ID: 206918a267a2b83f82e326e3c66466de0e2be37af952b7e1dd8dab418ad04948
    • Opcode Fuzzy Hash: 658074708cdc4eae649a0db26b8cd169f83442387c90a9b62b2c73c3739ac409
    • Instruction Fuzzy Hash: D621D379E20245ABD725DF2CD8C056EF7B9EB84630F14862EE8129B281D734EE4187A0
    Function 033F7DA6 Relevance: 4.6, APIs: 3, Instructions: 74COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033F7E31
    • GetDC.USER32(00000000), ref: 033F7E38
    • GetTextExtentPointW.GDI32(00000000), ref: 033F7E3F
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentPointTextWindow
    • String ID:
    • API String ID: 2168015606-0
    • Opcode ID: 34179ec1ab01fb46e51d9d213df793da518cb40689f1eb82420416c5fb911d28
    • Instruction ID: ce39d83299991c66ef59755a391b8dfe045c9147f4370baafcaf38e715cc244d
    • Opcode Fuzzy Hash: 34179ec1ab01fb46e51d9d213df793da518cb40689f1eb82420416c5fb911d28
    • Instruction Fuzzy Hash: 4E21F374D04208EFCB11EFA4C8D49EDFF78FF04359F90849AE6156A241C7340A91CB90
    Function 033F8A6D Relevance: 4.5, APIs: 3, Instructions: 29COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • _malloc.LIBCMT ref: 033F8A85
      • Part of subcall function 033FC44C: __FF_MSGBANNER.LIBCMT ref: 033FC463
      • Part of subcall function 033FC44C: __NMSG_WRITE.LIBCMT ref: 033FC46A
      • Part of subcall function 033FC44C: RtlAllocateHeap.NTDLL(03430000,00000000,00000001,00000001,033E18DB,033E18DB,?,033FBDB1,00000001,00000000,00000003,00000000,?,033FBCEB,033F887B,?), ref: 033FC48F
    • std::exception::exception.LIBCMT ref: 033F8AA3
    • __CxxThrowException@8.LIBCMT ref: 033F8AB8
      • Part of subcall function 033F9254: RaiseException.KERNEL32(?,?,033F8890,033E18DB,00000003,?,?,?,?,?,033F8890,033E18DB,03418A94,00000003), ref: 033F92A9
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
    • String ID:
    • API String ID: 3074076210-0
    • Opcode ID: 866a3580327a6915bcf6b4839e8ed3a1980805ba4b7644266ca020c0f6258279
    • Instruction ID: 62dc2c2bef74ad68759ce2de6da5fa5677bb8cce0e4d71efbd9f4fb9ebb619b9
    • Opcode Fuzzy Hash: 866a3580327a6915bcf6b4839e8ed3a1980805ba4b7644266ca020c0f6258279
    • Instruction Fuzzy Hash: 92E0657484070EBEDF04FA54CCC09EEB77CEB00240FD48666EE146E591DF31CA5495A1
    Function 033C3B27 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON
    Download Yara Rule
    Strings
    • xbftzkZErMGIHumMcosuOxQ, xrefs: 033C3BB0
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID: xbftzkZErMGIHumMcosuOxQ
    • API String ID: 0-1224003671
    • Opcode ID: 85fcaee7b6b2c7ebc8c4edf465d11f35044d0ed496444d616fdaf501723ba330
    • Instruction ID: 59e396a137140a44ef1d795aad777c76722c041baba8da8bfdf566b7bee8fb0e
    • Opcode Fuzzy Hash: 85fcaee7b6b2c7ebc8c4edf465d11f35044d0ed496444d616fdaf501723ba330
    • Instruction Fuzzy Hash: F2119139724394ABC624DE5D98C0D9BFBADEB45A74B00841EF9598B241C776EC0087E5
    Function 033C3749 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 033C37A6
      • Part of subcall function 033C34A1: __EH_prolog.LIBCMT ref: 033C34A6
      • Part of subcall function 033C34A1: _Allocate.LIBCPMT ref: 033C34FD
      • Part of subcall function 033C34A1: _memmove.LIBCMT ref: 033C3554
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AllocateH_prologXinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi
    • API String ID: 353893102-3097608044
    • Opcode ID: 22546fe32f267d688b738aafd157c33795ba5f82fc29e03a0732be2b4bc8fbe3
    • Instruction ID: a762c5db33fc761f688896ac6faaae0e80b79ee0ee4e4feee28ee0cfa282624f
    • Opcode Fuzzy Hash: 22546fe32f267d688b738aafd157c33795ba5f82fc29e03a0732be2b4bc8fbe3
    • Instruction Fuzzy Hash: 6AF04C7D9703A06FDB25E96C88C86A9B708DF01635F34899DF8619E0C2C329CD428FD2
    Function 033FC902 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: __lock_file_memset
    • String ID:
    • API String ID: 26237723-0
    • Opcode ID: 499949f707b210cb84359f25b9dc2fc6103906bd2d374ade3a88cd0ccfca7f6f
    • Instruction ID: 0a496cb7a195c351a1a0656c10fba2d82646350c902a071fcb48455ae0655780
    • Opcode Fuzzy Hash: 499949f707b210cb84359f25b9dc2fc6103906bd2d374ade3a88cd0ccfca7f6f
    • Instruction Fuzzy Hash: 22017175C4070DEFCF21EF6A8C4099FBB65AF80320F948215F6241E1A0D7718611DF91
    Function 033FC6AB Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
    Download Yara Rule
    APIs
      • Part of subcall function 033FBF95: __getptd_noexit.LIBCMT ref: 033FBF95
    • __lock_file.LIBCMT ref: 033FC6F0
      • Part of subcall function 03403959: __lock.LIBCMT ref: 0340397C
    • __fclose_nolock.LIBCMT ref: 033FC6FB
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
    • String ID:
    • API String ID: 2800547568-0
    • Opcode ID: c856f08cabe1bb5c045b07fdc8e2a0c60ef7c131cfbe08d7995d85845514d8ce
    • Instruction ID: c761f5f2f442b5442c43d42560aca6ae19343ad2f5e6f8c1218cd5aa86414a41
    • Opcode Fuzzy Hash: c856f08cabe1bb5c045b07fdc8e2a0c60ef7c131cfbe08d7995d85845514d8ce
    • Instruction Fuzzy Hash: DEF090B5D847099EDB20EF75888076E7B905F40330FA8A65A9664AF1D0CB7C45418F59
    Function 033FCE35 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
    Download Yara Rule
    APIs
    • __lock_file.LIBCMT ref: 033FCE69
    • __ftell_nolock.LIBCMT ref: 033FCE74
      • Part of subcall function 033FBF95: __getptd_noexit.LIBCMT ref: 033FBF95
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: __ftell_nolock__getptd_noexit__lock_file
    • String ID:
    • API String ID: 2999321469-0
    • Opcode ID: d2ccfe2dd14cd76604589b9b918d7cf94d1ed68e9096c409461ea98669cff323
    • Instruction ID: 0258bc37aa82fae8473d8913cc41ec8657a3da00e8765cbc123ff94754829cd8
    • Opcode Fuzzy Hash: d2ccfe2dd14cd76604589b9b918d7cf94d1ed68e9096c409461ea98669cff323
    • Instruction Fuzzy Hash: 21F0A079E507099EDB10FFB58C8176E76A06F40335FA04A1A9120AE1E0CF788A425B99
    Function 033E237A Relevance: 1.7, APIs: 1, Instructions: 176COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: 35514b894be742deec590353f36c4bd4c66099d808f2808611030d7e6ed5f43a
    • Instruction ID: 7f99de89c71045a7d36916e2dbdec8a403b7102cdecc5067c4e1dde6eee35e8d
    • Opcode Fuzzy Hash: 35514b894be742deec590353f36c4bd4c66099d808f2808611030d7e6ed5f43a
    • Instruction Fuzzy Hash: 06611571E4022ADBDF14DF98C9C19EEFBB9BB05701F24452AE615BA2C0D7705A81CF91
    Function 033D3E8F Relevance: 1.7, APIs: 1, Instructions: 152COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033D3E94
      • Part of subcall function 033F8A6D: _malloc.LIBCMT ref: 033F8A85
      • Part of subcall function 033D4630: __EH_prolog.LIBCMT ref: 033D4635
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog$_malloc
    • String ID:
    • API String ID: 4254904621-0
    • Opcode ID: 0025d878f199e9186de3cb5f16c0daf5ff8ffdcd13862ad185288323c1fa19da
    • Instruction ID: 5282277728837b4a138b01b443e58971cdd680506e1bdb28bc3b4d6f9cd50f07
    • Opcode Fuzzy Hash: 0025d878f199e9186de3cb5f16c0daf5ff8ffdcd13862ad185288323c1fa19da
    • Instruction Fuzzy Hash: 6A51B17AE04249AFDB15DF28E8C076EF7E9AF44320F084669E415DF280DB749D408792
    Function 033F77D0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033F77D5
      • Part of subcall function 033D24D8: __EH_prolog.LIBCMT ref: 033D24DD
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: b181fa8273060b715d52741f86849bd63027ece770199a588f02b86e557053e4
    • Instruction ID: 63813843c3edcab93ad3554042dd73257c0ca5a6013ae8573ea8a6efef869c27
    • Opcode Fuzzy Hash: b181fa8273060b715d52741f86849bd63027ece770199a588f02b86e557053e4
    • Instruction Fuzzy Hash: D421C075E00309AFCB04EFA898C19BEBBA9AF09210F44456EE915AF340CB706A40C760
    Function 033F7BE3 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: 09ff5b91e8a273edaba9c6f12dc66844ebd197024ca35d857f3d5f8c035f3810
    • Instruction ID: 7a02f02e78e4f3b7af0b59ec960bb27e6826224d45d0758f3ed69fb2eb2c40a0
    • Opcode Fuzzy Hash: 09ff5b91e8a273edaba9c6f12dc66844ebd197024ca35d857f3d5f8c035f3810
    • Instruction Fuzzy Hash: A621D53AD01208EFCF18EBE8D9D4AEDBBB4AF55340F644199D905AB280DB315F09C660
    Function 033D4630 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: 1916cf1d358c6f4c824e84719af36950058dd0b4fdbf36924bbf3bb01ef6757a
    • Instruction ID: ea742901c6971d440ca868f3435bcc00db760a939668f0b4b5e983ee70b2b3f6
    • Opcode Fuzzy Hash: 1916cf1d358c6f4c824e84719af36950058dd0b4fdbf36924bbf3bb01ef6757a
    • Instruction Fuzzy Hash: 7D115E79D00349DEDB10DFA4D8C1BEDBBB0EF04324F18452AE916AA2C1DB759544CB95
    Function 033E3F6E Relevance: 1.5, APIs: 1, Instructions: 45COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033E3F73
      • Part of subcall function 033E5B6B: __EH_prolog.LIBCMT ref: 033E5B70
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: 510af84323efef3716c9d5ac451134bffa783c9b6c8064ccedd3a88a798b2a7c
    • Instruction ID: 5a3eff4d02e36cc41c30a63fcd0492b90c4985e50ce3bef18c2b0bcbc684e04e
    • Opcode Fuzzy Hash: 510af84323efef3716c9d5ac451134bffa783c9b6c8064ccedd3a88a798b2a7c
    • Instruction Fuzzy Hash: 11017C35D0121CBACB20EA95C888FDFBF7CEB49A64F004056F508AA281CB708604C7F1
    Function 033EB587 Relevance: 1.5, APIs: 1, Instructions: 41windowCOMMON
    Download Yara Rule
    APIs
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,?,033EB55F,00000002,00000001,00000B83,00005234,00000001,000069A2,00005100), ref: 033EB5CB
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: FormatMessage
    • String ID:
    • API String ID: 1306739567-0
    • Opcode ID: 21fb7cc55f5240f5c1f7a1ee84f6c50729cb9b845d95d1399434ccb8d02b4c5b
    • Instruction ID: 073cde2740a0ed7743b26fd013bb9f580798caa16a185f5cdd0319e648ebe55e
    • Opcode Fuzzy Hash: 21fb7cc55f5240f5c1f7a1ee84f6c50729cb9b845d95d1399434ccb8d02b4c5b
    • Instruction Fuzzy Hash: DDF0C271248248AFFF02DF64ED86BFA7BA89B41708F080084F90D9E1D2C67598A1C760
    Function 033DDA35 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: 3a2db44ef9ef1fd353790f469fd5909d0038a25b21f853cb3383b1d346fb3169
    • Instruction ID: b32b4580269d3fc229ae5dee10a781d6920e968f937abf0e3398906dea23ed5b
    • Opcode Fuzzy Hash: 3a2db44ef9ef1fd353790f469fd5909d0038a25b21f853cb3383b1d346fb3169
    • Instruction Fuzzy Hash: D7E08C76E046589FC718EF98E4803ADB7A4EF04200F00469EA4895F340EBB40E018B85

    Non-executed Functions

    Function 03401875 Relevance: 30.5, APIs: 15, Strings: 2, Instructions: 773COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _write_multi_char_write_string$__cftof$__aulldvrm_free
    • String ID: $g
    • API String ID: 4283718489-3845294767
    • Opcode ID: c7a0b276f864477969a1c3bcaec8a9f50c80ee83691e420dd965081e8ba37ea8
    • Instruction ID: 1be3d7dc27a4942ba1f3654ae8b9ad636a2f06e16448b7083d031047cbaf0363
    • Opcode Fuzzy Hash: c7a0b276f864477969a1c3bcaec8a9f50c80ee83691e420dd965081e8ba37ea8
    • Instruction Fuzzy Hash: 64528F75B046288BEB25CA18CC447AAB7F5BB40314F1885FBD599AF2D0DB719E81CF84
    Function 033DBB9C Relevance: 6.3, APIs: 1, Strings: 2, Instructions: 1072COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memmove
    • String ID: inity$j
    • API String ID: 4104443479-3329007786
    • Opcode ID: 2ba151d3c4228a14a204f6a94b0420ac04a1a4b44400a49c2d4cd48b60e15c97
    • Instruction ID: 33bf7a3b4aef712cc566789c495cf449f9ecec0e8f7963499907f7f75232509a
    • Opcode Fuzzy Hash: 2ba151d3c4228a14a204f6a94b0420ac04a1a4b44400a49c2d4cd48b60e15c97
    • Instruction Fuzzy Hash: 9192C172D106099BDF19CFA9E9D06ADFBB9FF45350F28926AE415FB250E7308981CB40
    Function 033DA82A Relevance: 6.2, APIs: 1, Strings: 2, Instructions: 922COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memmove
    • String ID: Infinity$NaN
    • API String ID: 4104443479-4285296124
    • Opcode ID: 14a281c616c90a4a5d746a998c58890f390b263017819a6af4f8fa72cd275a16
    • Instruction ID: fd4343a82fb5142db9e19d04827662911662e75f9a1f2d3eeeee4361cc23f092
    • Opcode Fuzzy Hash: 14a281c616c90a4a5d746a998c58890f390b263017819a6af4f8fa72cd275a16
    • Instruction Fuzzy Hash: 8272C273D106099FDF16DFB8E9907ADF7B9EF05350F15826AE812BB240E77499428B40
    Function 033F4213 Relevance: 4.6, APIs: 3, Instructions: 139COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memset
    • String ID:
    • API String ID: 2102423945-0
    • Opcode ID: 39854f4c7c8c96835557c93b2be0a52577e2c1d1d299cb158765d7c2349f738a
    • Instruction ID: a9bdf156fe8750205ecadd8db4149b7a5088fc3aa9c1d6eaf2a3e9b29ef40bcf
    • Opcode Fuzzy Hash: 39854f4c7c8c96835557c93b2be0a52577e2c1d1d299cb158765d7c2349f738a
    • Instruction Fuzzy Hash: D841F2766192C19FCB06CF6D8CC099ABF689F6A11079D83D6EE98CF347C120D545C7A1
    Function 033F2F72 Relevance: 4.6, APIs: 3, Instructions: 130COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memset
    • String ID:
    • API String ID: 2102423945-0
    • Opcode ID: e1cf7a4849ae17f2b3e71ceecc07b82d9542eb943d80f1f72b30f71d3d9f1040
    • Instruction ID: b5625c0b15e988fb0fd8b50ac66c3e5b2adb0e6efbb91c4e1b703636418421a4
    • Opcode Fuzzy Hash: e1cf7a4849ae17f2b3e71ceecc07b82d9542eb943d80f1f72b30f71d3d9f1040
    • Instruction Fuzzy Hash: D7416326219BC6AFC31ACE6C4C4069AFF746F36104B488A5DD9D5A7B43C210F669C7F1
    Function 033E19F3 Relevance: 3.2, Strings: 2, Instructions: 678COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$AllocateErrorLast
    • String ID: hwA$r
    • API String ID: 3596851790-2805155317
    • Opcode ID: 80dabcf5b99dec776cc5eb69493c654803dee8e5d5bd31f621508530ffa7a732
    • Instruction ID: a1a0e19bc2278241e8ea34f35ba9905d31b93273f12dcd47b1255aa1692068e6
    • Opcode Fuzzy Hash: 80dabcf5b99dec776cc5eb69493c654803dee8e5d5bd31f621508530ffa7a732
    • Instruction Fuzzy Hash: CF524AB5D00269DFDB14DFA8CC85AEEBBB8FB08314F1445AAE519BB281D7705A84CF50
    Function 03405C54 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • SetUnhandledExceptionFilter.KERNEL32(00000000,033E18DB,03400E9D,033E15B3,?,?,00000001), ref: 03405C59
    • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 03405C62
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: ExceptionFilterUnhandled
    • String ID:
    • API String ID: 3192549508-0
    • Opcode ID: c9851a18540c480e5fe1dc15fb634378450868fdd10de81e8de92b17d8d6be36
    • Instruction ID: c44d7fe2ad00cd60a8644fc9bc9b4fbc1d17725c958261db49b1edf0639b8252
    • Opcode Fuzzy Hash: c9851a18540c480e5fe1dc15fb634378450868fdd10de81e8de92b17d8d6be36
    • Instruction Fuzzy Hash: 7AB09235244618ABCB003B91EA0DB48BFA8EB1865AF000810F60D5C0548BB254A08A92
    Function 054D11A4 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • SetUnhandledExceptionFilter.KERNEL32(00000000,?,054DBB0A,053B768C,00000001,?,054DBC21,053B768C,00000017), ref: 054D11A9
    • UnhandledExceptionFilter.KERNEL32(053B768C,?,054DBB0A,053B768C,00000001,?,054DBC21,053B768C,00000017), ref: 054D11B2
    Memory Dump Source
    • Source File: 00000003.00000002.2225059714.00000000053B1000.00000020.00001000.00020000.00000000.sdmp, Offset: 053B0000, based on PE: true
    • Associated: 00000003.00000002.2225041734.00000000053B0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2225178708.000000000550A000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2225480615.000000000597D000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2225501466.000000000597F000.00000040.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_53b0000_rundll32.jbxd
    Similarity
    • API ID: ExceptionFilterUnhandled
    • String ID:
    • API String ID: 3192549508-0
    • Opcode ID: e36165df1545106837280dbbdd89df05eec4e20ed3138039d6b4e4555c9e5fb8
    • Instruction ID: 57fbf628a0963b195cb6ef66c1c39cf7813987eac6506c36f3b9274857eb3c4e
    • Opcode Fuzzy Hash: e36165df1545106837280dbbdd89df05eec4e20ed3138039d6b4e4555c9e5fb8
    • Instruction Fuzzy Hash: B7B0923105830CABCA002BD1E80AF98BF28EF84662F000092F60E440608FA29452CA91
    Function 033F32C0 Relevance: 2.7, Strings: 1, Instructions: 1481COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID: 0-3916222277
    • Opcode ID: a4470279a48336228fde924ff18bbe219d090bf31e434a1a5ace179a9b4b31ac
    • Instruction ID: 0068f641ad24e6523834bead43631900c29ffdd5f83ccf41204ce8b9d3403a1c
    • Opcode Fuzzy Hash: a4470279a48336228fde924ff18bbe219d090bf31e434a1a5ace179a9b4b31ac
    • Instruction Fuzzy Hash: 2EC28472F002288BDF58CFADD8916EDB7F2EB88314B19816DE816E7341D639DD418B94
    Function 03403440 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetProcessHeap.KERNEL32(033FD4CC,03418CE0,00000008,033FD6A2,?,00000001,?,03418D00,0000000C,033FD641,?,00000001,?), ref: 03403440
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: HeapProcess
    • String ID:
    • API String ID: 54951025-0
    • Opcode ID: a82249d5f4d5190140d432a435af39593e152578eaae9cd37679deb18eb9f090
    • Instruction ID: 75af8b502fd2ecd4d3b4139d204baf5fb053a707cacbf0f212e5d451b0ac614c
    • Opcode Fuzzy Hash: a82249d5f4d5190140d432a435af39593e152578eaae9cd37679deb18eb9f090
    • Instruction Fuzzy Hash: AFB012F07019124747081B38761411935E47709201300043D7003D9184FF70C460AB01
    Function 033FB1F2 Relevance: .3, Instructions: 345COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
    • Instruction ID: cbbb0a3d82b6f037d8815dcb85de1ebee62ee7d15e603aafb6672caa11073ec3
    • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
    • Instruction Fuzzy Hash: F7C183722051534EDF2DCA39C8B407EFAE55E916B235E07ADE5B7CB2D5EF10C1648A10
    Function 033FB627 Relevance: .3, Instructions: 341COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
    • Instruction ID: 50c0b3a27dcd46ed64b76c5969fa7a06d2ab6725692e2b3e25da740338e6c57d
    • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
    • Instruction Fuzzy Hash: D5C182722051934DDF2D8639C8B407EFAE55E926B235E07ADE5B7CB2D5EF20C124CA20
    Function 033FADBD Relevance: .3, Instructions: 331COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
    • Instruction ID: 6ef34da51362a98958aacac7a4e1617505171af3e9ad63d29dbf0eafce59005b
    • Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
    • Instruction Fuzzy Hash: 9CC172722091930EDF2DC639C8B407EFAE55E916B235E07ADE5B7CB2D5EF10C1249A20
    Function 033FA9A5 Relevance: .3, Instructions: 323COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
    • Instruction ID: d1db977e587ff478e0aa80491c5051fb50e0c4eb1624684235303c8e50a0fee3
    • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
    • Instruction Fuzzy Hash: E8C172322050930EDF1DC63988B407EFAE55E916B234E17ADE5BBCB2D5EF20C1649E20
    Function 033DD4CD Relevance: .1, Instructions: 88COMMONLIBRARYCODE
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: e4276d584c1f5c006257fe31dd3ef6eb184690ec9de3ac06d1b8c782a16b778f
    • Instruction ID: b8916a7e0e9e3412c4a465f030ad446c7ef7f55e2985e0b6aaef00598bc7cf15
    • Opcode Fuzzy Hash: e4276d584c1f5c006257fe31dd3ef6eb184690ec9de3ac06d1b8c782a16b778f
    • Instruction Fuzzy Hash: 62216053B158290BB788D53D9C8073A72D7DBDC68534DC231E959CB389EA30D923D291
    Function 033FA2E0 Relevance: .1, Instructions: 76COMMON
    Download Yara Rule
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID:
    • API String ID:
    • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
    • Instruction ID: 11f4478d1dcbb3894b800ca402d031cab3076310025c2679cef0faaefc680590
    • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
    • Instruction Fuzzy Hash: A5112BB72081814FD704CA2DDCF45BAE399EBC52217EC837BDB8A4B758D222E1459D00
    Function 033DC8F0 Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 319windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033DC989
    • GetDC.USER32(00000000), ref: 033DC98C
    • GetTextExtentPointW.GDI32(00000000,?,00000000), ref: 033DC98F
    • GetSysColorBrush.USER32(0000196A), ref: 033DC9F7
    • GetDesktopWindow.USER32 ref: 033DCA0E
    • SetWindowTextW.USER32(00000000), ref: 033DCA11
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,?,?,00000000), ref: 033DCA39
    • GetDesktopWindow.USER32 ref: 033DCA98
    • SetDlgItemInt.USER32(00000000,?,00000000), ref: 033DCA9B
    • GetDesktopWindow.USER32 ref: 033DCABE
    • GetDC.USER32(00000000), ref: 033DCAC1
    • SetViewportExtEx.GDI32(00000000,?,00000000), ref: 033DCAC4
    • _memset.LIBCMT ref: 033DCB4D
    • _memset.LIBCMT ref: 033DCBA1
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text_memset$BrushColorExtentFormatItemMessagePointViewport
    • String ID: jt$jt
    • API String ID: 967997722-2819724509
    • Opcode ID: ae8c183187b41c1640bda7e0478b2d7313f8773c2a359461aa0f1f2b232bc9ef
    • Instruction ID: 790642a2a4f39d7f5c6f17248400e405dbd02cfa0c4b6d4525ce02f7d1101cf1
    • Opcode Fuzzy Hash: ae8c183187b41c1640bda7e0478b2d7313f8773c2a359461aa0f1f2b232bc9ef
    • Instruction Fuzzy Hash: 06C1D1B1D5834AAADB15CFA8E8C47EDFFB9FF85304F189199D4416B281C3704686CB90
    Function 033C8D0E Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 284libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetProcAddress.KERNEL32(?,?), ref: 033C90FE
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AddressProc
    • String ID: "$%$'$($.$4$;$A$B$T$V$W$^
    • API String ID: 190572456-504311776
    • Opcode ID: f80374c12d7376f2b64a057fec01b6efc6f7fed6e3ed162e6ec0ffd9e89f9857
    • Instruction ID: a4637b4e4f946aff0518c0ef4321160d7accfb15fb1588520befa649a7b19643
    • Opcode Fuzzy Hash: f80374c12d7376f2b64a057fec01b6efc6f7fed6e3ed162e6ec0ffd9e89f9857
    • Instruction Fuzzy Hash: 03E17B309182DDCEDF15CBB8D9987EDBFB0AF06305F1441ADD495AB282D3790A44CB21
    Function 033DFAE6 Relevance: 19.7, APIs: 13, Instructions: 185windowCOMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033DFAEB
    • GetDesktopWindow.USER32 ref: 033DFB7F
    • GetDC.USER32(00000000), ref: 033DFB82
    • GetTextExtentPointW.GDI32(00000000), ref: 033DFB89
    • GetSysColorBrush.USER32(0000196A), ref: 033DFC04
    • GetDesktopWindow.USER32 ref: 033DFC1B
    • SetWindowTextW.USER32(00000000), ref: 033DFC1E
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,?,00000002), ref: 033DFC46
    • GetDesktopWindow.USER32 ref: 033DFCC8
    • SetDlgItemInt.USER32(00000000), ref: 033DFCCB
    • GetDesktopWindow.USER32 ref: 033DFCEE
    • GetDC.USER32(00000000), ref: 033DFCF1
    • SetViewportExtEx.GDI32(00000000), ref: 033DFCF8
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatH_prologItemMessagePointViewport
    • String ID:
    • API String ID: 3397956014-0
    • Opcode ID: a564e5540167363e4b52042aabe720df89fc27d976cefcac8c670ed3e1de28ff
    • Instruction ID: a2aa12201c6dc544272c1f782c4ddc17469c74273332eb3308191cd50519f9ee
    • Opcode Fuzzy Hash: a564e5540167363e4b52042aabe720df89fc27d976cefcac8c670ed3e1de28ff
    • Instruction Fuzzy Hash: 07716EB5D0425AEFDF14EFA8E9896BEFBB8EF48305F144459D506BB280D7344680CBA1
    Function 033D41D7 Relevance: 19.7, APIs: 13, Instructions: 179windowCOMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033D41DC
    • GetDesktopWindow.USER32 ref: 033D4270
    • GetDC.USER32(00000000), ref: 033D4273
    • GetTextExtentPointW.GDI32(00000000), ref: 033D427A
    • GetSysColorBrush.USER32(0000196A), ref: 033D4303
    • GetDesktopWindow.USER32 ref: 033D431A
    • SetWindowTextW.USER32(00000000), ref: 033D431D
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 033D4345
    • GetDesktopWindow.USER32 ref: 033D43AE
    • SetDlgItemInt.USER32(00000000), ref: 033D43B1
    • GetDesktopWindow.USER32 ref: 033D43D3
    • GetDC.USER32(00000000), ref: 033D43D6
    • SetViewportExtEx.GDI32(00000000), ref: 033D43DD
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatH_prologItemMessagePointViewport
    • String ID:
    • API String ID: 3397956014-0
    • Opcode ID: 70e1b83a219ee7389b8267a30b6bb3db730c28a59c5a219be959011184641f86
    • Instruction ID: f8dd4534f20fa928403a49193806df760d9b643439ba27f469c28ab923adab9b
    • Opcode Fuzzy Hash: 70e1b83a219ee7389b8267a30b6bb3db730c28a59c5a219be959011184641f86
    • Instruction Fuzzy Hash: E171AF75D00249EFDB14DFA9E9885EEBBB5FF48311F24855AE8157B280CB304B80CBA1
    Function 033E1281 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 370COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memmove$Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 1771113911-141594409
    • Opcode ID: eda37bda52846bda73902b69640fc7329a2b3c8f640bb127c34699ef462d85dc
    • Instruction ID: 69df6cb07e8a0a9ca6ecdb119c7aaefe8dbe4a593516a718544a6382016b10c7
    • Opcode Fuzzy Hash: eda37bda52846bda73902b69640fc7329a2b3c8f640bb127c34699ef462d85dc
    • Instruction Fuzzy Hash: 3DD12875F00729DFCB20CF58D9C199AB7F9BF48740B14492AE9568B780D730EA91CBA1
    Function 033D53DF Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 154windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033D5434
    • GetDesktopWindow.USER32 ref: 033D5448
    • SetWindowTextW.USER32(00000000), ref: 033D544B
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,null,00000000,00000000), ref: 033D5470
    • GetDesktopWindow.USER32 ref: 033D54DD
    • SetDlgItemInt.USER32(00000000), ref: 033D54E0
    • GetDesktopWindow.USER32 ref: 033D5502
    • GetDC.USER32(00000000), ref: 033D5505
    • SetViewportExtEx.GDI32(00000000), ref: 033D550C
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport
    • String ID: \u%04X$null
    • API String ID: 654738355-3369567502
    • Opcode ID: be81b57ad9411885a58121872e738ea3ce07ea2a0fcba25992406924ad5f0460
    • Instruction ID: 87ddff1468ef3ee2fc3c23062fc08173ed956c18eccc5f8f2e466e52926516fb
    • Opcode Fuzzy Hash: be81b57ad9411885a58121872e738ea3ce07ea2a0fcba25992406924ad5f0460
    • Instruction Fuzzy Hash: D651BEB6D44348BFEF11DFA9E8849AEBFB9BF02315F188499E4527B281C7314684CB51
    Function 033D55A1 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 154windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033D55F6
    • GetDesktopWindow.USER32 ref: 033D560A
    • SetWindowTextW.USER32(00000000), ref: 033D560D
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,null,00000000,00000000), ref: 033D5632
    • GetDesktopWindow.USER32 ref: 033D569F
    • SetDlgItemInt.USER32(00000000), ref: 033D56A2
    • GetDesktopWindow.USER32 ref: 033D56C4
    • GetDC.USER32(00000000), ref: 033D56C7
    • SetViewportExtEx.GDI32(00000000), ref: 033D56CE
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport
    • String ID: \u%04X$null
    • API String ID: 654738355-3369567502
    • Opcode ID: 08e839e4ce981c478dc5d07b9f5eb78870e5295d875ac483430f71c050d7d721
    • Instruction ID: 455ffb9652967e5790f2ee4d24864467ff3757b2552a33e3f439a8d782eeb1ca
    • Opcode Fuzzy Hash: 08e839e4ce981c478dc5d07b9f5eb78870e5295d875ac483430f71c050d7d721
    • Instruction Fuzzy Hash: 0B51ACB6E85349FBEF10DFA8E8C49ADBFB8AF06314F188499E4517B281C7314684CB50
    Function 033E0120 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 143memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memmove$_memset$AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 2080731275-3797114014
    • Opcode ID: d5eba139731be5ad23f3a26c3a166d82336c1f541ee6bfe7a79ea62bfe1a8a64
    • Instruction ID: 8dd8d669e3f757a9bae54da49fd86a2caa5e0169936a1c546e5a393a9b20ae38
    • Opcode Fuzzy Hash: d5eba139731be5ad23f3a26c3a166d82336c1f541ee6bfe7a79ea62bfe1a8a64
    • Instruction Fuzzy Hash: D84121B590121AAFCB08DF6DCDC49AEBBA9FF49210B148529F919DB640D770ED20CB94
    Function 033D92F3 Relevance: 18.2, APIs: 12, Instructions: 187windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033D9385
    • GetDC.USER32(00000000), ref: 033D9388
    • GetTextExtentPointW.GDI32(00000000), ref: 033D938F
    • GetDesktopWindow.USER32 ref: 033D93E8
    • SetDlgItemInt.USER32(00000000), ref: 033D93EB
    • GetDesktopWindow.USER32 ref: 033D940E
    • GetDC.USER32(00000000), ref: 033D9411
    • SetViewportExtEx.GDI32(00000000), ref: 033D9418
    • GetSysColorBrush.USER32(0000196A), ref: 033D94B0
    • GetDesktopWindow.USER32 ref: 033D94C7
    • SetWindowTextW.USER32(00000000), ref: 033D94CA
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,Function_00010C5B,00000000), ref: 033D94F2
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatItemMessagePointViewport
    • String ID:
    • API String ID: 1998102902-0
    • Opcode ID: ec944a3025d0835daea70d01fe836f4a904ae64adb17c55530918b1ccb464804
    • Instruction ID: fe33d6a3ce4ebf78e5b9d142c64d1f6c65ee0a3fa6e1cdd7e45a0ce9612ddc3a
    • Opcode Fuzzy Hash: ec944a3025d0835daea70d01fe836f4a904ae64adb17c55530918b1ccb464804
    • Instruction Fuzzy Hash: D77159B1D04248FADB11DFA4E888BEEBBB8EF44315F14C4A9E855AA281D3348684CF50
    Function 033D9536 Relevance: 18.2, APIs: 12, Instructions: 187windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033D95C8
    • GetDC.USER32(00000000), ref: 033D95CB
    • GetTextExtentPointW.GDI32(00000000), ref: 033D95D2
    • GetDesktopWindow.USER32 ref: 033D962B
    • SetDlgItemInt.USER32(00000000), ref: 033D962E
    • GetDesktopWindow.USER32 ref: 033D9651
    • GetDC.USER32(00000000), ref: 033D9654
    • SetViewportExtEx.GDI32(00000000), ref: 033D965B
    • GetSysColorBrush.USER32(0000196A), ref: 033D96F3
    • GetDesktopWindow.USER32 ref: 033D970A
    • SetWindowTextW.USER32(00000000), ref: 033D970D
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,Function_00010C5B,00000000,?,00000000,00003CD6), ref: 033D9735
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatItemMessagePointViewport
    • String ID:
    • API String ID: 1998102902-0
    • Opcode ID: 60f0cac0832e6c2e733e02b41425b0a85e1552e182b8e182039e9f5aee7f0823
    • Instruction ID: f0f6c1dada26496a194e8ff80cc38dd44f73bcd94547699d83d79308ba0ce8d6
    • Opcode Fuzzy Hash: 60f0cac0832e6c2e733e02b41425b0a85e1552e182b8e182039e9f5aee7f0823
    • Instruction Fuzzy Hash: 7B714871D04248FEDB11DFA4E888BEEBFB9EF45315F1484A9E855AA281D7358680CF50
    Function 033E68CB Relevance: 18.2, APIs: 12, Instructions: 173windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033E695D
    • GetDC.USER32(00000000), ref: 033E6960
    • GetTextExtentPointW.GDI32(00000000), ref: 033E6967
    • GetSysColorBrush.USER32(0000196A), ref: 033E69DF
    • GetDesktopWindow.USER32 ref: 033E69F3
    • SetWindowTextW.USER32(00000000), ref: 033E69F6
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,FFFFFFFE,?,00000000,00003B8A,?,00000001), ref: 033E6A1B
    • GetDesktopWindow.USER32 ref: 033E6A77
    • SetDlgItemInt.USER32(00000000), ref: 033E6A7A
    • GetDesktopWindow.USER32 ref: 033E6A9C
    • GetDC.USER32(00000000), ref: 033E6A9F
    • SetViewportExtEx.GDI32(00000000), ref: 033E6AA6
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatItemMessagePointViewport
    • String ID:
    • API String ID: 1998102902-0
    • Opcode ID: 607aad59366488f6ae55aa378cebf7811b8a2c1c783d98e534b56646a1d6ec33
    • Instruction ID: a8276f9ff34b77e378a9decf6f20b90c8cfa02858c9d13412e1f0871dd9d9b0b
    • Opcode Fuzzy Hash: 607aad59366488f6ae55aa378cebf7811b8a2c1c783d98e534b56646a1d6ec33
    • Instruction Fuzzy Hash: 356155B4E843A8EFDF10DFA4C8969AEFFB8EB15305F148499E5617B281C2354A85CF50
    Function 033FE92E Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • DecodePointer.KERNEL32(?,00000001,033FD56B,03418CE0,00000008,033FD6A2,?,00000001,?,03418D00,0000000C,033FD641,?,00000001,?), ref: 033FE936
    • _free.LIBCMT ref: 033FE94F
      • Part of subcall function 033FC414: RtlFreeHeap.NTDLL(00000000,00000000,?,033FFB6E,00000000,00000001,00000000,00000003,00000000,?,033FBCEB,033F887B,?), ref: 033FC428
      • Part of subcall function 033FC414: GetLastError.KERNEL32(00000000,?,033FFB6E,00000000,00000001,00000000,00000003,00000000,?,033FBCEB,033F887B,?), ref: 033FC43A
    • _free.LIBCMT ref: 033FE962
    • _free.LIBCMT ref: 033FE980
    • _free.LIBCMT ref: 033FE992
    • _free.LIBCMT ref: 033FE9A3
    • _free.LIBCMT ref: 033FE9AE
    • _free.LIBCMT ref: 033FE9D2
    • EncodePointer.KERNEL32(034748D0), ref: 033FE9D9
    • _free.LIBCMT ref: 033FE9EE
    • _free.LIBCMT ref: 033FEA04
    • _free.LIBCMT ref: 033FEA2C
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
    • String ID:
    • API String ID: 3064303923-0
    • Opcode ID: 4ff7ea172fda66c1d76fc2e0c7894bdcb3dd603b960cd51a2da7347e53e8903c
    • Instruction ID: 36c9c2d30347b281d9346f7d95fb3842de7033efb8dbdb1be86eb895c923db7a
    • Opcode Fuzzy Hash: 4ff7ea172fda66c1d76fc2e0c7894bdcb3dd603b960cd51a2da7347e53e8903c
    • Instruction Fuzzy Hash: 5D21A57AD01A618FD622FF25E9C052677E4FB05760388593ADA857F258DB3848C1CBA0
    Function 033EC20F Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 429COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033EC214
    • QueryDosDeviceW.KERNEL32(00000000,00000000,00000752,00000000), ref: 033EC239
    • char_traits.LIBCPMT ref: 033EC338
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DeviceH_prologQuerychar_traits
    • String ID: \$\..\
    • API String ID: 1264856077-605892584
    • Opcode ID: 5e6b0a548c63ed009dda9de61a92acecf49d6bc5ccb883da57d9e15eb7accc52
    • Instruction ID: c170466a5b74e8916b403575948e4f25dbc6a4c120245c7dd9c84762e3ffb222
    • Opcode Fuzzy Hash: 5e6b0a548c63ed009dda9de61a92acecf49d6bc5ccb883da57d9e15eb7accc52
    • Instruction Fuzzy Hash: 91F14AB5E04229AFDF14DFA8C8C5AEEBBB9EB08304F145069E515BA2C1D7745E80CF61
    Function 033F48CB Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033F491F
    • GetDesktopWindow.USER32 ref: 033F4933
    • SetWindowTextW.USER32(00000000), ref: 033F4936
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 033F495B
    • GetDesktopWindow.USER32 ref: 033F49DB
    • SetDlgItemInt.USER32(00000000), ref: 033F49DE
    • GetDesktopWindow.USER32 ref: 033F4A08
    • GetDC.USER32(00000000), ref: 033F4A0B
    • SetViewportExtEx.GDI32(00000000), ref: 033F4A12
    • _abort.LIBCMT ref: 033F4A18
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport_abort
    • String ID:
    • API String ID: 50134168-0
    • Opcode ID: b6be79c296d25467a7d27852670a75a97c1b56ed13afeac7497ceb2a70bd0e40
    • Instruction ID: 27f4c29045509327dda4162e91ff4b3c37f85310e7802096b5552d4d4b83f2c0
    • Opcode Fuzzy Hash: b6be79c296d25467a7d27852670a75a97c1b56ed13afeac7497ceb2a70bd0e40
    • Instruction Fuzzy Hash: E0416DB4E88388BEDF10DFE9D88999EBF78AB01315F448599E6517A281D2354684CF50
    Function 033D5173 Relevance: 13.6, APIs: 9, Instructions: 125windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033D51E8
    • GetDesktopWindow.USER32 ref: 033D51FC
    • SetWindowTextW.USER32(00000000), ref: 033D51FF
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000400,?,00000000,75A89CE0,00000000), ref: 033D5224
    • GetDesktopWindow.USER32 ref: 033D528C
    • SetDlgItemInt.USER32(00000000,?,00000000,75A89CE0), ref: 033D528F
    • GetDesktopWindow.USER32 ref: 033D52B1
    • GetDC.USER32(00000000), ref: 033D52B4
    • SetViewportExtEx.GDI32(00000000,?,00000000,75A89CE0), ref: 033D52BB
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport
    • String ID:
    • API String ID: 654738355-0
    • Opcode ID: 80e458f3643f25050b72bbeaba1e7d642b237cc27d35a7ee843ae5ab012f7a47
    • Instruction ID: d7dc16a4c4c112876849b02ce58942f4f09fad743c2ac1d72d7a2c709e4e9d83
    • Opcode Fuzzy Hash: 80e458f3643f25050b72bbeaba1e7d642b237cc27d35a7ee843ae5ab012f7a47
    • Instruction Fuzzy Hash: 0841A0B5941389EFEF10DF98ED889AEBBB8EF02305F044459F8116F281C7708A58DB90
    Function 033D4ADE Relevance: 13.6, APIs: 9, Instructions: 119windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033D4B4A
    • GetDesktopWindow.USER32 ref: 033D4B61
    • SetWindowTextW.USER32(00000000), ref: 033D4B64
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,?,00000000,00000002), ref: 033D4B8C
    • GetDesktopWindow.USER32 ref: 033D4BF6
    • SetDlgItemInt.USER32(00000000,?,00000000,00000002), ref: 033D4BF9
    • GetDesktopWindow.USER32 ref: 033D4C1C
    • GetDC.USER32(00000000), ref: 033D4C1F
    • SetViewportExtEx.GDI32(00000000,?,00000000,00000002), ref: 033D4C26
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport
    • String ID:
    • API String ID: 654738355-0
    • Opcode ID: 1ea390054a0f76c8673074b5734a42b1861182603e7cfcf0bf05bc3a72da47ed
    • Instruction ID: 02e2f9771195d72f99404f7e1ff07a7fcfda7d8a0d853bea04621083cb2005d9
    • Opcode Fuzzy Hash: 1ea390054a0f76c8673074b5734a42b1861182603e7cfcf0bf05bc3a72da47ed
    • Instruction Fuzzy Hash: 0441ADB1D04348FEEB14DFAAE888BADFFB8AF94305F08C599E4546A181CA754685CB10
    Function 033C13C5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89memoryCOMMON
    Download Yara Rule
    APIs
    • _Allocate.LIBCPMT ref: 033C1417
      • Part of subcall function 033DD594: std::exception::exception.LIBCMT ref: 033F8848
      • Part of subcall function 033DD594: __CxxThrowException@8.LIBCMT ref: 033F885D
    • _Ucopy.LIBCPMT ref: 033C1436
    • _Ucopy.LIBCPMT ref: 033C1444
    • _Ucopy.LIBCPMT ref: 033C1428
      • Part of subcall function 033C1575: _memmove.LIBCMT ref: 033C1589
    • _Ucopy.LIBCPMT ref: 033C147D
    • std::_Xinvalid_argument.LIBCPMT ref: 033C14A8
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$AllocateException@8ThrowXinvalid_argument_memmovestd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 1826209128-3797114014
    • Opcode ID: e28e8759e1d3d048229942dd7d50e29293b17c0478dca618293cdf2056d9e8ea
    • Instruction ID: a405a993ee323c89bb6c2714a44a0f711c17158ff66fc12a7c753e11eaa7ac9b
    • Opcode Fuzzy Hash: e28e8759e1d3d048229942dd7d50e29293b17c0478dca618293cdf2056d9e8ea
    • Instruction Fuzzy Hash: 872182B6E20249BFCB15DF68CC85CAABBA9FB44310B14462DF8159B251DB31ED20DB90
    Function 033FD30D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMON
    Download Yara Rule
    APIs
    • FindCompleteObject.LIBCMT ref: 033FD32E
    • FindMITargetTypeInstance.LIBCMT ref: 033FD367
      • Part of subcall function 033FCFCD: PMDtoOffset.LIBCMT ref: 033FD05F
    • FindVITargetTypeInstance.LIBCMT ref: 033FD36E
    • PMDtoOffset.LIBCMT ref: 033FD37F
    • std::bad_exception::bad_exception.LIBCMT ref: 033FD3A8
    • __CxxThrowException@8.LIBCMT ref: 033FD3B6
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Find$InstanceOffsetTargetType$CompleteException@8ObjectThrowstd::bad_exception::bad_exception
    • String ID: ekLDdEOoyHpNjyypF
    • API String ID: 1565299582-2829376797
    • Opcode ID: a9f5fd25fb4702b7fc773c85323063fd7a4660628394e3dc1635d1a5f80780e1
    • Instruction ID: 2682b1698add4a2819a5d424c482d41f2b101e3eca0a69f21d1cc14d995ac1af
    • Opcode Fuzzy Hash: a9f5fd25fb4702b7fc773c85323063fd7a4660628394e3dc1635d1a5f80780e1
    • Instruction Fuzzy Hash: 5421A5B6E007099FCB14DFA4CDC9AAEB768AF48710F94444AEB159B285DB34D901CB50
    Function 033E15D5 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 170COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memmove$Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 1771113911-141594409
    • Opcode ID: 23766bb10d799ec04aa413c1f598e50d7db9e73dcaa958bbea0f1b959572a83a
    • Instruction ID: 4e822c15629680bc6e7abcff133d5e9713b9349fa2e570fbfcf40c5579f4dcaa
    • Opcode Fuzzy Hash: 23766bb10d799ec04aa413c1f598e50d7db9e73dcaa958bbea0f1b959572a83a
    • Instruction Fuzzy Hash: CA51C235F10325DBDB24CE5CDDC0A6AB7AAEF80A00B18092DF8528B6C0C770DD51DBA1
    Function 033D44E8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 139COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 256744135-141594409
    • Opcode ID: cbae6a63d969238cb35c50a235ee46780133ffb5117625a3d2820ec9d9ecc5ab
    • Instruction ID: 2b32120ab661d246720fcba529b57d83423702e8cee436fa7401bca5ed45f6c0
    • Opcode Fuzzy Hash: cbae6a63d969238cb35c50a235ee46780133ffb5117625a3d2820ec9d9ecc5ab
    • Instruction Fuzzy Hash: 2941D8367003059FD734DE6EECC4A5AB7AAEB41620B04092DF996CB781CF70E845CB95
    Function 033E7907 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memmove$Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 1771113911-141594409
    • Opcode ID: ca06594b892571769106b4f64b6732f33997ec6fd6af2842c89a699726ca5625
    • Instruction ID: 65379cfd6536b3b2a261aa44eda7cb82d8d83bb7c07803e024ea3e507a22bce5
    • Opcode Fuzzy Hash: ca06594b892571769106b4f64b6732f33997ec6fd6af2842c89a699726ca5625
    • Instruction Fuzzy Hash: FE418035610225DFDB38CF5CD8C096AB7A6EF846407244A2EF9A28B7C5D731E941CBA1
    Function 033D77FC Relevance: 10.6, APIs: 7, Instructions: 105COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033D7801
    • GetDesktopWindow.USER32 ref: 033D7834
    • SetDlgItemInt.USER32(00000000,?,00000000), ref: 033D783B
    • GetDesktopWindow.USER32 ref: 033D785D
    • GetDC.USER32(00000000), ref: 033D7864
    • SetViewportExtEx.GDI32(00000000,?,00000000), ref: 033D786B
    • __aulldvrm.LIBCMT ref: 033D78C5
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport__aulldvrm
    • String ID:
    • API String ID: 1873070202-0
    • Opcode ID: c2265dd6a925263f7767e547d4e32d60f5d414bd3600fefbf7397dd9c1796100
    • Instruction ID: 00f9a9636435e690af7b4770d44ce8cdc9a72b8ef893263fdb2ab74f00a5e69e
    • Opcode Fuzzy Hash: c2265dd6a925263f7767e547d4e32d60f5d414bd3600fefbf7397dd9c1796100
    • Instruction Fuzzy Hash: 1D315C76E40258FFDF14DFA8E895AEDFBB9EF48305F148459E605BB280C6305A84CB61
    Function 033D75C7 Relevance: 10.6, APIs: 7, Instructions: 101COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport__aulldvrm
    • String ID:
    • API String ID: 1873070202-0
    • Opcode ID: c4e80f2b75435ee6fe9af664f537012d3dee18f87a6059526d37f37e9173ead6
    • Instruction ID: 830eacb254533ab633b0697a5a8a2f1d87a899caba29f9dc32bb82b95cff677a
    • Opcode Fuzzy Hash: c4e80f2b75435ee6fe9af664f537012d3dee18f87a6059526d37f37e9173ead6
    • Instruction Fuzzy Hash: F5318F76E00248BFDF10DFA8E895AEDFBB8EB48310F184459F605BB281C6304A84CB61
    Function 033D7929 Relevance: 10.6, APIs: 7, Instructions: 91COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport__aulldvrm
    • String ID:
    • API String ID: 1873070202-0
    • Opcode ID: 5db8434ba0deae73a0b2c493c7d5ab867f196aa5f38b07344ac13930e23ba2ec
    • Instruction ID: 7701c50b294332fed887edb24c7212ec882bbff034bdf108008daa1704b76a4a
    • Opcode Fuzzy Hash: 5db8434ba0deae73a0b2c493c7d5ab867f196aa5f38b07344ac13930e23ba2ec
    • Instruction Fuzzy Hash: 37313AB6E00248EFDF10DFE8E894AEDBBB8EF08345F144459E505BB290D7305A84CB61
    Function 033C9713 Relevance: 10.6, APIs: 7, Instructions: 79COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033C9740
    • GetDC.USER32(00000000), ref: 033C9747
    • GetTextExtentPoint32W.GDI32(00000000,?,?,033C981D), ref: 033C974E
    • GetDesktopWindow.USER32 ref: 033C976E
    • SetWindowTextW.USER32(00000000), ref: 033C9775
    • GetDesktopWindow.USER32 ref: 033C97EB
    • SetDlgItemInt.USER32(00000000,?,?,033C981D), ref: 033C97F2
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$ExtentItemPoint32
    • String ID:
    • API String ID: 1801697257-0
    • Opcode ID: 68f597ba2e2648ed26da5dc63ab046e891ffc69138aa841a6690fae8a8e96e9d
    • Instruction ID: a7c529538dd09f9df9956c9828d501da26081af597c0f34c9b3cd9b8dd869740
    • Opcode Fuzzy Hash: 68f597ba2e2648ed26da5dc63ab046e891ffc69138aa841a6690fae8a8e96e9d
    • Instruction Fuzzy Hash: 06319EB4E01249AFDB40DFA9D984AADBBF4BB09311F18445AF955FB380D7349A508F60
    Function 033E6E25 Relevance: 10.5, APIs: 7, Instructions: 47COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033E6E48
    • GetDC.USER32(00000000), ref: 033E6E4F
    • SetViewportExtEx.GDI32(00000000,?,033E6BDB,00003BF0), ref: 033E6E56
    • GetDesktopWindow.USER32 ref: 033E6E6F
    • GetDC.USER32(00000000), ref: 033E6E76
    • GetTextExtentPointW.GDI32(00000000,?,033E6BDB,00003BF0), ref: 033E6E7D
    • GetSysColorBrush.USER32(0000196A), ref: 033E6E90
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$BrushColorExtentPointTextViewport
    • String ID:
    • API String ID: 3221472952-0
    • Opcode ID: a0ec911a073180b1f6dc926d765d902ddcfe35f212ec10235d8aa4f5c170d282
    • Instruction ID: 4fd0b06f6fe415def9003038410d191ea852064f4bb3599963f96f20081adab3
    • Opcode Fuzzy Hash: a0ec911a073180b1f6dc926d765d902ddcfe35f212ec10235d8aa4f5c170d282
    • Instruction Fuzzy Hash: 3D018071644744AFEB15AFA4EE4EB9A7B94AB49705F0C0880F1186F1E1C3B594A0C751
    Function 033FFC30 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • __init_pointers.LIBCMT ref: 033FFC30
      • Part of subcall function 033FEAFE: EncodePointer.KERNEL32(00000000,00000001,033FFC35,033FD4DC,03418CE0,00000008,033FD6A2,?,00000001,?,03418D00,0000000C,033FD641,?,00000001,?), ref: 033FEB01
      • Part of subcall function 033FEAFE: __initp_misc_winsig.LIBCMT ref: 033FEB1C
      • Part of subcall function 033FEAFE: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 034059AD
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 034059C1
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 034059D4
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 034059E7
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 034059FA
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 03405A0D
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 03405A20
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 03405A33
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 03405A46
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 03405A59
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 03405A6C
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 03405A7F
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 03405A92
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 03405AA5
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 03405AB8
      • Part of subcall function 033FEAFE: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 03405ACB
    • __mtinitlocks.LIBCMT ref: 033FFC35
    • __mtterm.LIBCMT ref: 033FFC3E
      • Part of subcall function 033FFCA6: DeleteCriticalSection.KERNEL32(?,?,?,?,033FD5A7,033FD58D,03418CE0,00000008,033FD6A2,?,00000001,?,03418D00,0000000C,033FD641,?), ref: 034060BE
      • Part of subcall function 033FFCA6: _free.LIBCMT ref: 034060C5
      • Part of subcall function 033FFCA6: DeleteCriticalSection.KERNEL32(0341C4B8,?,?,033FD5A7,033FD58D,03418CE0,00000008,033FD6A2,?,00000001,?,03418D00,0000000C,033FD641,?,00000001), ref: 034060E7
    • __calloc_crt.LIBCMT ref: 033FFC63
    • __initptd.LIBCMT ref: 033FFC85
    • GetCurrentThreadId.KERNEL32 ref: 033FFC8C
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
    • String ID:
    • API String ID: 3567560977-0
    • Opcode ID: 4e47744d14f4934be8e879223f248b1588b0928b64896592646b2caea19d90d1
    • Instruction ID: 9d8e99c416262a31bff68db6f68b033535c16c7b688a62d24bc2c5eb695024c4
    • Opcode Fuzzy Hash: 4e47744d14f4934be8e879223f248b1588b0928b64896592646b2caea19d90d1
    • Instruction Fuzzy Hash: 46F0BB36A197311DF638F7757E81A5B6AC4CF41770B54072AEEA4DD1E8FF2084414594
    Function 033D5CC2 Relevance: 9.4, APIs: 6, Instructions: 412COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033D5CC7
    • GetDesktopWindow.USER32 ref: 033D5F4F
    • SetDlgItemInt.USER32(00000000), ref: 033D5F56
      • Part of subcall function 033D621B: GetDesktopWindow.USER32 ref: 033D6246
      • Part of subcall function 033D621B: SetWindowTextW.USER32(00000000), ref: 033D624D
    • GetDesktopWindow.USER32 ref: 033D61E4
    • GetDC.USER32(00000000), ref: 033D61EB
    • SetViewportExtEx.GDI32(00000000), ref: 033D61F2
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$H_prologItemTextViewport
    • String ID:
    • API String ID: 2267899263-0
    • Opcode ID: 55f1ba67acb100fdd72c33e6aee9fcc7c042912dbae74a273b621f8c319c313b
    • Instruction ID: a541dc02295d52651b4009d6d914e6adf9f4e8dd66338001a8faf0b017d356f6
    • Opcode Fuzzy Hash: 55f1ba67acb100fdd72c33e6aee9fcc7c042912dbae74a273b621f8c319c313b
    • Instruction Fuzzy Hash: 7BF19EB2D40349AEEB20EF94DCC6FEEBB78AB01304F544099E6157A1C1DB755A88CB61
    Function 033D76E5 Relevance: 9.1, APIs: 6, Instructions: 94COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: 74dcb86ffd7aeee2c9d1ec308833791d09ddc315604dff578524920607b5af4a
    • Instruction ID: 85a4ea8cf85616979e37b3b69167f742584cd87e8b323014b85d36b62652fa44
    • Opcode Fuzzy Hash: 74dcb86ffd7aeee2c9d1ec308833791d09ddc315604dff578524920607b5af4a
    • Instruction Fuzzy Hash: F1315C76E42258EBCB10DFA8E995AEDBBB5FF08340F148559F905BF280D7305A44CB90
    Function 033D68D3 Relevance: 9.1, APIs: 6, Instructions: 90COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: d85f1dc1436cd3f5b5c2e74f0725e6eb264bb4dbff3d06b34b62fc438c6a162a
    • Instruction ID: 4e0d0f31c6df7edfe504fa37db03957704c319d42c41762a03341f9cd7238375
    • Opcode Fuzzy Hash: d85f1dc1436cd3f5b5c2e74f0725e6eb264bb4dbff3d06b34b62fc438c6a162a
    • Instruction Fuzzy Hash: 3431C477D00258ABCB21EFA4D9C69EEFB79EB44310F444559E6267B181CA355E40CBA0
    Function 033D73D2 Relevance: 9.1, APIs: 6, Instructions: 88COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: 0b05236c9dad035d3ef6f861bc7f9cb0b45a2b5771f138fcb75a3f689012e488
    • Instruction ID: 54927abb5dc9f7344e55e341f00d2c84c123f6f6af1f0fc2b6c7830677dace34
    • Opcode Fuzzy Hash: 0b05236c9dad035d3ef6f861bc7f9cb0b45a2b5771f138fcb75a3f689012e488
    • Instruction Fuzzy Hash: E431CF72E42248EFDF01DFA8E9D5AEDBBBAEF08304F188559E5006F280C7754A44CB61
    Function 033D74D6 Relevance: 9.1, APIs: 6, Instructions: 79COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: 7b0b4b4a221e1ff68d0314231aa1df602e09176369e264bdb91e3763af8de1cb
    • Instruction ID: 287795061414ca4e2bae6c3182d85f062ce9f3518942617aae9e50c53e09f167
    • Opcode Fuzzy Hash: 7b0b4b4a221e1ff68d0314231aa1df602e09176369e264bdb91e3763af8de1cb
    • Instruction Fuzzy Hash: DC314F75E01248EFDF00DFA8E9D5AEDFBBAEB08305F148559E5056A280C7754A44CB51
    Function 033F857E Relevance: 9.0, APIs: 6, Instructions: 41registryCOMMON
    Download Yara Rule
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,00000000,?,033F8104,?,00000001,000073CF,?), ref: 033F8599
    • GetDesktopWindow.USER32 ref: 033F85AD
    • SetWindowTextW.USER32(00000000), ref: 033F85B4
    • GetDesktopWindow.USER32 ref: 033F85CE
    • GetDC.USER32(00000000), ref: 033F85D5
    • SetViewportExtEx.GDI32(00000000,?,033F8104,?), ref: 033F85DC
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$LoadTextViewport
    • String ID:
    • API String ID: 145119710-0
    • Opcode ID: 93e667194da22122cdc293ba0cac2bf1231cbfd1d5e46e05abd3241906a2889c
    • Instruction ID: 7956f15a976cbd6508c75866b03b2c45559a3effafc090a5fa21fa81b041517c
    • Opcode Fuzzy Hash: 93e667194da22122cdc293ba0cac2bf1231cbfd1d5e46e05abd3241906a2889c
    • Instruction Fuzzy Hash: BA01A2B0244748AFEB169FA4ED4CBA97B94AB05309F0C0844F60D6E2D0C2B485E0CB51
    Function 033E11E9 Relevance: 9.0, APIs: 6, Instructions: 34windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033E11FA
    • GetDC.USER32(00000000), ref: 033E1201
    • DrawFocusRect.USER32(00000000), ref: 033E1208
    • GetDesktopWindow.USER32 ref: 033E1221
    • GetDC.USER32(00000000), ref: 033E1228
    • GetTextExtentPointW.GDI32(00000000,?,033E1063,00000000), ref: 033E122F
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$DrawExtentFocusPointRectText
    • String ID:
    • API String ID: 3079162497-0
    • Opcode ID: ccf66419c07e19279404292dc969e5c47c8e97a20559c359603556312699bf5f
    • Instruction ID: 59bbb842aa1cfd1390d2266b6680d799c060a4c01833d1ec9cd3a8c91d97a23e
    • Opcode Fuzzy Hash: ccf66419c07e19279404292dc969e5c47c8e97a20559c359603556312699bf5f
    • Instruction Fuzzy Hash: 20F05472A48744ABEB11BFE0ED4DB5D7B98AB09316F0C0C44F20C9D1C0C77950A0C711
    Function 033D4CB5 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 228COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog__floor_pentium4
    • String ID: false$null$true
    • API String ID: 2354235884-2913297407
    • Opcode ID: 6796d1f30bc4bedd90c097cb417ef7aa978fde618c7183929501b1697d5f2612
    • Instruction ID: f333215463b1a5aa33c633e7ee562c1c6d05ae38c104c074f864194f75cf45bd
    • Opcode Fuzzy Hash: 6796d1f30bc4bedd90c097cb417ef7aa978fde618c7183929501b1697d5f2612
    • Instruction Fuzzy Hash: 3281E176D04208AFDF15DFA5E8D4ADEBBB9EF16320F04421AF415AB181DB709A85CB60
    Function 033E6B29 Relevance: 7.7, APIs: 5, Instructions: 245COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033E6DEC
    • SetWindowTextW.USER32(00000000), ref: 033E6DF3
      • Part of subcall function 033E6E25: GetDesktopWindow.USER32 ref: 033E6E48
      • Part of subcall function 033E6E25: GetDC.USER32(00000000), ref: 033E6E4F
      • Part of subcall function 033E6E25: SetViewportExtEx.GDI32(00000000,?,033E6BDB,00003BF0), ref: 033E6E56
      • Part of subcall function 033E6B29: FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 033E6CD4
    • GetDesktopWindow.USER32 ref: 033E6E11
    • SetDlgItemInt.USER32(00000000), ref: 033E6E18
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$FormatItemMessageTextViewport
    • String ID:
    • API String ID: 424236427-0
    • Opcode ID: ec22ecc89a707f5e0ebaee1c90f16393d547bd6ee38ce0866413f7b6b551c43d
    • Instruction ID: d356f7eeaa58882e49ecf0ef1108dd364b6bcf98eb04c9267abd18e0e20fabb1
    • Opcode Fuzzy Hash: ec22ecc89a707f5e0ebaee1c90f16393d547bd6ee38ce0866413f7b6b551c43d
    • Instruction Fuzzy Hash: C0918B74E44369BBEB10DF94CDC2AEDBB78EB24704F148099EA557B2C1D3B14A80CB51
    Function 034061FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • _malloc.LIBCMT ref: 0340620B
      • Part of subcall function 033FC44C: __FF_MSGBANNER.LIBCMT ref: 033FC463
      • Part of subcall function 033FC44C: __NMSG_WRITE.LIBCMT ref: 033FC46A
      • Part of subcall function 033FC44C: RtlAllocateHeap.NTDLL(03430000,00000000,00000001,00000001,033E18DB,033E18DB,?,033FBDB1,00000001,00000000,00000003,00000000,?,033FBCEB,033F887B,?), ref: 033FC48F
    • _free.LIBCMT ref: 0340621E
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AllocateHeap_free_malloc
    • String ID:
    • API String ID: 1020059152-0
    • Opcode ID: 00309b90bf4bb486b196c6431b1caa816c58e71414643100a808af2eb4caade0
    • Instruction ID: 5f53db86235f71cc0c481159e34ad057ac221c001866a1d687e2ecb22603afc5
    • Opcode Fuzzy Hash: 00309b90bf4bb486b196c6431b1caa816c58e71414643100a808af2eb4caade0
    • Instruction Fuzzy Hash: CD112B31E04715AECF21FF70AC44A5A7BD8EF00260B550A3BEA069E2C0DE3C84A08654
    Function 033D91BE Relevance: 7.6, APIs: 5, Instructions: 50COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033D9120
    • SetDlgItemInt.USER32(00000000), ref: 033D9127
    • GetDesktopWindow.USER32 ref: 033D9149
    • GetDC.USER32(00000000), ref: 033D9150
    • SetViewportExtEx.GDI32(00000000), ref: 033D9157
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$ItemViewport
    • String ID:
    • API String ID: 1989583774-0
    • Opcode ID: 397ba50d6a642b152ae270afe65d80818fd971d91acd6e12d01be960c88cc255
    • Instruction ID: f60d665ee670aaa34fb7caf7783d3860236b37fb17c9e265736dffa45360ee19
    • Opcode Fuzzy Hash: 397ba50d6a642b152ae270afe65d80818fd971d91acd6e12d01be960c88cc255
    • Instruction Fuzzy Hash: 22117CB6A48384FFCB00EFA4E8CDA59BFB8AB05345F088598E6056F361C7758644CB51
    Function 033E3C46 Relevance: 7.5, APIs: 5, Instructions: 47COMMON
    Download Yara Rule
    APIs
    • SetLastError.KERNEL32(00002292,?,033E3D1B,00004322,00000000,00002A47,00000000,00000000,00000001,00003654,?,033E3A0E,00000BFB,00000000,?,00000000), ref: 033E3C62
    • GetDesktopWindow.USER32 ref: 033E3CAB
    • GetDC.USER32(00000000), ref: 033E3CB2
    • SetViewportExtEx.GDI32(00000000,?,033E3D1B,00004322), ref: 033E3CB9
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopErrorLastViewportWindow
    • String ID:
    • API String ID: 3126713311-0
    • Opcode ID: 53fc44f054cb9c5432d6f2c09d2b4206e7e2216571b2b497c8d3cffcb47d4352
    • Instruction ID: 77c640fbd4443d752129025f920d1ff82fcf8ed35690cd294303f973853758f2
    • Opcode Fuzzy Hash: 53fc44f054cb9c5432d6f2c09d2b4206e7e2216571b2b497c8d3cffcb47d4352
    • Instruction Fuzzy Hash: C601C0B9700265AFEB11AF94D94CB99BBA4AB0A729F0C4480F9486F2D1C374C4D1CB50
    Function 033DD3D4 Relevance: 7.5, APIs: 5, Instructions: 36COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033DD3EF
    • SetDlgItemInt.USER32(00000000,?,033DCE40,00000000), ref: 033DD3F6
    • GetDesktopWindow.USER32 ref: 033DD40F
    • GetDC.USER32(00000000), ref: 033DD416
    • GetTextExtentPointW.GDI32(00000000,?,033DCE40,00000000), ref: 033DD41D
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$ExtentItemPointText
    • String ID:
    • API String ID: 4061458486-0
    • Opcode ID: 06b56f3b20873a357009e398a93b7a50ff439a16fee54af0df8668ba42d4c6d2
    • Instruction ID: 88a7fdd31bf60fa6b795ee424c9cca599cc5f50e61890ae7d72eadb222f46dab
    • Opcode Fuzzy Hash: 06b56f3b20873a357009e398a93b7a50ff439a16fee54af0df8668ba42d4c6d2
    • Instruction Fuzzy Hash: 6DF030B2A80748BBEB126FE4FD4EB99BB996B04705F0C4840F7096D5D1C6B551E0CB51
    Function 033DE1AC Relevance: 7.5, APIs: 5, Instructions: 34COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033DE1D7
    • SetDlgItemInt.USER32(00000000), ref: 033DE1DE
    • GetDesktopWindow.USER32 ref: 033DE200
    • GetDC.USER32(00000000), ref: 033DE207
    • SetViewportExtEx.GDI32(00000000), ref: 033DE20E
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$ItemViewport
    • String ID:
    • API String ID: 1989583774-0
    • Opcode ID: 781e2471c6eee51de31a21d16ce0612eee5958c6ede31afcf5167c546c03f065
    • Instruction ID: e2c68329a7d3096c6130955fa36d060972c5adacfc7eb3858c506ba46784249b
    • Opcode Fuzzy Hash: 781e2471c6eee51de31a21d16ce0612eee5958c6ede31afcf5167c546c03f065
    • Instruction Fuzzy Hash: FCF044B1E88744BBDB10FFF0A94D55DFFB89B05705F088895A141AE185D5354258CB61
    Function 033D1E98 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033D1ED5
    • GetDC.USER32(00000000), ref: 033D1EDC
    • SetViewportExtEx.GDI32(00000000,?,033D1ACD,00001163), ref: 033D1EE3
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopViewportWindow
    • String ID:
    • API String ID: 1263604042-0
    • Opcode ID: d13182abf7cd4e896bc2680c360ec368311bcb4a2deb76fe13af8143786ed2d7
    • Instruction ID: 2f12d4a0fa253328d14d933323dfd2dea6bdbcb68b02e5fb32dbdc07af96efd0
    • Opcode Fuzzy Hash: d13182abf7cd4e896bc2680c360ec368311bcb4a2deb76fe13af8143786ed2d7
    • Instruction Fuzzy Hash: 8AF0B4B2A40749BBEF12AFE4FD4DBAA7B686B08306F0C4840F6095D0E1C67581F0C751
    Function 033E2EEC Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$DesktopH_prologLong
    • String ID: x(
    • API String ID: 1792819551-2475313659
    • Opcode ID: 2cf618dcb529c4b560792982b3f4bb6fe8697b310eb6992779633fbfec31135c
    • Instruction ID: 45e598c59ef19503ea87d9d477f75b2e26b9dd040ccfd15a061f18db36daa6b9
    • Opcode Fuzzy Hash: 2cf618dcb529c4b560792982b3f4bb6fe8697b310eb6992779633fbfec31135c
    • Instruction Fuzzy Hash: 69C157B8E4035DAFDB10DF98C885AEEBBB8FF05314F508059F905AB281D7749A54CBA1
    Function 033DF608 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162memoryCOMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033DF60D
    • std::_Xinvalid_argument.LIBCPMT ref: 033DF660
      • Part of subcall function 033F8863: std::exception::exception.LIBCMT ref: 033F8876
      • Part of subcall function 033F8863: __CxxThrowException@8.LIBCMT ref: 033F888B
    • _Allocate.LIBCPMT ref: 033DF676
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AllocateException@8H_prologThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 1962182295-3797114014
    • Opcode ID: 53add84d7cd2b368eae6c4ae600e3f3dd229e803167feb440d971ae682fe25cd
    • Instruction ID: 41b5807d8d4b22ce50b470844a9a28194bec8752b5ad8a95fa8268a12d9243ee
    • Opcode Fuzzy Hash: 53add84d7cd2b368eae6c4ae600e3f3dd229e803167feb440d971ae682fe25cd
    • Instruction Fuzzy Hash: E3515E76A10209AFCF15DF68C9C59AA7BA9FF88210F048669FC1A9B245D730ED10CB60
    Function 033D31E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID: false$null$true
    • API String ID: 3519838083-2913297407
    • Opcode ID: 44662a8aebe5168b38ffcac99989ee8020bc01e9641d2eb145ff28550f1a3c52
    • Instruction ID: 2bb944bd326f407aa4982cc046b09d8df1604fab093b062b6f2bb2f52cd7099e
    • Opcode Fuzzy Hash: 44662a8aebe5168b38ffcac99989ee8020bc01e9641d2eb145ff28550f1a3c52
    • Instruction Fuzzy Hash: 5F21E57BF403046ADA28DB64FCC2BADB3955B01B20F48442DE505AF9C1DBB2DD4186C6
    Function 033D4703 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 256744135-141594409
    • Opcode ID: 51d2a67d348f0e05060c6bf187924830aeaf9234020c60dfa9318dbedd41949e
    • Instruction ID: 3805ba056e01848fa3ac0e2b3a5285586d4d86b600a8915ecb28bd72ced3ddae
    • Opcode Fuzzy Hash: 51d2a67d348f0e05060c6bf187924830aeaf9234020c60dfa9318dbedd41949e
    • Instruction Fuzzy Hash: FE21B27AB007049FCB24DE6AECC0D6AB7ADEB42610B24492EF5768F641CB71E94187D0
    Function 033C438B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 256744135-141594409
    • Opcode ID: 8b0565250687a0fc4b7c9da3d01a1a3bae5e9c249c0d3461a4d30cbea7360f05
    • Instruction ID: 9602343d056185df34afc6506a66ed1d5321632fa34f4d8c90656d8700aa5250
    • Opcode Fuzzy Hash: 8b0565250687a0fc4b7c9da3d01a1a3bae5e9c249c0d3461a4d30cbea7360f05
    • Instruction Fuzzy Hash: F0110635B207449FC735DE5EDCD099AF7ADEB81610B200A2EE5528F681C771EC91C790
    Function 033C7EFE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 256744135-141594409
    • Opcode ID: a5911dcf6f33dd713e4bf909456774b4a1e0ee5217a27c983c0c35b84b7f1f7e
    • Instruction ID: 22fb69146c93bbe3939e68b42b5b59c29073229a94903360d81b502935c8d5c5
    • Opcode Fuzzy Hash: a5911dcf6f33dd713e4bf909456774b4a1e0ee5217a27c983c0c35b84b7f1f7e
    • Instruction Fuzzy Hash: 8D11AC36720345AFD728DF6DD8C0A5ABBAAAB41660B140A2DF925CB281C770EC54CB94
    Function 033D1268 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033D126D
      • Part of subcall function 033D0F96: __EH_prolog.LIBCMT ref: 033D0F9B
      • Part of subcall function 033D0F96: char_traits.LIBCPMT ref: 033D10B7
    • char_traits.LIBCPMT ref: 033D129D
    • char_traits.LIBCPMT ref: 033D12B7
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: char_traits$H_prolog
    • String ID: .
    • API String ID: 3393116018-3640953465
    • Opcode ID: 20303f1bbe28a400448bc043eb3141ba724544cda7fa48a7667fe2c65c218394
    • Instruction ID: 36f12bf0de1ba96cf6602e7f943bf848136223ed608c7474bb4521c84cfc6a2a
    • Opcode Fuzzy Hash: 20303f1bbe28a400448bc043eb3141ba724544cda7fa48a7667fe2c65c218394
    • Instruction Fuzzy Hash: 240180B7E006195FDB54EAA8BCC19FEFB7CAB40220F64066FE415AB680C7316D4186E5
    Function 033DCC54 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033DCC77
    • GetDC.USER32(00000000), ref: 033DCC7E
    • SetViewportExtEx.GDI32(00000000,?,033DD459,000058F1), ref: 033DCC85
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopViewportWindow
    • String ID: un2l
    • API String ID: 1263604042-2526548122
    • Opcode ID: 60a46a1db1158e95cf43bf93d88b67b0e3eca83bb3f622563a6269b8e9430e17
    • Instruction ID: 405f09fe02c1ed4e3eb69faf8adac6ed9d5a88d236483379f835418c043463ed
    • Opcode Fuzzy Hash: 60a46a1db1158e95cf43bf93d88b67b0e3eca83bb3f622563a6269b8e9430e17
    • Instruction Fuzzy Hash: F0F082B2640649BBEF11AFA4ED4DBDA7B986B05705F0C4440F7085E4D1C7B194A1D791
    Function 033FE1E8 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AdjustPointer_memmove
    • String ID:
    • API String ID: 1721217611-0
    • Opcode ID: 84b3a33f9824510bbbae21d88d5994a64e52f29c667c8f164d5865906786f2fc
    • Instruction ID: 65007a1de0d7ad0635c6c1afafe851e052dd22c401f67d9aadc100657f2c386d
    • Opcode Fuzzy Hash: 84b3a33f9824510bbbae21d88d5994a64e52f29c667c8f164d5865906786f2fc
    • Instruction Fuzzy Hash: 1F41943A6083039FEB38EE25DDC4B66B7A89F41750F68446FEA408E5F0EB31D580D611
    Function 033F07C6 Relevance: 6.2, APIs: 4, Instructions: 158COMMON
    Download Yara Rule
    APIs
    • _memset.LIBCMT ref: 033F086F
    • GetDesktopWindow.USER32 ref: 033F0971
    • GetDC.USER32(00000000), ref: 033F0978
    • SetViewportExtEx.GDI32(00000000), ref: 033F097F
      • Part of subcall function 033F468E: GetDesktopWindow.USER32 ref: 033F4690
      • Part of subcall function 033F468E: SetWindowTextW.USER32(00000000), ref: 033F4697
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$TextViewport_memset
    • String ID:
    • API String ID: 89821065-0
    • Opcode ID: 3fdb0f391af48224d1e84444611116281ea9625548a52da55f1147ee0f85a269
    • Instruction ID: 98799bba9c161367f733e04185d2877e5d69273ea0b915025cc124733ad07d37
    • Opcode Fuzzy Hash: 3fdb0f391af48224d1e84444611116281ea9625548a52da55f1147ee0f85a269
    • Instruction Fuzzy Hash: DE5137B9C04349EEDF04DFD8C8858EEFB78FF04315F9485AADA516A242D7354A48CB90
    Function 033D6AAF Relevance: 6.1, APIs: 4, Instructions: 102COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentH_prologPointTextWindow
    • String ID:
    • API String ID: 170700240-0
    • Opcode ID: c6c82461365e59f58cd7408386c4730a9952dd4e083a11b9619b4f7b686c006e
    • Instruction ID: e7d26f34fa3c73a755f4a103da41289ebcea53b5bdd1ec5be0ec913c2a20a4c1
    • Opcode Fuzzy Hash: c6c82461365e59f58cd7408386c4730a9952dd4e083a11b9619b4f7b686c006e
    • Instruction Fuzzy Hash: 75412CB6E44249EBDB10EF95EC82AADBB74FB04714F80C519FA296E281C3748650CF91
    Function 0340B800 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0340B836
    • __isleadbyte_l.LIBCMT ref: 0340B864
    • MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000002,00000000,?,00000000,00000000,?,00005234), ref: 0340B892
    • MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,00000002,00000000,?,00000000,00000000,?,00005234), ref: 0340B8C8
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
    • String ID:
    • API String ID: 3058430110-0
    • Opcode ID: e087f4143e1d68020b8f4267fd96a620683f12a9c083318692309e756b333d75
    • Instruction ID: 84845d14435498250f55ef251eac5de1052d934b6c05273c2f90225e457754bc
    • Opcode Fuzzy Hash: e087f4143e1d68020b8f4267fd96a620683f12a9c083318692309e756b333d75
    • Instruction Fuzzy Hash: 96318232B00256AFDB21DF65CC84A7BBBA5FF41210F19457AE4649F2E0D730D851DB98
    Function 033F437E Relevance: 6.1, APIs: 4, Instructions: 91COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memmove$_memset
    • String ID:
    • API String ID: 1357608183-0
    • Opcode ID: d0a66a7d6acb7acb60fa4a8b92752cbd559b609400514f1492ace66b6d358352
    • Instruction ID: 0d26c94201ad186e73d11d7416d97d516ffaf422756554d853477ceabf2991ea
    • Opcode Fuzzy Hash: d0a66a7d6acb7acb60fa4a8b92752cbd559b609400514f1492ace66b6d358352
    • Instruction Fuzzy Hash: 4521C1B69002046FDB10DF19DCC0AAB7769AF40724F954169EE19AB206E734D950CA94
    Function 033F30CE Relevance: 6.1, APIs: 4, Instructions: 91COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: _memmove$_memset
    • String ID:
    • API String ID: 1357608183-0
    • Opcode ID: 83208bb365ac6273134597c007199f908af698a054711ead73dd72d1acbf0f5e
    • Instruction ID: 562d6be9c22ca40109a17491719572959711bf33a55e1a64f53d3dd35794f90e
    • Opcode Fuzzy Hash: 83208bb365ac6273134597c007199f908af698a054711ead73dd72d1acbf0f5e
    • Instruction Fuzzy Hash: 1C21917AA003056FDF18EE19CCC5A6B7769EF40324F848169EE199A206D734D915CB94
    Function 033D2B88 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033D2B8D
    • GetDesktopWindow.USER32 ref: 033D2C76
    • GetDC.USER32(00000000), ref: 033D2C7D
    • GetTextExtentPointW.GDI32(00000000,?,033DF486), ref: 033D2C84
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentH_prologPointTextWindow
    • String ID:
    • API String ID: 170700240-0
    • Opcode ID: 9e7fc41d569f15648f7dfe035dbd3bfc5c1a3b8e62cc81cea6749764e44e0982
    • Instruction ID: 22277bf6c306abb9b5549f332a892e320f81f57154a609bbbeba0adb498d4287
    • Opcode Fuzzy Hash: 9e7fc41d569f15648f7dfe035dbd3bfc5c1a3b8e62cc81cea6749764e44e0982
    • Instruction Fuzzy Hash: 93314AB6D0425ADFDB15DF94EDC4AEFBBB4FF08305F50095AE516AA280C3B14A40CBA0
    Function 033DFF98 Relevance: 6.1, APIs: 4, Instructions: 76windowCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 033DFDB5: _memmove.LIBCMT ref: 033DFDEF
    • GetSysColorBrush.USER32(0000196A), ref: 033E0002
    • GetDesktopWindow.USER32 ref: 033E0016
    • SetWindowTextW.USER32(00000000), ref: 033E001D
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 033E0042
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText_memmove
    • String ID:
    • API String ID: 3230339316-0
    • Opcode ID: decfd6642b7f4f28dc21706ffa04d8ecaba114a29e789f378c1666a1ca76b4c1
    • Instruction ID: 80bbc0346d63484ca604119118b433c8a247de1f987c675e81aeb6b5cb61d848
    • Opcode Fuzzy Hash: decfd6642b7f4f28dc21706ffa04d8ecaba114a29e789f378c1666a1ca76b4c1
    • Instruction Fuzzy Hash: 8E3169B4500248FFDB04DF14D8C49ADBBA8EB0532AF14C15AFC695F385C27A8A84CB50
    Function 033D873C Relevance: 6.1, APIs: 4, Instructions: 75windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033D878C
    • GetDesktopWindow.USER32 ref: 033D87A3
    • SetWindowTextW.USER32(00000000), ref: 033D87AA
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000000), ref: 033D87D2
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: 29a82a3282b3028bbf4db97eac2ddaa9c98ab414d8655c67fa5466af103f3e03
    • Instruction ID: 1fc3cb007d5b250d6903b5d03687ef0ce0e17b5fa8917e2943de4859f6f0fcfd
    • Opcode Fuzzy Hash: 29a82a3282b3028bbf4db97eac2ddaa9c98ab414d8655c67fa5466af103f3e03
    • Instruction Fuzzy Hash: AB315CB5D04308FBEB14CFA9E8886ADFFB5BB84305F54C5A9E4646E281D7712685CB10
    Function 033EBABF Relevance: 6.1, APIs: 4, Instructions: 74COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentH_prologPoint32TextWindow
    • String ID:
    • API String ID: 4235267150-0
    • Opcode ID: 660383626a69fc730dcc4f9c1c91d03356f74b4c399b2b97a24f251fad39370f
    • Instruction ID: 3ef7c2648c4d674225eb0af8fbaacdc84be67d88d0a429edd3d0eeb32028e721
    • Opcode Fuzzy Hash: 660383626a69fc730dcc4f9c1c91d03356f74b4c399b2b97a24f251fad39370f
    • Instruction Fuzzy Hash: DE21AF72D00248BBDB11EFA4ED88EDFBBB9EF85700F044509F505AB1D0CA755A50CBA1
    Function 033D8669 Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033D86B6
    • GetDesktopWindow.USER32 ref: 033D86CA
    • SetWindowTextW.USER32(00000000), ref: 033D86D1
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000000), ref: 033D86F6
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: 59fa2b3a04da688a87a2e801e0773af469cdc1d23405dea83b2f22b3850f6ebc
    • Instruction ID: ce09837c90446db4306ca4acf01cf6684acde45358e32427a025e91d277e4143
    • Opcode Fuzzy Hash: 59fa2b3a04da688a87a2e801e0773af469cdc1d23405dea83b2f22b3850f6ebc
    • Instruction Fuzzy Hash: E62116B5D4434CFFDB00DFA8E8885ADFFB8BB04329F548599E6507A281D3316695CB50
    Function 033DE23E Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033DE28B
    • GetDesktopWindow.USER32 ref: 033DE29F
    • SetWindowTextW.USER32(00000000), ref: 033DE2A6
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 033DE2CB
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: 8c33cbb0ffd69857778252315f606974fb2f2122a73f4219801966f58a502d42
    • Instruction ID: b51488814096d22ed5215b05f739e82e05425be760320b50dcde2d1c2794b2bc
    • Opcode Fuzzy Hash: 8c33cbb0ffd69857778252315f606974fb2f2122a73f4219801966f58a502d42
    • Instruction Fuzzy Hash: E62114B5D48348BEEB10EFE8E8895ADFFB8AB05319F548699E5607A681C3310685CB50
    Function 033CBB5E Relevance: 6.1, APIs: 4, Instructions: 60COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033CBBD0
    • SetWindowLongW.USER32(00000000), ref: 033CBBD7
    • SetLastError.KERNEL32(00002292), ref: 033CBC00
    • GetUserDefaultUILanguage.KERNEL32 ref: 033CBC08
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$DefaultDesktopErrorLanguageLastLongUser
    • String ID:
    • API String ID: 1756640285-0
    • Opcode ID: 80da67366e8d00f0e2a5c0725e5fbc8b4ca48a571eeb405d575f87508e984b89
    • Instruction ID: a011047bea1748344966eff8d806eff5402bef8e9db3cd60436596d39ded38d3
    • Opcode Fuzzy Hash: 80da67366e8d00f0e2a5c0725e5fbc8b4ca48a571eeb405d575f87508e984b89
    • Instruction Fuzzy Hash: AB21B4B4E142599FDB40DFA9D985AADFBF4AB08200F04846AE855E7340D7349A50CF61
    Function 033CF97D Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 033CF9BF
    • GetDC.USER32(00000000), ref: 033CF9C6
    • DrawFocusRect.USER32(00000000), ref: 033CF9CD
    • GetSysColorBrush.USER32(0000196A), ref: 033CF9F0
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: BrushColorDesktopDrawFocusRectWindow
    • String ID:
    • API String ID: 2851196967-0
    • Opcode ID: 0a607d92f62bbef098ed26a27b49ce764149167c8ce5715e04f398121e7c93ea
    • Instruction ID: 83bada07a6fd4f02a5caeaa280a564fc4c0a0c3d5b7d62d176c791bdc9deb7af
    • Opcode Fuzzy Hash: 0a607d92f62bbef098ed26a27b49ce764149167c8ce5715e04f398121e7c93ea
    • Instruction Fuzzy Hash: C821D8B4E04249AFDF40DFA9D985AAEFBF4AF09700F18445AF954FB280D634DA508B61
    Function 033CB9C7 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
    Download Yara Rule
    APIs
    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000000), ref: 033CBA0D
    • GetDesktopWindow.USER32 ref: 033CBA34
    • GetDC.USER32(00000000), ref: 033CBA3B
    • GetTextExtentPointW.GDI32(00000000,?,033CBFFD,00000718), ref: 033CBA42
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentLookupPointPrivilegeTextValueWindow
    • String ID:
    • API String ID: 2870449056-0
    • Opcode ID: da97105aa422b1bbe82dedf9f7d414a426ccd7bfe30c3bee0ddb9d4409fd90e8
    • Instruction ID: 995aeb9089c1ce0bc80a21071fb66f0cb41e0e32a134d3ae21042c7195d1b97a
    • Opcode Fuzzy Hash: da97105aa422b1bbe82dedf9f7d414a426ccd7bfe30c3bee0ddb9d4409fd90e8
    • Instruction Fuzzy Hash: 8D11F674E04249AFDB50DFA5D986BAEBFF4AB08701F14449AF954FB280D634AA508F60
    Function 033FDB2C Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • ___BuildCatchObject.LIBCMT ref: 033FDB43
      • Part of subcall function 033FE15A: ___AdjustPointer.LIBCMT ref: 033FE1A3
    • _UnwindNestedFrames.LIBCMT ref: 033FDB5A
    • ___FrameUnwindToState.LIBCMT ref: 033FDB6C
    • CallCatchBlock.LIBCMT ref: 033FDB90
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
    • String ID:
    • API String ID: 2633735394-0
    • Opcode ID: 8b30573c538f3b1fc18e63ca7426e9ddefb9c98fc61009f8d964c6abd2916d26
    • Instruction ID: 545c74ad42052f627dc1b86a520d743ba2055492714874a6b5a1351c761d3148
    • Opcode Fuzzy Hash: 8b30573c538f3b1fc18e63ca7426e9ddefb9c98fc61009f8d964c6abd2916d26
    • Instruction Fuzzy Hash: 2501E932400209BFCF12AF55CC84EEA7BBAFF49754F454115FE1866124D332E961DBA0
    Function 033FFF0E Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
    • String ID:
    • API String ID: 3016257755-0
    • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
    • Instruction ID: c0785080e1b335cfc343132c16e5d8ec9297fca503a3d5fcac0940d88b53f00a
    • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
    • Instruction Fuzzy Hash: 26017B3600424EBFCF129E84CC818EE3F26BB19350B888625FE1858171C632C5B2AB85
    Function 033EB42F Relevance: 6.0, APIs: 4, Instructions: 46COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033EB434
    • GetDesktopWindow.USER32 ref: 033EB497
    • GetDC.USER32(00000000), ref: 033EB49E
    • GetTextExtentPoint32W.GDI32(00000000,?,033EA53B,?), ref: 033EB4A5
      • Part of subcall function 033EB820: __EH_prolog.LIBCMT ref: 033EB825
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog$DesktopExtentPoint32TextWindow
    • String ID:
    • API String ID: 2853833731-0
    • Opcode ID: 3f96f7d883ff3e81607fb2c88a06f28c70090ec55992dcd1e367413a555757ab
    • Instruction ID: f60e0192123393c6c44c370e0177c61fd74e8b35713ff40c81354e609164e775
    • Opcode Fuzzy Hash: 3f96f7d883ff3e81607fb2c88a06f28c70090ec55992dcd1e367413a555757ab
    • Instruction Fuzzy Hash: 46117935D0424DABEF06EFA0DA89BECBB74AF00308F148048F4092E1D1DB795A54CF51
    Function 033E3353 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
    Download Yara Rule
    APIs
    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000000), ref: 033E33A3
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: LookupPrivilegeValue
    • String ID:
    • API String ID: 3899507212-0
    • Opcode ID: 17f3962e9a9138dd3823915ff00fa8bdcc19e9ae4d65266ff8fb8447e7857c87
    • Instruction ID: 17752b3042cd9efeb3f854faa4f7e1c05dab60c5a305948c4a2eb1d9c6ab51e8
    • Opcode Fuzzy Hash: 17f3962e9a9138dd3823915ff00fa8bdcc19e9ae4d65266ff8fb8447e7857c87
    • Instruction Fuzzy Hash: 96018475604254EFDB01EF64E848BA9BBF8FB06325F0C0485F8498B291C73488D0CB50
    Function 033C1F3C Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 033C1F65
    • GetDesktopWindow.USER32 ref: 033C1F8F
    • SetWindowTextW.USER32(00000000), ref: 033C1F96
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 033C1FC2
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: 146fbd1cf6f20334cea05aadb344c47d28fab1fda3269a2d5cfa2d292c2dec26
    • Instruction ID: b982f4ed2ebec9c0d2617b7829d3e9b819fd2f75d32d37892ff3aa953a8c3e4c
    • Opcode Fuzzy Hash: 146fbd1cf6f20334cea05aadb344c47d28fab1fda3269a2d5cfa2d292c2dec26
    • Instruction Fuzzy Hash: 7D015274E587A89AEF20EBA8DD99BADFEB47B05709F080709F145BE1C3C7748400A720
    Function 033D62EB Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON
    Download Yara Rule
    APIs
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,?,033D63C0,00000000,00003AF7,000005E3,00000003,?,033D6385,00000000), ref: 033D6327
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: FormatMessage
    • String ID:
    • API String ID: 1306739567-0
    • Opcode ID: 08bb23d69783dcd09398526d0c3cb7d17b4d3c16fb0701f79fc2c0423585f7db
    • Instruction ID: 6249542a3d440684117537636785546ba489eee69ded57ecb2a9be13fd470319
    • Opcode Fuzzy Hash: 08bb23d69783dcd09398526d0c3cb7d17b4d3c16fb0701f79fc2c0423585f7db
    • Instruction Fuzzy Hash: 9BF036B2685744BFFB01AAA0EE4EF7A7A9C9704705F4C0844FA1D9D4D2D67545A08660
    Function 033E3DCD Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON
    Download Yara Rule
    APIs
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 033E3DF4
    • GetDesktopWindow.USER32 ref: 033E3E0B
    • GetDC.USER32(00000000), ref: 033E3E12
    • GetTextExtentPointW.GDI32(00000000), ref: 033E3E19
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentFormatMessagePointTextWindow
    • String ID:
    • API String ID: 2513662917-0
    • Opcode ID: 26708f4955df7a05a05a8746d7821e25bc9974f08c3f568fec87e8f45c08d1f9
    • Instruction ID: cdbb0a7083d8749d48a51a1089f2a45a387f8ed0f0f7c98db3939b24fef40434
    • Opcode Fuzzy Hash: 26708f4955df7a05a05a8746d7821e25bc9974f08c3f568fec87e8f45c08d1f9
    • Instruction Fuzzy Hash: 55F096B5645749BBFB11BFF09D49EBB7E5CAB04714F080840FA08AE1D2C27185A08761
    Function 033F8694 Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON
    Download Yara Rule
    APIs
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,?,033F8114), ref: 033F86BB
    • GetDesktopWindow.USER32 ref: 033F86D2
    • GetDC.USER32(00000000), ref: 033F86D9
    • GetTextExtentPointW.GDI32(00000000,?,033F8114), ref: 033F86E0
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentFormatMessagePointTextWindow
    • String ID:
    • API String ID: 2513662917-0
    • Opcode ID: f9c68a14843f2aa92cb8ee6034390662f11b82af14d0102b9696152927b55dbc
    • Instruction ID: f699bc55e0a711c33377c75185fc6aac32a31bdf2d045c8a93012768b922e4c9
    • Opcode Fuzzy Hash: f9c68a14843f2aa92cb8ee6034390662f11b82af14d0102b9696152927b55dbc
    • Instruction Fuzzy Hash: 1EF082B1685748BEFB00BBF0AD49F7A7B9C9B04615F4C8845F70CAD1C2C57582908724
    Function 033DD613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prologXinvalid_argumentstd::_
    • String ID: NDEkzAepEGOKPahJWoW
    • API String ID: 4014091808-2683528191
    • Opcode ID: 992fa8e9900bf0d242ee08b4b822c4c637ad94640f5f4b17d9b57d3fb3295d90
    • Instruction ID: f76c92008e768f19dda50a701d9d7653f3b71bc89117498de08a30de9a56c1c2
    • Opcode Fuzzy Hash: 992fa8e9900bf0d242ee08b4b822c4c637ad94640f5f4b17d9b57d3fb3295d90
    • Instruction Fuzzy Hash: 81615436A00245DFCB11DF19E8C4A69BBE9EF49314F19C49AE8198F362C771EC51CB90
    Function 033D6605 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 033D672E
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: a97dae764d24fb611ad1d4d4bb2b59fa8e4c78596dc4e8a6a3c079f37e57448d
    • Instruction ID: b0d057d02343d09c4e3ed6616d42d312dcd5748d1f200b97260e1c52c594fd70
    • Opcode Fuzzy Hash: a97dae764d24fb611ad1d4d4bb2b59fa8e4c78596dc4e8a6a3c079f37e57448d
    • Instruction Fuzzy Hash: 62419236A10209DFCB24DF5CE8C589AB3FAFF44744750452EE862CB611DB30E915CBA1
    Function 033E70C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 033E70C5
    • std::_Xinvalid_argument.LIBCPMT ref: 033E7118
      • Part of subcall function 033F8863: std::exception::exception.LIBCMT ref: 033F8876
      • Part of subcall function 033F8863: __CxxThrowException@8.LIBCMT ref: 033F888B
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Exception@8H_prologThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 935663214-3797114014
    • Opcode ID: 3c04fd9fe51ceddd7f5696c2f0d4e3401671d1adab19ea5689b38ca365f43c9f
    • Instruction ID: 6d28c04f82b5ef39ede95ca8f72c84f0d6b623bd1cd2bfa897dbabf8a63a17b1
    • Opcode Fuzzy Hash: 3c04fd9fe51ceddd7f5696c2f0d4e3401671d1adab19ea5689b38ca365f43c9f
    • Instruction Fuzzy Hash: 934180B6E0031AAFDF05DF68CD859ADFBAAFF48310F10451AF9159B290DB719920CB90
    Function 033D673E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 033D67E9
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: bc76276a7787a6242971ab1d4b0a71a2f3496cfb6fb9b535a13b3cfd91af1154
    • Instruction ID: b776ccd4fa6b2950cbc27b5811c7feaff2c0e082686f2e2800f38a9a91703fce
    • Opcode Fuzzy Hash: bc76276a7787a6242971ab1d4b0a71a2f3496cfb6fb9b535a13b3cfd91af1154
    • Instruction Fuzzy Hash: 0F11AF3AB103099FC724DE68E8C585AB7ADFF80B50760092EF4628B641DB30E959C7A0
    Function 033C4476 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 033C4521
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: cbcfb756c4aa8705f462025187135687ac3664fd1c0618b31fd572b94dea1753
    • Instruction ID: 3d61a6f678f1276c6396841db0a68468f2e593d2ddb9889857d5134375c2f643
    • Opcode Fuzzy Hash: cbcfb756c4aa8705f462025187135687ac3664fd1c0618b31fd572b94dea1753
    • Instruction Fuzzy Hash: 7A11DF387203449BC735DE5EC8D099AB7B9EF80750B244A2EE4568B645DB31EC45C7A0
    Function 033E777C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 033E781C
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: 39bf66872b3ce262139b2b2f9143e14b7de839184ec4f60ea3076c7270cceee0
    • Instruction ID: 01e9c7fd662d1cc175f3d136aefb09e509d71ec8e0896c95ec49a1b325cb25bd
    • Opcode Fuzzy Hash: 39bf66872b3ce262139b2b2f9143e14b7de839184ec4f60ea3076c7270cceee0
    • Instruction Fuzzy Hash: E311BE38710329AFC728DE6CDCC096AB7A9BF45711710092EF925CB690CB30ED59CBA1
    Function 033D6487 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 033D6527
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: e3345935a57b416c840877f35c3481a2f209ba36ed3e8a5dea6e3189d8fa4eea
    • Instruction ID: ba4b6add1542f157e5aeb1ddce8b859602e9881a0afa2e3d4ff4dc5359bf13ab
    • Opcode Fuzzy Hash: e3345935a57b416c840877f35c3481a2f209ba36ed3e8a5dea6e3189d8fa4eea
    • Instruction Fuzzy Hash: F011D63AB107199FC724DF6CE8D095AB7BABF44710790093DE526CB641C730E9A5CB90
    Function 033D7A37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID: null$true
    • API String ID: 3519838083-1304502921
    • Opcode ID: ccacedeebe91629fb868d038bf78476f9e17023289e87e3659bbf2cf1972c9cd
    • Instruction ID: b011c67730be5bdcacf12527dcacaa8ae494d7e323b2f31e1bf1f00930f012c1
    • Opcode Fuzzy Hash: ccacedeebe91629fb868d038bf78476f9e17023289e87e3659bbf2cf1972c9cd
    • Instruction Fuzzy Hash: 61014075E44318BADB14DA95CC89FDFBF7CEF49B64F004115B508BA281C7749604C7A1
    Function 033C315C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • _Allocate.LIBCPMT ref: 033C3182
    • std::_Xinvalid_argument.LIBCPMT ref: 033C31A1
      • Part of subcall function 033F8863: std::exception::exception.LIBCMT ref: 033F8876
      • Part of subcall function 033F8863: __CxxThrowException@8.LIBCMT ref: 033F888B
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 2227214630-3797114014
    • Opcode ID: f27958892ac2fb3823f58a163c08c51e1e459b204101e9807e458b22f1a68223
    • Instruction ID: e71c9af23be665cf3d53049b5e772dcac6051e592b2598da288f08a19da8f21d
    • Opcode Fuzzy Hash: f27958892ac2fb3823f58a163c08c51e1e459b204101e9807e458b22f1a68223
    • Instruction Fuzzy Hash: E9F0E57A504745AF8724EF29D88046BB7ECDE46630328C83FD5A9C7640E730E8418B64
    Function 033C31A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33memoryCOMMON
    Download Yara Rule
    APIs
    • _Allocate.LIBCPMT ref: 033C31CD
    • std::_Xinvalid_argument.LIBCPMT ref: 033C31EC
      • Part of subcall function 033F8863: std::exception::exception.LIBCMT ref: 033F8876
      • Part of subcall function 033F8863: __CxxThrowException@8.LIBCMT ref: 033F888B
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 2227214630-3797114014
    • Opcode ID: 5200a255b01213f7febe9ce01a89abcfeb3952fcc9f2bc230d5bce9e0cac5a52
    • Instruction ID: 2555e82cea6a340a961c3513df2b9ae8cfca4b8cd0abaca1edea1b9839c788ba
    • Opcode Fuzzy Hash: 5200a255b01213f7febe9ce01a89abcfeb3952fcc9f2bc230d5bce9e0cac5a52
    • Instruction Fuzzy Hash: 8FF0E57A914745AF8320EF29D880867BBECEE45630324C83FD5E9C7640EB36A8414BA0
    Function 033D6A47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33memoryCOMMON
    Download Yara Rule
    APIs
    • _Allocate.LIBCPMT ref: 033D6A6A
    • std::_Xinvalid_argument.LIBCPMT ref: 033D6A88
      • Part of subcall function 033F8863: std::exception::exception.LIBCMT ref: 033F8876
      • Part of subcall function 033F8863: __CxxThrowException@8.LIBCMT ref: 033F888B
    Strings
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 2227214630-3797114014
    • Opcode ID: a0b0c9ec81b54794f300422ec817507ad53323a65021db58cb1241c51e1cf0e0
    • Instruction ID: 3ae0b98b12841037f1b6d5ee2226fd83855048a3bab58456b1414f8772216409
    • Opcode Fuzzy Hash: a0b0c9ec81b54794f300422ec817507ad53323a65021db58cb1241c51e1cf0e0
    • Instruction Fuzzy Hash: F1F0E5B76007056F8320DF69E881567F7ECDA85670328C93FD5F8C7740E630A44147A4
    Function 033FD3CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
    Download Yara Rule
    APIs
    • __CxxThrowException@8.LIBCMT ref: 033FD3B6
      • Part of subcall function 033F9254: RaiseException.KERNEL32(?,?,033F8890,033E18DB,00000003,?,?,?,?,?,033F8890,033E18DB,03418A94,00000003), ref: 033F92A9
    • std::bad_exception::bad_exception.LIBCMT ref: 033FD3DD
      • Part of subcall function 033FBC44: std::bad_exception::bad_exception.LIBCMT ref: 033FBC4D
    Strings
    • VzGQCIbqrdwuIsGHNdRpxKtwJdXpetLf, xrefs: 033FD3D5
    Memory Dump Source
    • Source File: 00000003.00000002.2224073636.00000000033C1000.00000020.00001000.00020000.00000000.sdmp, Offset: 033C0000, based on PE: true
    • Associated: 00000003.00000002.2224041712.00000000033C0000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224113401.000000000340E000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000003.00000002.2224137402.000000000341A000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_3_2_33c0000_rundll32.jbxd
    Similarity
    • API ID: std::bad_exception::bad_exception$ExceptionException@8RaiseThrow
    • String ID: VzGQCIbqrdwuIsGHNdRpxKtwJdXpetLf
    • API String ID: 1432139112-2565811093
    • Opcode ID: 41024437ec6ad25b4b55fd14f1655ffdb612a5cf648eeefcf1e7e2362dc3ad77
    • Instruction ID: 88df3766c8099a179e2918e1b9ecdf96de68651cba9112d81bc23dc4f317959b
    • Opcode Fuzzy Hash: 41024437ec6ad25b4b55fd14f1655ffdb612a5cf648eeefcf1e7e2362dc3ad77
    • Instruction Fuzzy Hash: FFE01275E00208DFCF04DBA0C881BEEB7B4AB05302F550055E612BB554D774A954CF55

    Execution Graph

    Execution Coverage:0.7%
    Dynamic/Decrypted Code Coverage:100%
    Signature Coverage:0%
    Total number of Nodes:444
    Total number of Limit Nodes:3
    execution_graph 1629 5540e47 1630 5540e5e TlsGetValue 1629->1630 1631 5540e5a 1629->1631 1160 55433b0 1161 55433e7 1160->1161 1162 55433da 1160->1162 1163 553e753 __crtGetLocaleInfoA_stat 6 API calls 1161->1163 1204 553e753 1162->1204 1167 55433f7 __except_handler4 1163->1167 1165 554350f 1166 55434c4 __except_handler4 1166->1165 1168 55434ff 1166->1168 1169 553e753 __crtGetLocaleInfoA_stat 6 API calls 1166->1169 1167->1165 1167->1166 1172 554344e __IsNonwritableInCurrentImage 1167->1172 1170 553e753 __crtGetLocaleInfoA_stat 6 API calls 1168->1170 1169->1168 1170->1165 1211 5547492 RtlUnwind 1172->1211 1173 5543526 1175 553e753 __crtGetLocaleInfoA_stat 6 API calls 1173->1175 1174 554348c __except_handler4 1174->1173 1176 553e753 __crtGetLocaleInfoA_stat 6 API calls 1174->1176 1177 5543536 __except_handler4 1175->1177 1176->1173 1178 5543681 1177->1178 1179 554357b 1177->1179 1180 55436d4 1178->1180 1181 5543686 1178->1181 1213 554e1c6 1179->1213 1186 5542c29 __crtGetLocaleInfoA_stat 2 API calls 1180->1186 1203 554363c 1180->1203 1223 5542c29 1181->1223 1185 55435a8 GetLastError 1187 55435b7 1185->1187 1185->1203 1186->1203 1189 554e1c6 ___crtGetLocaleInfoA 47 API calls 1187->1189 1188 553e753 __crtGetLocaleInfoA_stat 6 API calls 1190 554364d 1188->1190 1198 55435cd 1189->1198 1191 5538bc4 _free 2 API calls 1191->1203 1192 5543695 1195 5542c29 __crtGetLocaleInfoA_stat 2 API calls 1192->1195 1196 55436be 1192->1196 1193 554362e 1193->1203 1218 5538bc4 1193->1218 1195->1196 1196->1191 1196->1203 1197 5543712 1200 554e1c6 ___crtGetLocaleInfoA 47 API calls 1198->1200 1198->1203 1199 5543651 __except_handler4 1199->1197 1201 5538bc4 _free 2 API calls 1199->1201 1199->1203 1202 554360f 1200->1202 1201->1203 1202->1193 1202->1199 1203->1188 1205 553e75b 1204->1205 1206 553e75d IsProcessorFeaturePresent 1204->1206 1205->1161 1208 554bb3e 1206->1208 1227 554baed IsDebuggerPresent 1208->1227 1212 55474a6 1211->1212 1212->1174 1235 553ca16 1213->1235 1219 5538bcd HeapFree 1218->1219 1222 5538bf6 _free 1218->1222 1220 5538be2 1219->1220 1219->1222 1221 5538be8 GetLastError 1220->1221 1221->1222 1222->1203 1224 5542c45 GetLocaleInfoEx 1223->1224 1225 5542c49 __crtGetLocaleInfoA_stat 1223->1225 1224->1192 1226 5542c4e GetLocaleInfoW 1225->1226 1226->1192 1228 554bb02 ___raise_securityfailure 1227->1228 1233 55411a4 SetUnhandledExceptionFilter UnhandledExceptionFilter 1228->1233 1231 554bb0a ___raise_securityfailure 1234 554118f GetCurrentProcess TerminateProcess 1231->1234 1232 554bb27 1232->1161 1233->1231 1234->1232 1236 553ca27 1235->1236 1242 553ca74 1235->1242 1254 554452e 1236->1254 1239 553ca54 1239->1242 1271 5549b58 1239->1271 1243 554e0e2 1242->1243 1244 5542c29 __crtGetLocaleInfoA_stat 2 API calls 1243->1244 1247 554e10e __crtGetLocaleInfoA_stat 1244->1247 1245 554e117 1246 553e753 __crtGetLocaleInfoA_stat 6 API calls 1245->1246 1248 554359b 1246->1248 1247->1245 1249 5542c29 __crtGetLocaleInfoA_stat 2 API calls 1247->1249 1248->1185 1248->1202 1250 554e182 1249->1250 1251 554e1a9 1250->1251 1253 554e19a WideCharToMultiByte 1250->1253 1625 5540879 1251->1625 1253->1251 1255 5544534 1254->1255 1257 553ca2d 1255->1257 1281 554308a 1255->1281 1257->1239 1258 5546ee3 1257->1258 1259 5546eef _doexit 1258->1259 1260 554452e _LocaleUpdate::_LocaleUpdate 42 API calls 1259->1260 1261 5546ef8 1260->1261 1262 5546f27 1261->1262 1263 5546f0b 1261->1263 1367 5546f63 1262->1367 1264 554452e _LocaleUpdate::_LocaleUpdate 42 API calls 1263->1264 1267 5546f10 1264->1267 1268 5546f1e _doexit 1267->1268 1270 554308a _LocaleUpdate::_LocaleUpdate 42 API calls 1267->1270 1268->1239 1270->1268 1272 5549b64 _doexit 1271->1272 1273 554452e _LocaleUpdate::_LocaleUpdate 42 API calls 1272->1273 1278 5549b6e 1273->1278 1274 5549b80 1275 5549b8e _doexit 1274->1275 1277 554308a _LocaleUpdate::_LocaleUpdate 42 API calls 1274->1277 1275->1242 1277->1275 1278->1274 1279 5538bc4 _free 2 API calls 1278->1279 1280 5549bcb 1278->1280 1279->1280 1621 5549bf5 1280->1621 1290 5546a3a 1281->1290 1289 55430b1 1289->1257 1294 5546a41 __FF_MSGBANNER 1290->1294 1291 5546a97 __NMSG_WRITE 31 API calls 1292 5546a66 1291->1292 1295 5546a97 __NMSG_WRITE 31 API calls 1292->1295 1293 5543092 1296 5546a97 1293->1296 1294->1291 1294->1293 1295->1293 1301 5546ab5 __FF_MSGBANNER __NMSG_WRITE 1296->1301 1297 5546bdc 1298 553e753 __crtGetLocaleInfoA_stat 6 API calls 1297->1298 1299 554309a 1298->1299 1309 5543139 1299->1309 1300 5546be1 GetStdHandle 1300->1297 1302 5546bef _strlen 1300->1302 1301->1297 1301->1300 1304 5546aeb __NMSG_WRITE 1301->1304 1302->1297 1303 5546c28 WriteFile 1302->1303 1303->1297 1304->1297 1305 5546b18 GetModuleFileNameW 1304->1305 1306 5546c49 1304->1306 1307 5546b38 __NMSG_WRITE 1305->1307 1307->1306 1330 554f0ef EncodePointer 1307->1330 1310 55431ef _doexit 11 API calls 1309->1310 1311 55430a5 1310->1311 1312 55431ef 1311->1312 1313 55431fb _doexit 1312->1313 1314 55432bb __initterm 1313->1314 1315 5543230 DecodePointer 1313->1315 1355 5543309 1314->1355 1315->1314 1317 5543247 DecodePointer 1315->1317 1323 5543257 1317->1323 1319 5543318 _doexit 1319->1289 1321 5543264 EncodePointer 1321->1323 1322 5543300 1360 5542f67 1322->1360 1323->1314 1323->1321 1325 5543274 DecodePointer EncodePointer 1323->1325 1328 5543286 DecodePointer DecodePointer 1325->1328 1328->1323 1331 554f123 ___crtIsPackagedApp 1330->1331 1332 554f1e2 IsDebuggerPresent 1331->1332 1333 554f132 LoadLibraryExW 1331->1333 1334 554f207 1332->1334 1335 554f1ec 1332->1335 1336 554f16f GetProcAddress 1333->1336 1337 554f149 GetLastError 1333->1337 1341 554f1fa 1334->1341 1342 554f20c DecodePointer 1334->1342 1340 554f1f3 OutputDebugStringW 1335->1340 1335->1341 1339 554f183 7 API calls 1336->1339 1345 554f1ff 1336->1345 1338 554f158 LoadLibraryExW 1337->1338 1337->1345 1338->1336 1338->1345 1343 554f1df 1339->1343 1344 554f1cb GetProcAddress EncodePointer 1339->1344 1340->1341 1341->1345 1348 554f233 DecodePointer DecodePointer 1341->1348 1352 554f24b 1341->1352 1342->1345 1343->1332 1344->1343 1346 553e753 __crtGetLocaleInfoA_stat 6 API calls 1345->1346 1350 554f2d1 1346->1350 1347 554f283 DecodePointer 1351 554f28a 1347->1351 1354 554f26f DecodePointer 1347->1354 1348->1352 1350->1297 1353 554f29b DecodePointer 1351->1353 1351->1354 1352->1347 1352->1354 1353->1354 1354->1345 1356 55432e9 1355->1356 1357 554330f 1355->1357 1356->1319 1359 553f7c4 LeaveCriticalSection 1356->1359 1363 553f7c4 LeaveCriticalSection 1357->1363 1359->1322 1364 5542f33 GetModuleHandleExW 1360->1364 1363->1356 1365 5542f5e ExitProcess 1364->1365 1366 5542f4c GetProcAddress 1364->1366 1366->1365 1368 5546f6e ___addlocaleref ___removelocaleref 1367->1368 1370 5546f42 1367->1370 1368->1370 1374 5546ce9 1368->1374 1371 5546f5a 1370->1371 1620 553f7c4 LeaveCriticalSection 1371->1620 1373 5546f61 1373->1267 1376 5546d62 1374->1376 1381 5546cfe 1374->1381 1375 5546daf 1398 5546dd8 1375->1398 1444 554f9df 1375->1444 1376->1375 1377 5538bc4 _free 2 API calls 1376->1377 1378 5546d83 1377->1378 1382 5538bc4 _free 2 API calls 1378->1382 1380 5546d2f 1383 5546d4d 1380->1383 1393 5538bc4 _free 2 API calls 1380->1393 1381->1376 1381->1380 1386 5538bc4 _free 2 API calls 1381->1386 1388 5546d96 1382->1388 1389 5538bc4 _free 2 API calls 1383->1389 1385 5538bc4 _free 2 API calls 1385->1398 1390 5546d24 1386->1390 1387 5546e37 1391 5538bc4 _free 2 API calls 1387->1391 1392 5538bc4 _free 2 API calls 1388->1392 1394 5546d57 1389->1394 1404 554f2d5 1390->1404 1396 5546e3d 1391->1396 1397 5546da4 1392->1397 1399 5546d42 1393->1399 1400 5538bc4 _free 2 API calls 1394->1400 1396->1370 1401 5538bc4 _free 2 API calls 1397->1401 1398->1387 1402 5538bc4 HeapFree GetLastError _free 1398->1402 1432 554f772 1399->1432 1400->1376 1401->1375 1402->1398 1405 554f2e4 1404->1405 1431 554f3cd 1404->1431 1406 554f2f5 1405->1406 1407 5538bc4 _free 2 API calls 1405->1407 1408 554f307 1406->1408 1410 5538bc4 _free 2 API calls 1406->1410 1407->1406 1409 554f319 1408->1409 1411 5538bc4 _free 2 API calls 1408->1411 1412 554f32b 1409->1412 1413 5538bc4 _free 2 API calls 1409->1413 1410->1408 1411->1409 1414 554f33d 1412->1414 1415 5538bc4 _free 2 API calls 1412->1415 1413->1412 1416 554f34f 1414->1416 1418 5538bc4 _free 2 API calls 1414->1418 1415->1414 1417 554f361 1416->1417 1419 5538bc4 _free 2 API calls 1416->1419 1420 554f373 1417->1420 1421 5538bc4 _free 2 API calls 1417->1421 1418->1416 1419->1417 1422 5538bc4 _free 2 API calls 1420->1422 1425 554f385 1420->1425 1421->1420 1422->1425 1423 554f397 1424 554f3a9 1423->1424 1427 5538bc4 _free 2 API calls 1423->1427 1428 554f3bb 1424->1428 1429 5538bc4 _free 2 API calls 1424->1429 1425->1423 1426 5538bc4 _free 2 API calls 1425->1426 1426->1423 1427->1424 1430 5538bc4 _free 2 API calls 1428->1430 1428->1431 1429->1428 1430->1431 1431->1380 1433 554f77d 1432->1433 1443 554f7d5 1432->1443 1434 554f78d 1433->1434 1435 5538bc4 _free 2 API calls 1433->1435 1436 554f79f 1434->1436 1437 5538bc4 _free 2 API calls 1434->1437 1435->1434 1438 554f7b1 1436->1438 1439 5538bc4 _free 2 API calls 1436->1439 1437->1436 1440 554f7c3 1438->1440 1441 5538bc4 _free 2 API calls 1438->1441 1439->1438 1442 5538bc4 _free 2 API calls 1440->1442 1440->1443 1441->1440 1442->1443 1443->1383 1445 554f9ee 1444->1445 1619 5546dcd 1444->1619 1446 5538bc4 _free 2 API calls 1445->1446 1447 554f9f6 1446->1447 1448 5538bc4 _free 2 API calls 1447->1448 1449 554f9fe 1448->1449 1450 5538bc4 _free 2 API calls 1449->1450 1451 554fa06 1450->1451 1452 5538bc4 _free 2 API calls 1451->1452 1453 554fa0e 1452->1453 1454 5538bc4 _free 2 API calls 1453->1454 1455 554fa16 1454->1455 1456 5538bc4 _free 2 API calls 1455->1456 1457 554fa1e 1456->1457 1458 5538bc4 _free 2 API calls 1457->1458 1459 554fa25 1458->1459 1460 5538bc4 _free 2 API calls 1459->1460 1461 554fa2d 1460->1461 1462 5538bc4 _free 2 API calls 1461->1462 1463 554fa35 1462->1463 1464 5538bc4 _free 2 API calls 1463->1464 1465 554fa3d 1464->1465 1466 5538bc4 _free 2 API calls 1465->1466 1467 554fa45 1466->1467 1468 5538bc4 _free 2 API calls 1467->1468 1469 554fa4d 1468->1469 1470 5538bc4 _free 2 API calls 1469->1470 1471 554fa55 1470->1471 1472 5538bc4 _free 2 API calls 1471->1472 1473 554fa5d 1472->1473 1474 5538bc4 _free 2 API calls 1473->1474 1475 554fa65 1474->1475 1476 5538bc4 _free 2 API calls 1475->1476 1477 554fa6d 1476->1477 1478 5538bc4 _free 2 API calls 1477->1478 1479 554fa78 1478->1479 1480 5538bc4 _free 2 API calls 1479->1480 1481 554fa80 1480->1481 1482 5538bc4 _free 2 API calls 1481->1482 1483 554fa88 1482->1483 1484 5538bc4 _free 2 API calls 1483->1484 1485 554fa90 1484->1485 1486 5538bc4 _free 2 API calls 1485->1486 1487 554fa98 1486->1487 1488 5538bc4 _free 2 API calls 1487->1488 1489 554faa0 1488->1489 1490 5538bc4 _free 2 API calls 1489->1490 1491 554faa8 1490->1491 1492 5538bc4 _free 2 API calls 1491->1492 1493 554fab0 1492->1493 1494 5538bc4 _free 2 API calls 1493->1494 1495 554fab8 1494->1495 1496 5538bc4 _free 2 API calls 1495->1496 1497 554fac0 1496->1497 1498 5538bc4 _free 2 API calls 1497->1498 1499 554fac8 1498->1499 1500 5538bc4 _free 2 API calls 1499->1500 1501 554fad0 1500->1501 1502 5538bc4 _free 2 API calls 1501->1502 1503 554fad8 1502->1503 1504 5538bc4 _free 2 API calls 1503->1504 1505 554fae0 1504->1505 1506 5538bc4 _free 2 API calls 1505->1506 1507 554fae8 1506->1507 1508 5538bc4 _free 2 API calls 1507->1508 1509 554faf0 1508->1509 1510 5538bc4 _free 2 API calls 1509->1510 1511 554fafe 1510->1511 1512 5538bc4 _free 2 API calls 1511->1512 1513 554fb09 1512->1513 1514 5538bc4 _free 2 API calls 1513->1514 1515 554fb14 1514->1515 1516 5538bc4 _free 2 API calls 1515->1516 1517 554fb1f 1516->1517 1518 5538bc4 _free 2 API calls 1517->1518 1519 554fb2a 1518->1519 1520 5538bc4 _free 2 API calls 1519->1520 1521 554fb35 1520->1521 1522 5538bc4 _free 2 API calls 1521->1522 1523 554fb40 1522->1523 1524 5538bc4 _free 2 API calls 1523->1524 1525 554fb4b 1524->1525 1526 5538bc4 _free 2 API calls 1525->1526 1527 554fb56 1526->1527 1528 5538bc4 _free 2 API calls 1527->1528 1529 554fb61 1528->1529 1530 5538bc4 _free 2 API calls 1529->1530 1531 554fb6c 1530->1531 1532 5538bc4 _free 2 API calls 1531->1532 1533 554fb77 1532->1533 1534 5538bc4 _free 2 API calls 1533->1534 1535 554fb82 1534->1535 1536 5538bc4 _free 2 API calls 1535->1536 1537 554fb8d 1536->1537 1538 5538bc4 _free 2 API calls 1537->1538 1539 554fb98 1538->1539 1540 5538bc4 _free 2 API calls 1539->1540 1541 554fba3 1540->1541 1542 5538bc4 _free 2 API calls 1541->1542 1543 554fbb1 1542->1543 1544 5538bc4 _free 2 API calls 1543->1544 1545 554fbbc 1544->1545 1546 5538bc4 _free 2 API calls 1545->1546 1547 554fbc7 1546->1547 1548 5538bc4 _free 2 API calls 1547->1548 1549 554fbd2 1548->1549 1550 5538bc4 _free 2 API calls 1549->1550 1551 554fbdd 1550->1551 1552 5538bc4 _free 2 API calls 1551->1552 1553 554fbe8 1552->1553 1554 5538bc4 _free 2 API calls 1553->1554 1555 554fbf3 1554->1555 1556 5538bc4 _free 2 API calls 1555->1556 1557 554fbfe 1556->1557 1558 5538bc4 _free 2 API calls 1557->1558 1559 554fc09 1558->1559 1560 5538bc4 _free 2 API calls 1559->1560 1561 554fc14 1560->1561 1562 5538bc4 _free 2 API calls 1561->1562 1563 554fc1f 1562->1563 1564 5538bc4 _free 2 API calls 1563->1564 1565 554fc2a 1564->1565 1566 5538bc4 _free 2 API calls 1565->1566 1567 554fc35 1566->1567 1568 5538bc4 _free 2 API calls 1567->1568 1569 554fc40 1568->1569 1570 5538bc4 _free 2 API calls 1569->1570 1571 554fc4b 1570->1571 1572 5538bc4 _free 2 API calls 1571->1572 1573 554fc56 1572->1573 1574 5538bc4 _free 2 API calls 1573->1574 1575 554fc64 1574->1575 1576 5538bc4 _free 2 API calls 1575->1576 1577 554fc6f 1576->1577 1578 5538bc4 _free 2 API calls 1577->1578 1579 554fc7a 1578->1579 1580 5538bc4 _free 2 API calls 1579->1580 1581 554fc85 1580->1581 1582 5538bc4 _free 2 API calls 1581->1582 1583 554fc90 1582->1583 1584 5538bc4 _free 2 API calls 1583->1584 1585 554fc9b 1584->1585 1586 5538bc4 _free 2 API calls 1585->1586 1587 554fca6 1586->1587 1588 5538bc4 _free 2 API calls 1587->1588 1589 554fcb1 1588->1589 1590 5538bc4 _free 2 API calls 1589->1590 1591 554fcbc 1590->1591 1592 5538bc4 _free 2 API calls 1591->1592 1593 554fcc7 1592->1593 1594 5538bc4 _free 2 API calls 1593->1594 1595 554fcd2 1594->1595 1596 5538bc4 _free 2 API calls 1595->1596 1597 554fcdd 1596->1597 1598 5538bc4 _free 2 API calls 1597->1598 1599 554fce8 1598->1599 1600 5538bc4 _free 2 API calls 1599->1600 1601 554fcf3 1600->1601 1602 5538bc4 _free 2 API calls 1601->1602 1603 554fcfe 1602->1603 1604 5538bc4 _free 2 API calls 1603->1604 1605 554fd09 1604->1605 1606 5538bc4 _free 2 API calls 1605->1606 1607 554fd17 1606->1607 1608 5538bc4 _free 2 API calls 1607->1608 1609 554fd22 1608->1609 1610 5538bc4 _free 2 API calls 1609->1610 1611 554fd2d 1610->1611 1612 5538bc4 _free 2 API calls 1611->1612 1613 554fd38 1612->1613 1614 5538bc4 _free 2 API calls 1613->1614 1615 554fd43 1614->1615 1616 5538bc4 _free 2 API calls 1615->1616 1617 554fd4e 1616->1617 1618 5538bc4 _free 2 API calls 1617->1618 1618->1619 1619->1385 1620->1373 1624 553f7c4 LeaveCriticalSection 1621->1624 1623 5549bfc 1623->1274 1624->1623 1626 5540883 1625->1626 1628 5540894 1625->1628 1627 5538bc4 _free 2 API calls 1626->1627 1626->1628 1627->1628 1628->1245 1632 5547400 1633 5547412 1632->1633 1635 5547420 @_EH4_CallFilterFunc@8 1632->1635 1634 553e753 __crtGetLocaleInfoA_stat 6 API calls 1633->1634 1634->1635 1636 5523828 1637 5523843 std::exception::exception 1636->1637 1650 553e762 1637->1650 1639 5523858 Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception 1640 553e762 __CxxThrowException@8 RaiseException 1639->1640 1641 552387c 1640->1641 1642 553e762 __CxxThrowException@8 RaiseException 1641->1642 1643 55238aa 1642->1643 1644 553e762 __CxxThrowException@8 RaiseException 1643->1644 1645 55238d8 Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception 1644->1645 1646 553e762 __CxxThrowException@8 RaiseException 1645->1646 1647 55238f8 1646->1647 1648 553e762 __CxxThrowException@8 RaiseException 1647->1648 1649 5523926 1648->1649 1652 553e781 RaiseException 1650->1652 1652->1639 1156 5542c29 1157 5542c45 GetLocaleInfoEx 1156->1157 1158 5542c49 __crtGetLocaleInfoA_stat 1156->1158 1159 5542c4e GetLocaleInfoW 1158->1159

    Callgraph

    • Executed
    • Not Executed
    • Opacity -> Relevance
    • Disassembly available
    callgraph 0 Function_0553E753 41 Function_0554BAED 0->41 1 Function_05546C54 2 Function_0554F2D5 14 Function_05538BC4 2->14 3 Function_0554D3D6 4 Function_05543350 5 Function_0553F7D9 5->4 27 Function_0553E8F5 5->27 47 Function_05543395 5->47 6 Function_0554F9DF 6->14 7 Function_05549B58 7->4 7->14 21 Function_05549BF5 7->21 7->47 68 Function_0554308A 7->68 80 Function_0554452E 7->80 8 Function_05546F5A 15 Function_0553F7C4 8->15 9 Function_05479348 10 Function_0554E1C6 38 Function_0554E0E2 10->38 49 Function_0553CA16 10->49 11 Function_05540E47 12 Function_0554D440 13 Function_0554DF40 23 Function_0554DEF0 13->23 61 Function_0554E000 13->61 45 Function_05538EEE 14->45 16 Function_05546E43 17 Function_055392C9 18 Function_05483552 36 Function_0548357C 18->36 19 Function_054351D9 20 Function_05452DD8 21->15 22 Function_05547370 31 Function_05550FE5 22->31 55 Function_05551004 22->55 24 Function_055564F0 25 Function_0554EFF1 26 Function_0554F772 26->14 28 Function_05546A73 29 Function_05547479 29->31 30 Function_05540879 30->14 32 Function_054F3DFE 33 Function_0553E762 34 Function_05542B65 35 Function_05542F67 71 Function_05542F33 35->71 37 Function_05547462 38->0 38->12 38->30 82 Function_05542C29 38->82 39 Function_05546F63 39->1 39->16 46 Function_05546CE9 39->46 40 Function_05546EE3 40->4 40->8 40->39 40->47 40->68 40->80 60 Function_0554E200 41->60 65 Function_0554118F 41->65 75 Function_055411A4 41->75 42 Function_05523768 43 Function_0554F0EF 43->0 69 Function_05540EB6 43->69 44 Function_055431EF 44->4 44->15 44->35 44->47 57 Function_05543185 44->57 67 Function_05543309 44->67 46->2 46->6 46->14 46->26 48 Function_05546A97 48->0 48->3 48->25 48->28 48->43 56 Function_0554EF85 48->56 58 Function_05538C00 48->58 63 Function_05538C8B 48->63 81 Function_0554F0AF 48->81 49->7 49->40 49->80 50 Function_05547492 51 Function_05565610 52 Function_0543510B 53 Function_05433C0E 52->53 54 Function_0545A50B 59 Function_05539307 62 Function_05547400 62->0 62->22 64 Function_05523708 64->42 66 Function_0548DE94 66->18 66->19 67->15 68->44 68->48 73 Function_05543139 68->73 74 Function_05546A3A 68->74 70 Function_055433B0 70->0 70->10 70->13 70->14 70->29 70->37 70->50 72 Function_0554E03E 70->72 70->82 83 Function_055474AB 70->83 73->44 74->48 74->81 76 Function_055474A6 77 Function_054449B0 78 Function_0553F1A6 79 Function_05523828 79->17 79->33 79->59 79->64 80->68 82->34 83->22

    Executed Functions

    Function 05542C29 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE
    Download Yara Rule

    Control-flow Graph

    APIs
    • GetLocaleInfoEx.KERNELBASE(?,?,00000002,?,?,055436FA,?,?,?,00000002,?,?,?), ref: 05542C45
    • GetLocaleInfoW.KERNEL32(00000000,?,00000002,?,?,055436FA,?,?,?,00000002,?,?,?), ref: 05542C50
    Memory Dump Source
    • Source File: 00000004.00000002.2222899587.0000000005421000.00000020.00001000.00020000.00000000.sdmp, Offset: 05420000, based on PE: true
    • Associated: 00000004.00000002.2222881843.0000000005420000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000004.00000002.2223020055.000000000557A000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000004.00000002.2223457756.00000000059ED000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000004.00000002.2223482203.00000000059EF000.00000040.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_4_2_5420000_rundll32.jbxd
    Similarity
    • API ID: InfoLocale
    • String ID:
    • API String ID: 2299586839-0
    • Opcode ID: 826b54ae92500ec36698c75b96a888e57edca56e5c6f3628d65a8c2ae31257f6
    • Instruction ID: 28fe9d2828e21f2d718f95ce9ff27c0aa8139e8ac87689d6b257e1a19b891355
    • Opcode Fuzzy Hash: 826b54ae92500ec36698c75b96a888e57edca56e5c6f3628d65a8c2ae31257f6
    • Instruction Fuzzy Hash: 8DD0623641411DBF8F059FD0F806C6A3F69FB4C254F044405F51845110DA32A5209B55

    Execution Graph

    Execution Coverage:5.1%
    Dynamic/Decrypted Code Coverage:100%
    Signature Coverage:0%
    Total number of Nodes:1603
    Total number of Limit Nodes:57
    execution_graph 45210 4d98ebb 45235 4d98ed5 Mailbox 45210->45235 45211 4d9a1a9 45314 4d71868 45211->45314 45214 4d9a210 45317 4d9ac9b 45214->45317 45218 4daca22 85 API calls _fseek 45218->45235 45219 4d9a244 Mailbox 45227 4d96eae 59 API calls 45227->45235 45228 4d717a1 59 API calls 45228->45235 45229 4d77c6d 59 API calls 45229->45235 45230 4d9b820 59 API calls 45230->45235 45231 4d8e3b4 59 API calls 45231->45235 45235->45211 45235->45218 45235->45227 45235->45228 45235->45229 45235->45230 45235->45231 45239 4d9b587 85 API calls 45235->45239 45240 4d9a2a8 45235->45240 45243 4d77c9c 45235->45243 45247 4d96ffc 45235->45247 45250 4d96fd5 45235->45250 45253 4dace35 45235->45253 45266 4d85c51 45235->45266 45273 4dac8e7 45235->45273 45276 4d849d0 45235->45276 45280 4dad30d 45235->45280 45287 4d9741f 45235->45287 45290 4d904f7 45235->45290 45298 4d96eff 59 API calls __EH_prolog 45235->45298 45299 4d96f6a 59 API calls __EH_prolog 45235->45299 45300 4d908ac 65 API calls 45235->45300 45301 4d9b30e 61 API calls __EH_prolog 45235->45301 45302 4d9750b 59 API calls __EH_prolog 45235->45302 45303 4d9b42f 63 API calls __EH_prolog 45235->45303 45304 4d9b108 45235->45304 45239->45235 45294 4d90391 45240->45294 45244 4d77cba char_traits 45243->45244 45321 4d780e1 45244->45321 45246 4d77cc6 45246->45235 45330 4d97a2b 45247->45330 45249 4d97014 45249->45235 45430 4d9777c 45250->45430 45252 4d96fec 45252->45235 45254 4dace41 __initptd 45253->45254 45255 4dace68 45254->45255 45256 4dace53 45254->45256 45442 4db3959 45255->45442 45477 4dabf95 58 API calls __getptd_noexit 45256->45477 45260 4dace58 45478 4db0efc 9 API calls __write_nolock 45260->45478 45265 4dace63 __initptd 45265->45235 45267 4d85c60 45266->45267 45268 4d85c94 45266->45268 45585 4d73749 45267->45585 45592 4da8863 59 API calls 2 library calls 45268->45592 45272 4d85c68 45272->45235 45595 4dac902 45273->45595 45275 4dac8fd 45275->45235 45277 4d849de 45276->45277 45278 4d849e2 45276->45278 45277->45235 45692 4d848bf 115 API calls 2 library calls 45278->45692 45282 4dad319 FindCompleteObject FindMITargetTypeInstance __initptd FindVITargetTypeInstance 45280->45282 45281 4dad320 PMDtoOffset __initptd 45281->45235 45282->45281 45693 4dabc7a 58 API calls std::exception::exception 45282->45693 45284 4dad3ad 45694 4da9254 RaiseException 45284->45694 45286 4dad3bb 45286->45235 45695 4d970c0 45287->45695 45289 4d97446 45289->45235 45291 4d90501 __EH_prolog 45290->45291 45710 4d717a1 45291->45710 45293 4d90556 45293->45235 45295 4d9039a 45294->45295 45728 4d9172d 45295->45728 45298->45235 45299->45235 45300->45235 45301->45235 45302->45235 45303->45235 45305 4d9b111 45304->45305 45306 4d9b155 45304->45306 45307 4d9b133 45305->45307 45308 4d9b117 45305->45308 45737 4d9b53d 85 API calls 45306->45737 45311 4d9b165 45307->45311 45312 4d9b13d GetDesktopWindow GetDC DrawFocusRect 45307->45312 45736 4d97822 59 API calls 45308->45736 45311->45235 45312->45235 45313 4d9b126 45313->45235 45738 4d7315c 45314->45738 45316 4d71883 Mailbox 45316->45214 45318 4d9aca4 45317->45318 45320 4d9acaa 45317->45320 45319 4d9acd9 SetLastError 45318->45319 45318->45320 45319->45219 45320->45219 45322 4d780f1 45321->45322 45323 4d780f5 45322->45323 45324 4d78113 45322->45324 45328 4d73c34 59 API calls 45323->45328 45329 4d737ac 59 API calls std::_Xinvalid_argument 45324->45329 45327 4d78111 45327->45246 45328->45327 45329->45327 45331 4d97b59 45330->45331 45423 4da8891 45331->45423 45333 4d97b63 __EH_prolog 45334 4d97bbd 45333->45334 45335 4d9b42f 63 API calls 45333->45335 45336 4d9b108 88 API calls 45334->45336 45335->45334 45337 4d97be6 45336->45337 45338 4d9aedf GetDesktopWindow SetDlgItemTextW 45337->45338 45339 4d97bef 45338->45339 45340 4d71868 Mailbox 59 API calls 45339->45340 45343 4d97c9a Mailbox 45340->45343 45341 4d713c5 59 API calls 45341->45343 45342 4d9b1f1 89 API calls 45342->45343 45343->45341 45343->45342 45344 4d97dcd Mailbox 45343->45344 45345 4d713c5 59 API calls 45344->45345 45346 4d97ff1 Mailbox 45345->45346 45347 4d77c6d 59 API calls 45346->45347 45348 4d982a2 45347->45348 45349 4d9ad1c 74 API calls 45348->45349 45350 4d982ea 45348->45350 45349->45350 45351 4d983b5 ExtCreateRegion 45350->45351 45352 4d983c7 45350->45352 45351->45350 45353 4d77c9c 59 API calls 45352->45353 45354 4d98481 45353->45354 45355 4d71868 Mailbox 59 API calls 45354->45355 45356 4d9849f Mailbox 45355->45356 45357 4d77c6d 59 API calls 45356->45357 45358 4d98563 45357->45358 45359 4d71868 Mailbox 59 API calls 45358->45359 45360 4d98574 45359->45360 45361 4d71868 Mailbox 59 API calls 45360->45361 45362 4d98585 45361->45362 45363 4d9af12 GetFileSize VariantClear 45362->45363 45364 4d985bd 45363->45364 45365 4d9ac9b SetLastError 45364->45365 45369 4d9860b Mailbox 45365->45369 45366 4d71868 Mailbox 59 API calls 45366->45369 45367 4d9b4d2 90 API calls 45367->45369 45368 4d9b255 89 API calls 45368->45369 45369->45366 45369->45367 45369->45368 45370 4d98769 Mailbox 45369->45370 45371 4d77c6d 59 API calls 45370->45371 45372 4d98806 45371->45372 45373 4d9b255 89 API calls 45372->45373 45374 4d9b4d2 90 API calls 45372->45374 45375 4d98882 45372->45375 45373->45372 45374->45372 45376 4d71868 Mailbox 59 API calls 45375->45376 45377 4d9897b 45376->45377 45378 4d9a56f 63 API calls 45377->45378 45379 4d989a4 45378->45379 45380 4d9ae82 87 API calls 45379->45380 45381 4d98a4b Mailbox 45379->45381 45380->45379 45382 4d71868 Mailbox 59 API calls 45381->45382 45386 4d98b38 Mailbox 45382->45386 45383 4d71868 Mailbox 59 API calls 45383->45386 45384 4d98beb Mailbox 45385 4d77c6d 59 API calls 45384->45385 45387 4d98c9f 45385->45387 45386->45383 45386->45384 45386->45386 45388 4d71868 Mailbox 59 API calls 45387->45388 45389 4d98d27 Mailbox 45388->45389 45390 4d9a56f 63 API calls 45389->45390 45418 4d98e87 Mailbox 45390->45418 45391 4d9a1a9 45392 4d71868 Mailbox 59 API calls 45391->45392 45394 4d9a210 45392->45394 45393 4d77c9c 59 API calls 45393->45418 45395 4d9ac9b SetLastError 45394->45395 45422 4d9a244 Mailbox 45395->45422 45396 4d96ffc 185 API calls 45396->45418 45397 4d96fd5 59 API calls 45397->45418 45398 4dace35 69 API calls 45398->45418 45399 4daca22 85 API calls _fseek 45399->45418 45400 4d85c51 59 API calls 45400->45418 45401 4dac8e7 __fread_nolock 62 API calls 45401->45418 45402 4d849d0 115 API calls 45402->45418 45403 4dad30d 59 API calls 45403->45418 45404 4d9741f 59 API calls 45404->45418 45405 4d96eff 59 API calls 45405->45418 45406 4d96eae 59 API calls 45406->45418 45407 4d9b820 59 API calls 45407->45418 45408 4d717a1 59 API calls 45408->45418 45409 4d77c6d 59 API calls 45409->45418 45410 4d8e3b4 59 API calls 45410->45418 45411 4d96f6a 59 API calls 45411->45418 45412 4d9750b 59 API calls 45412->45418 45413 4d908ac 65 API calls 45413->45418 45414 4d904f7 59 API calls 45414->45418 45415 4d9b42f 63 API calls 45415->45418 45416 4d9b30e 61 API calls 45416->45418 45417 4d9b587 85 API calls 45417->45418 45418->45391 45418->45393 45418->45396 45418->45397 45418->45398 45418->45399 45418->45400 45418->45401 45418->45402 45418->45403 45418->45404 45418->45405 45418->45406 45418->45407 45418->45408 45418->45409 45418->45410 45418->45411 45418->45412 45418->45413 45418->45414 45418->45415 45418->45416 45418->45417 45419 4d9a2a8 45418->45419 45420 4d9b108 88 API calls 45418->45420 45421 4d90391 59 API calls 45419->45421 45420->45418 45421->45422 45422->45249 45428 4dabccd 58 API calls std::exception::_Copy_str 45423->45428 45425 4da88a9 45429 4da9254 RaiseException 45425->45429 45427 4da88be 45428->45425 45429->45427 45431 4d9780d 45430->45431 45432 4d97791 45430->45432 45434 4da8891 59 API calls 45431->45434 45433 4d97817 45432->45433 45435 4d977aa 45432->45435 45441 4da8863 59 API calls 2 library calls 45433->45441 45434->45433 45439 4d977bb 45435->45439 45440 4d737ac 59 API calls std::_Xinvalid_argument 45435->45440 45439->45252 45440->45439 45443 4db398b EnterCriticalSection 45442->45443 45444 4db3969 45442->45444 45447 4dace6e 45443->45447 45444->45443 45445 4db3971 45444->45445 45480 4db6073 45445->45480 45448 4dacaa5 45447->45448 45449 4dacab2 __write_nolock 45448->45449 45450 4dacaca 45449->45450 45451 4dacae2 45449->45451 45524 4dabf95 58 API calls __getptd_noexit 45450->45524 45489 4db3895 45451->45489 45454 4dacacf 45525 4db0efc 9 API calls __write_nolock 45454->45525 45456 4dacaea 45496 4db47b0 45456->45496 45458 4dacb06 45461 4dacb89 45458->45461 45462 4daccf6 45458->45462 45475 4dacada 45458->45475 45460 4dace31 45479 4dace99 LeaveCriticalSection LeaveCriticalSection _fseek 45460->45479 45464 4dacbaf 45461->45464 45468 4daccb2 45461->45468 45463 4daccff 45462->45463 45462->45468 45527 4dabf95 58 API calls __getptd_noexit 45463->45527 45464->45475 45526 4db4946 62 API calls 5 library calls 45464->45526 45467 4dacbe8 45470 4dacc14 ReadFile 45467->45470 45467->45475 45469 4db47b0 __write 64 API calls 45468->45469 45468->45475 45471 4dacd63 45469->45471 45472 4dacc39 45470->45472 45470->45475 45473 4db47b0 __write 64 API calls 45471->45473 45471->45475 45474 4db47b0 __write 64 API calls 45472->45474 45473->45475 45476 4dacc4c 45474->45476 45528 4dad80b 6 API calls ___raise_securityfailure 45475->45528 45476->45475 45477->45260 45478->45265 45479->45265 45481 4db6097 EnterCriticalSection 45480->45481 45482 4db6084 45480->45482 45481->45447 45487 4db60fb 58 API calls 8 library calls 45482->45487 45484 4db608a 45484->45481 45488 4daea3b 58 API calls 3 library calls 45484->45488 45487->45484 45490 4db389f 45489->45490 45491 4db38b4 45489->45491 45529 4dabf95 58 API calls __getptd_noexit 45490->45529 45491->45456 45493 4db38a4 45530 4db0efc 9 API calls __write_nolock 45493->45530 45495 4db38af 45495->45456 45497 4db47bc __initptd 45496->45497 45498 4db47c9 45497->45498 45499 4db47e0 45497->45499 45553 4dabf61 58 API calls __getptd_noexit 45498->45553 45500 4db487f 45499->45500 45502 4db47f4 45499->45502 45559 4dabf61 58 API calls __getptd_noexit 45500->45559 45505 4db481c 45502->45505 45506 4db4812 45502->45506 45504 4db47ce 45554 4dabf95 58 API calls __getptd_noexit 45504->45554 45531 4db86bf 45505->45531 45555 4dabf61 58 API calls __getptd_noexit 45506->45555 45510 4db4817 45560 4dabf95 58 API calls __getptd_noexit 45510->45560 45511 4db4822 45513 4db4848 45511->45513 45514 4db4835 45511->45514 45556 4dabf95 58 API calls __getptd_noexit 45513->45556 45540 4db489f 45514->45540 45515 4db488b 45561 4db0efc 9 API calls __write_nolock 45515->45561 45519 4db4841 45558 4db4877 LeaveCriticalSection __unlock_fhandle 45519->45558 45520 4db484d 45557 4dabf61 58 API calls __getptd_noexit 45520->45557 45521 4db47d5 __initptd 45521->45458 45524->45454 45525->45475 45526->45467 45527->45475 45528->45460 45529->45493 45530->45495 45532 4db86cb __initptd 45531->45532 45533 4db871a EnterCriticalSection 45532->45533 45534 4db6073 __lock 58 API calls 45532->45534 45535 4db8740 __initptd 45533->45535 45536 4db86f0 45534->45536 45535->45511 45539 4db8708 45536->45539 45562 4db5938 InitializeCriticalSectionAndSpinCount 45536->45562 45563 4db8744 LeaveCriticalSection _doexit 45539->45563 45564 4db897c 45540->45564 45542 4db48b0 45543 4db48b8 45542->45543 45544 4db48c7 SetFilePointerEx 45542->45544 45577 4dabf95 58 API calls __getptd_noexit 45543->45577 45546 4db48df SetFilePointerEx 45544->45546 45547 4db48f3 GetLastError 45544->45547 45546->45547 45548 4db4902 45546->45548 45578 4dabf74 58 API calls 2 library calls 45547->45578 45550 4db4908 SetFilePointerEx 45548->45550 45551 4db48bd 45548->45551 45579 4dabf95 58 API calls __getptd_noexit 45550->45579 45551->45519 45553->45504 45554->45521 45555->45510 45556->45520 45557->45519 45558->45521 45559->45510 45560->45515 45561->45521 45562->45539 45563->45533 45565 4db899c 45564->45565 45566 4db8987 45564->45566 45570 4db89c1 45565->45570 45582 4dabf61 58 API calls __getptd_noexit 45565->45582 45580 4dabf61 58 API calls __getptd_noexit 45566->45580 45569 4db898c 45581 4dabf95 58 API calls __getptd_noexit 45569->45581 45570->45542 45571 4db89cb 45583 4dabf95 58 API calls __getptd_noexit 45571->45583 45573 4db8994 45573->45542 45575 4db89d3 45584 4db0efc 9 API calls __write_nolock 45575->45584 45577->45551 45578->45551 45579->45551 45580->45569 45581->45573 45582->45571 45583->45575 45584->45573 45586 4d73755 45585->45586 45587 4d737a1 45585->45587 45591 4d73763 Mailbox 45586->45591 45593 4d734a1 59 API calls 4 library calls 45586->45593 45594 4da8863 59 API calls 2 library calls 45587->45594 45591->45272 45593->45591 45596 4dac90e __initptd 45595->45596 45597 4dac951 45596->45597 45598 4dac949 __initptd 45596->45598 45602 4dac924 _memset 45596->45602 45599 4db3959 __lock_file 59 API calls 45597->45599 45598->45275 45601 4dac957 45599->45601 45608 4dac722 45601->45608 45621 4dabf95 58 API calls __getptd_noexit 45602->45621 45603 4dac93e 45622 4db0efc 9 API calls __write_nolock 45603->45622 45611 4dac73d _memset 45608->45611 45614 4dac758 45608->45614 45609 4dac748 45644 4dabf95 58 API calls __getptd_noexit 45609->45644 45611->45609 45611->45614 45618 4dac798 45611->45618 45623 4dac98b LeaveCriticalSection LeaveCriticalSection _fseek 45614->45623 45615 4dac8a9 _memset 45647 4dabf95 58 API calls __getptd_noexit 45615->45647 45616 4db3895 __fseek_nolock 58 API calls 45616->45618 45618->45614 45618->45615 45618->45616 45624 4db3d6b 45618->45624 45646 4db3e8c 58 API calls 3 library calls 45618->45646 45620 4dac74d 45645 4db0efc 9 API calls __write_nolock 45620->45645 45621->45603 45622->45598 45623->45598 45625 4db3d76 45624->45625 45628 4db3d8b 45624->45628 45678 4dabf95 58 API calls __getptd_noexit 45625->45678 45627 4db3d7b 45679 4db0efc 9 API calls __write_nolock 45627->45679 45630 4db3dc0 45628->45630 45638 4db3d86 45628->45638 45680 4db77c9 58 API calls __malloc_crt 45628->45680 45632 4db3895 __fseek_nolock 58 API calls 45630->45632 45633 4db3dd4 45632->45633 45648 4db3f0b 45633->45648 45635 4db3ddb 45636 4db3895 __fseek_nolock 58 API calls 45635->45636 45635->45638 45637 4db3dfe 45636->45637 45637->45638 45639 4db3895 __fseek_nolock 58 API calls 45637->45639 45638->45618 45640 4db3e0a 45639->45640 45640->45638 45641 4db3895 __fseek_nolock 58 API calls 45640->45641 45642 4db3e17 45641->45642 45643 4db3895 __fseek_nolock 58 API calls 45642->45643 45643->45638 45644->45620 45645->45614 45646->45618 45647->45620 45649 4db3f17 __initptd 45648->45649 45650 4db3f3b 45649->45650 45651 4db3f24 45649->45651 45652 4db3fff 45650->45652 45654 4db3f4f 45650->45654 45681 4dabf61 58 API calls __getptd_noexit 45651->45681 45689 4dabf61 58 API calls __getptd_noexit 45652->45689 45657 4db3f7a 45654->45657 45658 4db3f6d 45654->45658 45656 4db3f29 45682 4dabf95 58 API calls __getptd_noexit 45656->45682 45661 4db3f9c 45657->45661 45662 4db3f87 45657->45662 45683 4dabf61 58 API calls __getptd_noexit 45658->45683 45665 4db86bf ___lock_fhandle 59 API calls 45661->45665 45684 4dabf61 58 API calls __getptd_noexit 45662->45684 45663 4db3f72 45690 4dabf95 58 API calls __getptd_noexit 45663->45690 45668 4db3fa2 45665->45668 45667 4db3f8c 45685 4dabf95 58 API calls __getptd_noexit 45667->45685 45675 4db3fb5 45668->45675 45686 4dabf95 58 API calls __getptd_noexit 45668->45686 45669 4db3f94 45691 4db0efc 9 API calls __write_nolock 45669->45691 45670 4db3f30 __initptd 45670->45635 45674 4db3fcd 45687 4dabf61 58 API calls __getptd_noexit 45674->45687 45688 4db3ff7 LeaveCriticalSection __unlock_fhandle 45675->45688 45678->45627 45679->45638 45680->45630 45681->45656 45682->45670 45683->45663 45684->45667 45685->45669 45686->45674 45687->45675 45688->45670 45689->45663 45690->45669 45691->45670 45692->45277 45693->45284 45694->45286 45696 4d970ca __EH_prolog 45695->45696 45697 4d97101 45696->45697 45698 4d971d2 45696->45698 45705 4d97163 45696->45705 45699 4d9711d 45697->45699 45706 4da8863 59 API calls 2 library calls 45697->45706 45709 4d97307 59 API calls __EH_prolog 45698->45709 45707 4d809f6 59 API calls 3 library calls 45699->45707 45703 4d97132 45708 4d97307 59 API calls __EH_prolog 45703->45708 45705->45289 45707->45703 45708->45705 45709->45705 45713 4d73a93 45710->45713 45712 4d717c0 45712->45293 45714 4d73b1c 45713->45714 45715 4d73aa8 45713->45715 45716 4da8891 59 API calls 45714->45716 45717 4d73ab5 45715->45717 45718 4d73acc 45715->45718 45720 4d73b26 45716->45720 45725 4d73eff 59 API calls 45717->45725 45727 4d736e6 59 API calls std::_Xinvalid_argument 45718->45727 45722 4d73abd 45726 4d73e7d 59 API calls _memmove 45722->45726 45724 4d73aca _memmove 45724->45712 45725->45722 45726->45724 45727->45724 45729 4d9176d 45728->45729 45730 4d9173c 45728->45730 45735 4d915d5 59 API calls 2 library calls 45729->45735 45734 4d73e7d 59 API calls _memmove 45730->45734 45733 4d903be 45733->45219 45734->45733 45735->45733 45736->45313 45737->45311 45739 4d73174 45738->45739 45740 4d73178 45738->45740 45739->45316 45741 4d73180 45740->45741 45742 4d7319c 45740->45742 45746 4d8d594 45741->45746 45752 4da8863 59 API calls 2 library calls 45742->45752 45747 4d8d5a0 45746->45747 45748 4d8d5b0 std::exception::exception 45746->45748 45747->45748 45753 4da8a6d 45747->45753 45748->45739 45761 4da9254 RaiseException 45748->45761 45751 4da8862 45754 4da8a75 45753->45754 45756 4da8a8f 45754->45756 45758 4da8a93 std::exception::exception 45754->45758 45762 4dac44c 45754->45762 45779 4dae8b1 DecodePointer 45754->45779 45756->45748 45780 4da9254 RaiseException 45758->45780 45760 4da8abd 45761->45751 45763 4dac4c7 45762->45763 45768 4dac458 45762->45768 45787 4dae8b1 DecodePointer 45763->45787 45765 4dac463 45765->45768 45781 4db345d 58 API calls __NMSG_WRITE 45765->45781 45782 4db34ba 58 API calls 5 library calls 45765->45782 45783 4dae918 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 45765->45783 45766 4dac4cd 45788 4dabf95 58 API calls __getptd_noexit 45766->45788 45768->45765 45770 4dac48b RtlAllocateHeap 45768->45770 45773 4dac4b3 45768->45773 45777 4dac4b1 45768->45777 45784 4dae8b1 DecodePointer 45768->45784 45770->45768 45772 4dac4bf 45770->45772 45772->45754 45785 4dabf95 58 API calls __getptd_noexit 45773->45785 45786 4dabf95 58 API calls __getptd_noexit 45777->45786 45779->45754 45780->45760 45781->45765 45782->45765 45784->45768 45785->45777 45786->45772 45787->45766 45788->45772 45789 4d925bb 45791 4d925c5 __EH_prolog 45789->45791 45798 4d92647 45791->45798 45842 4d93353 LookupPrivilegeValueW GetDesktopWindow GetDC DrawFocusRect 45791->45842 45843 4d93cce 13 API calls 45791->45843 45793 4d92716 45823 4d9373a 45793->45823 45795 4d92720 45796 4d71868 Mailbox 59 API calls 45795->45796 45797 4d92736 45796->45797 45830 4d9368f 45797->45830 45798->45793 45844 4d93a16 61 API calls 45798->45844 45801 4d92752 45802 4d927a5 Mailbox 45801->45802 45803 4d9368f 63 API calls 45801->45803 45836 4d93f6e 45802->45836 45803->45801 45805 4d92832 45806 4d71868 Mailbox 59 API calls 45805->45806 45808 4d92892 Mailbox 45806->45808 45807 4d71868 Mailbox 59 API calls 45807->45808 45808->45807 45810 4d9293b 45808->45810 45809 4d71868 Mailbox 59 API calls 45811 4d92de1 45809->45811 45818 4d929db Mailbox 45810->45818 45845 4d93353 LookupPrivilegeValueW GetDesktopWindow GetDC DrawFocusRect 45810->45845 45849 4d9389a LookupPrivilegeValueW GetDesktopWindow GetDC DrawFocusRect GetOverlappedResult 45811->45849 45813 4d92afc 45848 4d93d77 70 API calls 45813->45848 45816 4d92b14 45817 4d71868 Mailbox 59 API calls 45816->45817 45822 4d92b7d Mailbox 45817->45822 45818->45813 45818->45822 45846 4d93d77 70 API calls 45818->45846 45847 4d939ad 6 API calls 45818->45847 45821 4d92e21 Mailbox 45822->45809 45824 4d93778 45823->45824 45825 4d93743 45823->45825 45850 4d937d6 8 API calls 45824->45850 45826 4d93749 45825->45826 45827 4d9375d GetDesktopWindow SetDlgItemInt 45825->45827 45826->45795 45827->45795 45829 4d9377f 45829->45795 45831 4d936d8 45830->45831 45832 4d93698 45830->45832 45851 4d93827 61 API calls 45831->45851 45834 4d9369e GetDesktopWindow SetDlgItemTextW 45832->45834 45835 4d936b4 45832->45835 45834->45801 45835->45801 45835->45835 45837 4d93f78 __EH_prolog 45836->45837 45852 4d95b6b 45837->45852 45839 4d93fb3 45870 4d806c7 45839->45870 45841 4d93fc2 45841->45805 45842->45791 45843->45791 45844->45798 45845->45810 45846->45818 45847->45818 45848->45816 45849->45821 45850->45829 45851->45835 45853 4d95b75 __EH_prolog 45852->45853 45854 4d95c82 45853->45854 45855 4d95b84 45853->45855 45888 4d95435 62 API calls 45854->45888 45856 4d95b8f 45855->45856 45857 4d95c65 GetDesktopWindow GetDC GetTextExtentPoint32W 45855->45857 45859 4d95bc0 45856->45859 45876 4da8bee 45856->45876 45869 4d95be2 45857->45869 45861 4d95bc9 45859->45861 45862 4d95be7 45859->45862 45861->45869 45879 4d73b27 45861->45879 45873 4d9402b 45862->45873 45867 4d95c22 45868 4d73b27 59 API calls 45867->45868 45867->45869 45868->45869 45869->45839 45871 4d73b27 59 API calls 45870->45871 45872 4d806e6 45871->45872 45872->45841 45889 4d94bdd 45873->45889 46082 4da8af2 45876->46082 45878 4da8bf9 45878->45859 45880 4d73bb0 45879->45880 45881 4da8891 59 API calls 45880->45881 45882 4d73bba 45881->45882 45883 4d73beb 45882->45883 45885 4d73b27 59 API calls 45882->45885 45884 4d73749 59 API calls 45883->45884 45886 4d73bf9 _memmove 45884->45886 45885->45883 45886->45869 45887 4d93fe9 150 API calls 45887->45867 45888->45869 45890 4d94be7 __EH_prolog 45889->45890 45891 4d94bfa 45890->45891 45892 4d953f2 45890->45892 45893 4d953e8 RegUnLoadKeyW 45891->45893 45894 4d94c05 45891->45894 45895 4d9541e EndMenu 45892->45895 45897 4d9404e 45892->45897 45893->45897 45896 4d71868 Mailbox 59 API calls 45894->45896 45895->45897 45901 4d94c63 Mailbox 45896->45901 45897->45869 45897->45887 45898 4d71868 Mailbox 59 API calls 45898->45901 45899 4d94db8 Mailbox 45902 4d71868 Mailbox 59 API calls 45899->45902 45900 4d94bdd 148 API calls 45900->45901 45901->45898 45901->45900 45903 4d94d26 45901->45903 45904 4d94e5d 45902->45904 45903->45899 45965 4d95f1f 150 API calls 45903->45965 45928 4d95dd0 45904->45928 45907 4d94e86 45934 4d96824 45907->45934 45909 4d94ea7 Mailbox 45941 4d942fc 45909->45941 45911 4d9501f 45919 4d95071 45911->45919 45948 4d93f47 45911->45948 45912 4d94f8e 45912->45911 45913 4d942fc 148 API calls 45912->45913 45966 4d95f8e 150 API calls 45912->45966 45913->45912 45916 4d71868 Mailbox 59 API calls 45926 4d950f0 Mailbox 45916->45926 45919->45916 45922 4d953ad 45962 4d94058 45922->45962 45925 4d95264 45958 4d95483 45925->45958 45951 4d95ece 45926->45951 45929 4d95dd9 45928->45929 45930 4d95e27 45928->45930 45932 4d95e0e GetDesktopWindow SetWindowLongW 45929->45932 45933 4d95ddf 45929->45933 45969 4d95da7 150 API calls 45930->45969 45932->45907 45933->45907 45935 4d9683b 45934->45935 45936 4d9682d 45934->45936 45938 4d96891 VariantClear 45935->45938 45939 4d96841 45935->45939 45970 4d9454c 150 API calls 45936->45970 45938->45909 45939->45909 45940 4d96837 45940->45909 45942 4d94309 45941->45942 45943 4d94394 45941->45943 45944 4d9430f QueryDosDeviceW 45942->45944 45947 4d94320 45942->45947 45971 4d944d4 150 API calls 45943->45971 45944->45912 45946 4d943b0 45946->45912 45947->45912 45972 4d95b40 45948->45972 45952 4d95f08 45951->45952 45953 4d95ed7 45951->45953 46016 4d95528 61 API calls 45952->46016 45954 4d95edd 45953->45954 45955 4d95ee7 FormatMessageW 45953->45955 45954->45925 45955->45925 45957 4d95f1a 45957->45925 45959 4d954d8 45958->45959 45961 4d9548c 45958->45961 45960 4d954e6 GetDesktopWindow GetDC DrawFocusRect 45959->45960 45959->45961 45960->45922 45961->45922 46017 4d9600c 45962->46017 45964 4d94078 45964->45897 45968 4d95f8e 150 API calls 45964->45968 45965->45903 45966->45912 45967 4d93eb9 150 API calls __EH_prolog 45967->45919 45968->45897 45969->45933 45970->45940 45971->45946 45975 4d94590 45972->45975 45974 4d93f64 45974->45919 45974->45967 45976 4d9459a __EH_prolog 45975->45976 45977 4d945ac 45976->45977 45978 4d94b4e 45976->45978 45980 4d71868 Mailbox 59 API calls 45977->45980 46008 4d945b2 45977->46008 46015 4d94527 150 API calls 45978->46015 45981 4d945da 45980->45981 45982 4d95483 3 API calls 45981->45982 45983 4d9460c 45982->45983 45984 4d95483 3 API calls 45983->45984 45985 4d94661 45983->45985 45984->45983 45986 4d9467f GetDesktopWindow GetDC GetTextExtentPointW 45985->45986 45995 4d946ab Mailbox 45985->45995 45986->45985 45987 4d94765 45989 4d9479b 45987->45989 45990 4d947c0 45987->45990 45988 4d9470e GetSysColorBrush 45988->45995 45998 4d947be 45989->45998 46010 4d95e79 76 API calls 45989->46010 46011 4d95e39 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW SetLastError 45990->46011 45993 4d947d0 45993->45998 46012 4d95f1f 150 API calls 45993->46012 45995->45987 45995->45988 45997 4d95ece 62 API calls 45995->45997 46009 4d95fc5 65 API calls 45995->46009 45997->45995 45999 4d71868 Mailbox 59 API calls 45998->45999 46002 4d94834 45999->46002 46000 4d94abb 46003 4d94ad6 46000->46003 46014 4d9454c 150 API calls 46000->46014 46001 4d94a4c Mailbox 46001->46000 46001->46008 46013 4d9689b 62 API calls _abort 46001->46013 46002->46001 46004 4d94bdd 146 API calls 46002->46004 46006 4d95483 3 API calls 46003->46006 46004->46002 46006->46008 46008->45974 46009->45995 46010->45998 46011->45993 46012->45998 46013->46000 46014->46003 46015->46008 46016->45957 46018 4d96016 __EH_prolog 46017->46018 46019 4d96656 46018->46019 46026 4d96029 46018->46026 46020 4d9666c GetFileSize 46019->46020 46021 4d9665e ExtCreateRegion 46019->46021 46022 4d960b5 Mailbox 46020->46022 46021->46022 46022->45964 46023 4d960ae 46023->46022 46025 4d71868 Mailbox 59 API calls 46023->46025 46024 4d9555e 62 API calls 46024->46026 46027 4d960cd 46025->46027 46026->46022 46026->46023 46026->46024 46029 4d9600c 147 API calls 46026->46029 46057 4d9555e 46027->46057 46029->46026 46031 4d960f4 46033 4d96156 Mailbox 46031->46033 46073 4d95da7 150 API calls 46031->46073 46074 4d95fc5 65 API calls 46031->46074 46033->46022 46034 4d71868 Mailbox 59 API calls 46033->46034 46035 4d961a7 46034->46035 46036 4d71868 Mailbox 59 API calls 46035->46036 46037 4d961ba 46036->46037 46064 4d94b73 46037->46064 46039 4d961ea 46041 4d96225 Mailbox 46039->46041 46075 4d95e39 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW SetLastError 46039->46075 46042 4d71868 Mailbox 59 API calls 46041->46042 46046 4d96366 Mailbox 46041->46046 46070 4d9456b 46041->46070 46042->46041 46044 4d963e6 46047 4d96406 GetVolumeInformationW 46044->46047 46046->46044 46048 4d94b73 147 API calls 46046->46048 46076 4d95f6e GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW 46046->46076 46047->46022 46055 4d96412 46047->46055 46048->46046 46049 4d964fa 46050 4d71868 Mailbox 59 API calls 46049->46050 46051 4d96512 46050->46051 46078 4d95ca7 61 API calls char_traits 46051->46078 46053 4d9654c 46053->46022 46079 4d95ca7 61 API calls char_traits 46053->46079 46055->46049 46077 4d943b5 150 API calls 46055->46077 46058 4d95580 46057->46058 46059 4d95567 46057->46059 46062 4d955b5 LookupPrivilegeValueW 46058->46062 46063 4d95586 46058->46063 46080 4d95528 61 API calls 46059->46080 46061 4d9557b 46061->46031 46062->46063 46063->46031 46063->46063 46065 4d94b7c 46064->46065 46066 4d94bc2 46064->46066 46068 4d94b8c ExtCreateRegion 46065->46068 46069 4d94b9b 46065->46069 46081 4d943db 150 API calls 46066->46081 46068->46039 46069->46039 46071 4d95dd0 150 API calls 46070->46071 46072 4d9458b 46071->46072 46072->46041 46073->46031 46074->46031 46075->46041 46076->46046 46077->46055 46078->46053 46079->46053 46080->46061 46081->46069 46083 4da8afe __initptd 46082->46083 46090 4daeb8e 46083->46090 46089 4da8b25 __initptd 46089->45878 46091 4db6073 __lock 58 API calls 46090->46091 46092 4da8b07 46091->46092 46093 4da8b36 DecodePointer DecodePointer 46092->46093 46094 4da8b63 46093->46094 46095 4da8b13 46093->46095 46094->46095 46107 4daeccf 59 API calls __write_nolock 46094->46107 46104 4da8b30 46095->46104 46097 4da8bc6 EncodePointer EncodePointer 46097->46095 46098 4da8b75 46098->46097 46099 4da8b9a 46098->46099 46108 4daed8f 61 API calls __realloc_crt 46098->46108 46099->46095 46102 4da8bb4 EncodePointer 46099->46102 46109 4daed8f 61 API calls __realloc_crt 46099->46109 46102->46097 46103 4da8bae 46103->46095 46103->46102 46110 4daeb97 46104->46110 46107->46098 46108->46099 46109->46103 46113 4db61dd LeaveCriticalSection 46110->46113 46112 4da8b35 46112->46089 46113->46112 46114 4d9237a 46115 4d92384 __EH_prolog 46114->46115 46117 4d9256d 46115->46117 46118 4d9b965 46115->46118 46121 4d9c786 46118->46121 46120 4d9b984 46120->46117 46122 4d9c790 __EH_prolog 46121->46122 46123 4d9f5e9 46122->46123 46124 4d9c7a1 46122->46124 46496 4d9bd76 GetFileSize 46123->46496 46126 4d9f5da ExtCreateRegion 46124->46126 46127 4d9c7ac 46124->46127 46146 4d9f5bf 46126->46146 46128 4d9c7da 46127->46128 46393 4d9babf 62 API calls __EH_prolog 46127->46393 46132 4d9c81f 46128->46132 46394 4d9c0bc GetDesktopWindow GetDC DrawFocusRect GetSysColorBrush 46128->46394 46131 4d9c8ef 46359 4d9fb8c 46131->46359 46132->46131 46395 4d9beaa GetFileSize 46132->46395 46134 4d9c917 46365 4d80c05 46134->46365 46137 4d9c928 46138 4d71868 Mailbox 59 API calls 46137->46138 46139 4d9c947 46138->46139 46371 4d9f8ab 46139->46371 46142 4d9c9a5 Mailbox 46143 4d9ca64 Mailbox 46142->46143 46376 4d713c5 46142->46376 46384 4da7da6 46143->46384 46146->46120 46147 4d713c5 59 API calls 46167 4d9cac8 Mailbox 46147->46167 46148 4d9cd73 Mailbox 46149 4d9cdd7 46148->46149 46156 4d9cde1 46148->46156 46398 4d9f68b 7 API calls 46149->46398 46151 4d71868 59 API calls Mailbox 46151->46167 46152 4d9cddf 46152->46156 46153 4d9ce83 46155 4d9ceb0 46153->46155 46158 4da8bee __cinit 67 API calls 46153->46158 46160 4d71868 Mailbox 59 API calls 46155->46160 46179 4d9f42e Mailbox 46155->46179 46156->46153 46161 4d9c786 197 API calls 46156->46161 46399 4d9f85f GetFileSize LookupPrivilegeValueW 46156->46399 46158->46155 46159 4d713c5 59 API calls 46159->46167 46162 4d9cecf 46160->46162 46161->46156 46400 4d9f719 8 API calls 46162->46400 46165 4d9cef1 46401 4d9bc9f SetLastError 46165->46401 46167->46148 46167->46151 46167->46159 46396 4d9c0bc GetDesktopWindow GetDC DrawFocusRect GetSysColorBrush 46167->46396 46397 4d9beaa GetFileSize 46167->46397 46169 4d9cf0f 46171 4d9cf67 Mailbox 46169->46171 46172 4d9cf4a GetOverlappedResult 46169->46172 46402 4d9f61e 10 API calls 46169->46402 46171->46171 46173 4d71868 Mailbox 59 API calls 46171->46173 46172->46169 46174 4d9cfeb 46173->46174 46176 4d71868 Mailbox 59 API calls 46174->46176 46178 4d9cffc 46176->46178 46403 4d9f956 66 API calls 46178->46403 46179->46146 46492 4d908ac 65 API calls 46179->46492 46493 4d9ba77 59 API calls 46179->46493 46494 4d9f85f GetFileSize LookupPrivilegeValueW 46179->46494 46495 4d9f956 66 API calls 46179->46495 46182 4d9d061 46187 4d9d08b Mailbox 46182->46187 46404 4d9bc9f SetLastError 46182->46404 46184 4d71868 Mailbox 59 API calls 46184->46187 46185 4d9d1cc GetDesktopWindow SetWindowLongW 46185->46187 46187->46184 46187->46185 46188 4d9d1f0 Mailbox 46187->46188 46405 4d9be07 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW GetSysColorBrush 46187->46405 46406 4d77c6d 46188->46406 46193 4d9d22d 46200 4d9d2d9 46193->46200 46411 4d9f7b0 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW GetSysColorBrush 46193->46411 46412 4d9c036 7 API calls 46193->46412 46196 4d9d3ac 46197 4d9d481 46196->46197 46414 4d9fa09 GetSysColorBrush 46196->46414 46198 4d71868 Mailbox 59 API calls 46197->46198 46201 4d9d49b 46198->46201 46200->46196 46413 4d9c036 7 API calls 46200->46413 46202 4d9d55b 46201->46202 46203 4d9d50e 46201->46203 46204 4d9d560 46202->46204 46207 4d9d559 Mailbox 46202->46207 46203->46207 46415 4d9f9b7 7 API calls 46203->46415 46204->46202 46416 4d9f68b 7 API calls 46204->46416 46208 4d77c6d 59 API calls 46207->46208 46209 4d9d591 46208->46209 46417 4d9fa89 59 API calls 46209->46417 46211 4d9d59d 46212 4d71868 Mailbox 59 API calls 46211->46212 46217 4d9d607 Mailbox 46212->46217 46213 4d71868 Mailbox 59 API calls 46213->46217 46214 4d9d6c6 Mailbox 46216 4d71868 Mailbox 59 API calls 46214->46216 46218 4d9d793 46216->46218 46217->46213 46217->46214 46217->46217 46418 4d9fa09 GetSysColorBrush 46217->46418 46419 4d9bc4d 7 API calls 46218->46419 46220 4d9d7b3 46420 4d9beaa GetFileSize 46220->46420 46222 4d9da25 46224 4d71868 Mailbox 59 API calls 46222->46224 46223 4d9d803 Mailbox 46223->46222 46421 4d9c20f 46223->46421 46453 4d9f7b0 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW GetSysColorBrush 46223->46453 46231 4d9db39 46224->46231 46227 4d9dcc6 Mailbox 46228 4d77c6d 59 API calls 46227->46228 46229 4d9dce3 46228->46229 46455 4d9fa89 59 API calls 46229->46455 46231->46227 46454 4d9bc9f SetLastError 46231->46454 46234 4d9df32 46235 4d77c6d 59 API calls 46234->46235 46236 4d9df4a 46235->46236 46457 4d9fa89 59 API calls 46236->46457 46237 4d9dcf2 46237->46234 46456 4d9be5c 87 API calls 46237->46456 46239 4d9df59 46239->46239 46240 4d77c6d 59 API calls 46239->46240 46241 4d9dfee 46240->46241 46458 4d9fa89 59 API calls 46241->46458 46243 4d9dffd 46244 4d77c6d 59 API calls 46243->46244 46245 4d9e093 46244->46245 46459 4d9fa89 59 API calls 46245->46459 46247 4d9e0a4 46247->46247 46248 4d77c6d 59 API calls 46247->46248 46249 4d9e127 46248->46249 46460 4d9fa89 59 API calls 46249->46460 46251 4d9e133 46251->46251 46252 4d77c6d 59 API calls 46251->46252 46253 4d9e1af 46252->46253 46461 4d9fa89 59 API calls 46253->46461 46255 4d9e1bb 46256 4d77c6d 59 API calls 46255->46256 46257 4d9e25c 46256->46257 46462 4d9fa89 59 API calls 46257->46462 46259 4d9e268 46261 4d9e348 46259->46261 46463 4d9bc9f SetLastError 46259->46463 46262 4d77c6d 59 API calls 46261->46262 46263 4d9e360 46262->46263 46464 4d9fa89 59 API calls 46263->46464 46265 4d9e36c 46266 4d77c6d 59 API calls 46265->46266 46267 4d9e425 46266->46267 46465 4d9fa89 59 API calls 46267->46465 46269 4d9e436 46270 4d77c6d 59 API calls 46269->46270 46271 4d9e518 46270->46271 46466 4d9fa89 59 API calls 46271->46466 46273 4d9e524 46274 4d77c6d 59 API calls 46273->46274 46275 4d9e5f9 46274->46275 46467 4d9fa89 59 API calls 46275->46467 46277 4d9e605 46278 4d77c6d 59 API calls 46277->46278 46279 4d9e6e4 46278->46279 46468 4d9fa89 59 API calls 46279->46468 46281 4d9e6f3 46282 4d77c6d 59 API calls 46281->46282 46283 4d9e7a2 46282->46283 46469 4d9fa89 59 API calls 46283->46469 46285 4d9e7b3 46287 4d9e8c2 46285->46287 46470 4d9beaa GetFileSize 46285->46470 46288 4d77c6d 59 API calls 46287->46288 46289 4d9e8da 46288->46289 46471 4d9fa89 59 API calls 46289->46471 46291 4d9e8eb 46293 4d9e9c5 46291->46293 46472 4d9be07 GetDesktopWindow GetDC DrawFocusRect LookupPrivilegeValueW GetSysColorBrush 46291->46472 46294 4d77c6d 59 API calls 46293->46294 46295 4d9e9dd 46294->46295 46473 4d9fa89 59 API calls 46295->46473 46297 4d9e9e9 46299 4d9ea97 46297->46299 46474 4d9bbf8 7 API calls 46297->46474 46300 4d77c6d 59 API calls 46299->46300 46301 4d9eaa9 46300->46301 46475 4d9fa89 59 API calls 46301->46475 46303 4d9eaba 46303->46303 46304 4d77c6d 59 API calls 46303->46304 46305 4d9eb48 46304->46305 46476 4d9fa89 59 API calls 46305->46476 46307 4d9eb54 46309 4d9ec20 46307->46309 46477 4d9f76f 7 API calls 46307->46477 46310 4d77c6d 59 API calls 46309->46310 46311 4d9ec38 46310->46311 46478 4d9fa89 59 API calls 46311->46478 46313 4d9ec44 46313->46313 46314 4d77c6d 59 API calls 46313->46314 46315 4d9ecea 46314->46315 46479 4d9fa89 59 API calls 46315->46479 46317 4d9ecf9 46318 4d77c6d 59 API calls 46317->46318 46319 4d9edb1 46318->46319 46480 4d9fa89 59 API calls 46319->46480 46321 4d9edc0 46323 4d9ee89 46321->46323 46481 4d9bc4d 7 API calls 46321->46481 46324 4d77c6d 59 API calls 46323->46324 46325 4d9eea1 46324->46325 46482 4d9fa89 59 API calls 46325->46482 46327 4d9eeb0 46328 4d77c6d 59 API calls 46327->46328 46329 4d9ef8f 46328->46329 46483 4d9fa89 59 API calls 46329->46483 46331 4d9ef9e 46333 4d9f06c 46331->46333 46484 4d9f80a 7 API calls 46331->46484 46334 4d77c6d 59 API calls 46333->46334 46335 4d9f084 46334->46335 46485 4d9fa89 59 API calls 46335->46485 46337 4d9f093 46338 4d77c6d 59 API calls 46337->46338 46339 4d9f141 46338->46339 46486 4d9fa89 59 API calls 46339->46486 46341 4d9f150 46343 4d9f217 46341->46343 46487 4d9f80a 7 API calls 46341->46487 46344 4d77c6d 59 API calls 46343->46344 46345 4d9f22f 46344->46345 46488 4d9fa89 59 API calls 46345->46488 46347 4d9f23e 46347->46347 46348 4d77c6d 59 API calls 46347->46348 46349 4d9f2db 46348->46349 46489 4d9fa89 59 API calls 46349->46489 46351 4d9f2ea 46351->46351 46352 4d77c6d 59 API calls 46351->46352 46353 4d9f363 46352->46353 46490 4d9fa89 59 API calls 46353->46490 46355 4d9f374 46356 4d77c6d 59 API calls 46355->46356 46357 4d9f422 46356->46357 46491 4d9fa89 59 API calls 46357->46491 46360 4d9fb96 __EH_prolog 46359->46360 46497 4d9f83d 46360->46497 46364 4d9fbd9 46364->46134 46366 4d80c0f __EH_prolog 46365->46366 46367 4d80b8a 59 API calls 46366->46367 46368 4d80c1e 46367->46368 46369 4d80c43 46368->46369 46524 4d8189c 59 API calls 46368->46524 46369->46137 46372 4d9f8b4 46371->46372 46375 4d9f8c8 46371->46375 46525 4d9c1f7 7 API calls 46372->46525 46374 4d9f8c3 46374->46142 46375->46142 46377 4d713de 46376->46377 46382 4d7141c _Ucopy 46376->46382 46378 4d71405 46377->46378 46379 4d714a3 46377->46379 46377->46382 46383 4d8d594 _Allocate 59 API calls 46378->46383 46526 4da8863 59 API calls 2 library calls 46379->46526 46382->46142 46383->46382 46385 4d71868 Mailbox 59 API calls 46384->46385 46387 4da7dba 46385->46387 46386 4da7e56 Mailbox 46527 4da7d6a 46386->46527 46387->46386 46388 4da7e2a GetDesktopWindow GetDC GetTextExtentPointW 46387->46388 46388->46387 46390 4da7e64 46531 4da7b07 46390->46531 46393->46128 46394->46132 46395->46132 46396->46167 46397->46167 46398->46152 46399->46156 46400->46165 46401->46169 46402->46169 46403->46182 46404->46187 46405->46187 46407 4d77c89 46406->46407 46710 4d78068 46407->46710 46409 4d77c95 46410 4d9fa89 59 API calls 46409->46410 46410->46193 46411->46193 46412->46193 46413->46200 46414->46196 46415->46203 46416->46204 46417->46211 46418->46217 46419->46220 46420->46223 46422 4d9c219 __EH_prolog 46421->46422 46423 4d9c22a 46422->46423 46424 4d9c731 46422->46424 46425 4d9c230 QueryDosDeviceW 46423->46425 46426 4d9c244 46423->46426 46729 4d9bba8 SetLastError 46424->46729 46446 4d9c720 46425->46446 46428 4d71868 Mailbox 59 API calls 46426->46428 46429 4d9c253 46428->46429 46718 4d9fa09 GetSysColorBrush 46429->46718 46431 4d9c281 46435 4d9c2bf 46431->46435 46719 4d9c1f7 7 API calls 46431->46719 46433 4d9c316 Mailbox 46721 4d86456 59 API calls char_traits 46433->46721 46435->46433 46720 4d9f916 SetLastError GetDesktopWindow GetDC GetTextExtentPointW 46435->46720 46437 4d9c392 GetDesktopWindow GetDC SetViewportExtEx 46440 4d9c32f char_traits Mailbox 46437->46440 46438 4d9c62d 46441 4d9c6ca 46438->46441 46725 4d9fa09 GetSysColorBrush 46438->46725 46726 4d9f6ff 7 API calls 46438->46726 46727 4d9c081 87 API calls 46438->46727 46440->46437 46440->46438 46444 4d71868 Mailbox 59 API calls 46440->46444 46452 4d9f8ab 7 API calls 46440->46452 46722 4d9f61e 10 API calls 46440->46722 46723 4d9f719 8 API calls 46440->46723 46724 4d9babf 62 API calls __EH_prolog 46440->46724 46442 4d9c70b 46441->46442 46728 4d9f9b7 7 API calls 46441->46728 46442->46446 46447 4d81790 59 API calls 46442->46447 46444->46440 46446->46223 46447->46446 46452->46440 46453->46223 46454->46231 46455->46237 46456->46237 46457->46239 46458->46243 46459->46247 46460->46251 46461->46255 46462->46259 46463->46259 46464->46265 46465->46269 46466->46273 46467->46277 46468->46281 46469->46285 46470->46285 46471->46291 46472->46291 46473->46297 46474->46297 46475->46303 46476->46307 46477->46307 46478->46313 46479->46317 46480->46321 46481->46321 46482->46327 46483->46331 46484->46331 46485->46337 46486->46341 46487->46341 46488->46347 46489->46351 46490->46355 46491->46179 46492->46179 46493->46179 46494->46179 46495->46179 46496->46146 46498 4d9c20f 87 API calls 46497->46498 46499 4d9f85a 46498->46499 46500 4d80b8a 46499->46500 46503 4d81790 46500->46503 46502 4d80bab 46502->46364 46504 4d81818 46503->46504 46505 4d817a5 46503->46505 46506 4da8891 59 API calls 46504->46506 46507 4d817c9 46505->46507 46508 4d817b2 46505->46508 46514 4d81822 46506->46514 46522 4d81534 59 API calls std::_Xinvalid_argument 46507->46522 46520 4d73f2e 59 API calls 46508->46520 46511 4d817ba 46521 4d8189c 59 API calls 46511->46521 46513 4d817c7 46513->46502 46515 4d81855 46514->46515 46517 4d81837 46514->46517 46523 4d81534 59 API calls std::_Xinvalid_argument 46515->46523 46518 4d81790 59 API calls 46517->46518 46519 4d81853 46518->46519 46519->46502 46520->46511 46521->46513 46522->46513 46523->46519 46524->46369 46525->46374 46528 4da7d74 __EH_prolog 46527->46528 46529 4da8a6d _Allocate 59 API calls 46528->46529 46530 4da7d7c 46529->46530 46530->46390 46532 4da7b26 46531->46532 46533 4da7b52 GetSysColorBrush 46532->46533 46534 4da7baf 46532->46534 46537 4da7b6a GetDesktopWindow SetWindowTextW 46532->46537 46538 4da7b80 FormatMessageW 46532->46538 46533->46532 46539 4da7be3 46534->46539 46536 4d9ca7f 46536->46146 46536->46147 46537->46532 46538->46532 46540 4da7bed __EH_prolog 46539->46540 46553 4d80bf0 46540->46553 46543 4da7c23 46547 4da7c7c 46543->46547 46556 4d811ba 46543->46556 46547->46536 46548 4da8a6d _Allocate 59 API calls 46549 4da7c48 46548->46549 46559 4da77d0 46549->46559 46551 4da7c70 46551->46547 46573 4da7aee 59 API calls 46551->46573 46554 4d80b8a 59 API calls 46553->46554 46555 4d80bfe 46554->46555 46555->46543 46572 4d80c9a 59 API calls 46555->46572 46574 4d811c2 46556->46574 46558 4d811c0 46558->46547 46558->46548 46560 4da77da __EH_prolog 46559->46560 46582 4da7508 46560->46582 46565 4da781b 46607 4da74ec 59 API calls 46565->46607 46566 4da7801 46569 4da780f 46566->46569 46606 4d824d8 65 API calls 2 library calls 46566->46606 46571 4da7865 46569->46571 46608 4d824d8 65 API calls 2 library calls 46569->46608 46571->46551 46572->46543 46573->46547 46577 4d80e75 46574->46577 46576 4d811cf 46576->46558 46578 4d71868 Mailbox 59 API calls 46577->46578 46579 4d80e89 46578->46579 46580 4d80ef9 GetDesktopWindow GetDC GetTextExtentPointW 46579->46580 46581 4d80f25 Mailbox 46579->46581 46580->46579 46581->46576 46609 4da7568 46582->46609 46584 4da7518 46585 4d825ac 46584->46585 46586 4d71868 Mailbox 59 API calls 46585->46586 46587 4d825c2 46586->46587 46588 4d82637 GetDesktopWindow GetDC GetTextExtentPointW 46587->46588 46589 4d82662 Mailbox 46587->46589 46588->46587 46590 4d82675 46589->46590 46613 4d80806 46589->46613 46590->46565 46590->46566 46592 4d8273c 46627 4d82852 46592->46627 46593 4d826db GetSysColorBrush 46595 4d82688 Mailbox 46593->46595 46595->46590 46595->46592 46595->46593 46599 4d826f6 GetDesktopWindow SetWindowTextW 46595->46599 46603 4d8270b FormatMessageW 46595->46603 46597 4d82779 46601 4d827a9 46597->46601 46602 4d8278a 46597->46602 46598 4d8276d 46648 4d82800 65 API calls Mailbox 46598->46648 46599->46595 46601->46590 46605 4d827b8 GetDesktopWindow GetDC SetViewportExtEx 46601->46605 46602->46590 46604 4d82792 GetDesktopWindow SetDlgItemInt 46602->46604 46603->46595 46604->46590 46605->46590 46606->46569 46607->46569 46608->46571 46610 4da7572 __EH_prolog 46609->46610 46611 4da8a6d _Allocate 59 API calls 46610->46611 46612 4da7581 46611->46612 46612->46584 46614 4d71868 Mailbox 59 API calls 46613->46614 46616 4d8081d 46614->46616 46615 4d808ba Mailbox 46649 4d81268 46615->46649 46616->46615 46618 4d80891 GetDesktopWindow GetDC GetTextExtentPointW 46616->46618 46618->46616 46619 4d808ca 46620 4d8098f 46619->46620 46624 4d808d2 46619->46624 46653 4d820be 46620->46653 46622 4d8096c 46622->46595 46623 4d80913 GetSysColorBrush 46623->46624 46624->46622 46624->46623 46625 4d8092b GetDesktopWindow SetWindowTextW 46624->46625 46626 4d8093d FormatMessageW 46624->46626 46625->46624 46626->46624 46628 4d71868 Mailbox 59 API calls 46627->46628 46629 4d82869 46628->46629 46630 4d828d9 GetDesktopWindow GetDC GetTextExtentPointW 46629->46630 46632 4d82905 Mailbox 46629->46632 46630->46629 46631 4d82769 46631->46597 46631->46598 46632->46631 46633 4d82943 CreateFileMappingW 46632->46633 46634 4d809bd 65 API calls 46633->46634 46636 4d82950 46634->46636 46635 4d8298f GetSysColorBrush 46635->46636 46636->46635 46637 4d829ec Mailbox 46636->46637 46638 4d829a7 GetDesktopWindow SetWindowTextW 46636->46638 46641 4d829bd FormatMessageW 46636->46641 46637->46631 46639 4d82a2d 46637->46639 46640 4d82a50 46637->46640 46638->46636 46642 4d82a35 GetDesktopWindow SetDlgItemInt 46639->46642 46644 4d82a7e 46639->46644 46643 4d82a5f GetDesktopWindow GetDC SetViewportExtEx 46640->46643 46640->46644 46641->46636 46642->46644 46643->46644 46646 4d82a97 46644->46646 46709 4d8254a 74 API calls 46644->46709 46646->46631 46647 4d82b42 MapViewOfFile 46646->46647 46647->46631 46648->46590 46650 4d81272 __EH_prolog 46649->46650 46670 4d80f96 46650->46670 46652 4d8128e char_traits 46652->46619 46654 4d71868 Mailbox 59 API calls 46653->46654 46655 4d820d5 46654->46655 46656 4d82145 GetDesktopWindow GetDC GetTextExtentPointW 46655->46656 46663 4d82173 Mailbox 46655->46663 46656->46655 46657 4d82239 46659 4d8229a 46657->46659 46660 4d82276 46657->46660 46658 4d821d4 GetSysColorBrush 46658->46663 46662 4d822aa GetDesktopWindow GetDC SetViewportExtEx 46659->46662 46666 4d822c9 46659->46666 46661 4d8227f GetDesktopWindow SetDlgItemInt 46660->46661 46660->46666 46661->46666 46662->46666 46663->46657 46663->46658 46664 4d821ef GetDesktopWindow SetWindowTextW 46663->46664 46665 4d82208 FormatMessageW 46663->46665 46664->46663 46665->46663 46667 4d823ac CreateFileW 46666->46667 46669 4d823b8 Mailbox 46666->46669 46701 4d809bd 46667->46701 46669->46622 46672 4d80fa0 __EH_prolog 46670->46672 46671 4d81171 46671->46652 46672->46671 46673 4d80bf0 59 API calls 46672->46673 46674 4d80fe4 46673->46674 46675 4d80d7f 62 API calls 46674->46675 46696 4d80ffc 46675->46696 46676 4d80cb8 78 API calls 46676->46696 46677 4d80cf6 62 API calls 46677->46696 46678 4d81091 46679 4d80c9a 59 API calls 46678->46679 46681 4d8109e char_traits 46679->46681 46680 4d80cd3 78 API calls 46680->46696 46683 4d7917f 59 API calls 46681->46683 46700 4d810ea 46681->46700 46682 4d80d7f 62 API calls 46686 4d81106 46682->46686 46687 4d810cd 46683->46687 46684 4d81f69 59 API calls 46684->46696 46685 4d80d7f 62 API calls 46685->46696 46688 4d80e75 62 API calls 46686->46688 46692 4d80cf6 62 API calls 46687->46692 46687->46700 46690 4d81113 46688->46690 46689 4d80c9a 59 API calls 46689->46696 46691 4d81148 46690->46691 46693 4d81790 59 API calls 46690->46693 46695 4d80a22 59 API calls 46691->46695 46694 4d810dd 46692->46694 46697 4d81138 46693->46697 46698 4d81f69 59 API calls 46694->46698 46695->46671 46696->46676 46696->46677 46696->46678 46696->46680 46696->46684 46696->46685 46696->46689 46699 4d81efc 59 API calls 46697->46699 46698->46700 46699->46691 46700->46682 46702 4d809cb 46701->46702 46708 4d809ed 46701->46708 46703 4d807d3 Mailbox 65 API calls 46702->46703 46704 4d809d0 Mailbox 46703->46704 46705 4d85ad9 Mailbox 62 API calls 46704->46705 46704->46708 46706 4d809e2 46705->46706 46707 4d8f401 62 API calls 46706->46707 46707->46708 46708->46669 46709->46646 46711 4d78078 46710->46711 46712 4d78098 46711->46712 46713 4d7807c 46711->46713 46717 4d736e6 59 API calls std::_Xinvalid_argument 46712->46717 46715 4d73a93 59 API calls 46713->46715 46716 4d78096 _memmove 46715->46716 46716->46409 46717->46716 46718->46431 46719->46431 46720->46435 46721->46440 46722->46440 46723->46440 46724->46440 46725->46438 46726->46438 46727->46438 46728->46441 46729->46446 46730 4d79a7a 46731 4d79abd 46730->46731 46732 4d79b1a 46730->46732 46820 4d79237 46731->46820 46733 4d71868 Mailbox 59 API calls 46732->46733 46736 4d79b3f 46733->46736 46735 4d79aec 46739 4d79be9 46736->46739 46823 4d7ffb6 SetLastError 46736->46823 46754 4d79c6e 46739->46754 46824 4d7be48 46739->46824 46837 4d7fcf4 7 API calls 46739->46837 46742 4d79dbb 46842 4d7c8f3 LookupPrivilegeValueW GetFileSize FormatMessageW 46742->46842 46745 4d79d66 46745->46742 46841 4d7f94f 147 API calls 46745->46841 46746 4d79dd2 46747 4d7b7c2 46746->46747 46752 4d71868 Mailbox 59 API calls 46746->46752 46749 4d7b802 46747->46749 46750 4d7b80f 46747->46750 46875 4d7fa58 GetDesktopWindow SetDlgItemInt RegUnLoadKeyW 46749->46875 46750->46735 46876 4d80219 GetSysColorBrush GetDesktopWindow GetDC SetViewportExtEx 46750->46876 46762 4d79df3 46752->46762 46754->46745 46838 4d7f97d 94 API calls 46754->46838 46839 4d7952b GetDesktopWindow SetWindowTextW GetOverlappedResult GetSysColorBrush 46754->46839 46840 4d7c8f3 LookupPrivilegeValueW GetFileSize FormatMessageW 46754->46840 46757 4d7a41b 46758 4d7a455 46757->46758 46845 4d802e0 142 API calls 46757->46845 46766 4d7a481 46758->46766 46846 4d80056 GetSysColorBrush GetDesktopWindow GetDC DrawFocusRect 46758->46846 46761 4d7a58e 46763 4d71868 Mailbox 59 API calls 46761->46763 46778 4d7a02c 46762->46778 46843 4d8010a 61 API calls 46762->46843 46765 4d7a5e5 46763->46765 46848 4d79851 46765->46848 46766->46761 46847 4d7c8f3 LookupPrivilegeValueW GetFileSize FormatMessageW 46766->46847 46769 4d7a66e 46770 4d7a6bd 46769->46770 46772 4d7a87c 46769->46772 46860 4d718aa 59 API calls 46770->46860 46772->46747 46861 4d718aa 59 API calls 46772->46861 46774 4d7a915 46775 4d71868 Mailbox 59 API calls 46774->46775 46818 4d7aac1 46774->46818 46789 4d7a95f 46775->46789 46777 4d7af1e 46779 4d7afa7 46777->46779 46780 4d7af8a 46777->46780 46844 4d717f6 59 API calls 46778->46844 46782 4d77c9c 59 API calls 46779->46782 46865 4d7bb5e 63 API calls 46780->46865 46785 4d7afd4 46782->46785 46783 4d7afa4 46783->46779 46787 4d7b07d 46785->46787 46866 4d7b9c7 LookupPrivilegeValueW GetDesktopWindow GetDC GetTextExtentPointW SetLastError 46785->46866 46867 4d7b898 ExtCreateRegion 46785->46867 46790 4d71868 Mailbox 59 API calls 46787->46790 46788 4d7a71a 46791 4d71868 Mailbox 59 API calls 46789->46791 46789->46818 46798 4d7b0da 46790->46798 46793 4d7aafc 46791->46793 46792 4d7b1ba 46870 4d778bc 59 API calls 46792->46870 46800 4d7abd7 46793->46800 46804 4d7ab81 46793->46804 46793->46818 46797 4d7b1dc 46797->46747 46799 4d7b1e9 46797->46799 46798->46792 46868 4d7bb16 142 API calls 46798->46868 46869 4d7c9aa GetOverlappedResult GetSysColorBrush 46798->46869 46801 4d71868 Mailbox 59 API calls 46799->46801 46863 4d718aa 59 API calls 46800->46863 46803 4d7b1f6 46801->46803 46806 4d71868 Mailbox 59 API calls 46803->46806 46804->46818 46862 4d79713 7 API calls 46804->46862 46807 4d7b207 46806->46807 46871 4d7952b GetDesktopWindow SetWindowTextW GetOverlappedResult GetSysColorBrush 46807->46871 46809 4d7b27b 46872 4d7bb5e 63 API calls 46809->46872 46810 4d7b24c 46810->46809 46812 4d7b295 46813 4d71868 Mailbox 59 API calls 46812->46813 46814 4d7b761 46812->46814 46819 4d7b39a 46812->46819 46815 4d7b35d 46813->46815 46814->46735 46873 4d7b898 ExtCreateRegion 46815->46873 46864 4d7b898 ExtCreateRegion 46818->46864 46819->46814 46874 4d7b9aa 63 API calls 46819->46874 46821 4d79851 142 API calls 46820->46821 46822 4d7925f 46821->46822 46822->46735 46823->46736 46825 4d7be7f 46824->46825 46826 4d7be6c 46824->46826 46828 4d7be78 46825->46828 46829 4d71868 Mailbox 59 API calls 46825->46829 46877 4d797fc 7 API calls 46826->46877 46828->46739 46831 4d7bef0 46829->46831 46836 4d7bf93 46831->46836 46878 4d803c3 ExtCreateRegion 46831->46878 46832 4d7c004 46881 4d7945d 76 API calls 46832->46881 46836->46832 46879 4d79822 GetSysColorBrush 46836->46879 46880 4d7fed3 LookupPrivilegeValueW GetDesktopWindow GetDC GetTextExtentPointW SetLastError 46836->46880 46837->46739 46838->46754 46839->46754 46840->46754 46841->46745 46842->46746 46843->46778 46844->46757 46845->46758 46846->46766 46847->46766 46849 4d79a25 46848->46849 46850 4d79878 46848->46850 46887 4d801f7 GetSysColorBrush GetDesktopWindow GetDC SetViewportExtEx 46849->46887 46853 4d798df 46850->46853 46855 4d7992f 46850->46855 46882 4d77ccd 46850->46882 46853->46855 46885 4d79270 142 API calls 46853->46885 46855->46769 46856 4da8bee __cinit 67 API calls 46856->46853 46859 4d79964 46859->46855 46886 4d8010a 61 API calls 46859->46886 46860->46788 46861->46774 46862->46804 46863->46818 46864->46777 46865->46783 46866->46785 46867->46785 46868->46798 46869->46798 46870->46797 46871->46810 46872->46812 46873->46819 46874->46814 46875->46735 46876->46735 46877->46828 46878->46831 46879->46836 46880->46836 46881->46828 46888 4d77c17 46882->46888 46885->46859 46886->46855 46887->46855 46889 4d77c21 __EH_prolog 46888->46889 46894 4d77d73 46889->46894 46900 4d778d1 46894->46900 46896 4d77c37 46897 4d8f5cd 46896->46897 46907 4d8f608 46897->46907 46899 4d77c59 46899->46856 46901 4d778dd 46900->46901 46902 4d778ed std::exception::exception 46900->46902 46901->46902 46903 4da8a6d _Allocate 59 API calls 46901->46903 46902->46896 46906 4da9254 RaiseException 46902->46906 46903->46902 46905 4da8862 46906->46905 46908 4d8f612 __EH_prolog 46907->46908 46909 4d8f665 46908->46909 46912 4d8f67b 46908->46912 46913 4da8863 59 API calls 2 library calls 46908->46913 46911 4d8d594 _Allocate 59 API calls 46909->46911 46911->46912 46912->46899 46914 4db41f5 46952 4db6e21 46914->46952 46916 4db41fe 46917 4db4277 ReadFile 46916->46917 46920 4db4214 GetConsoleMode 46916->46920 46918 4db4299 46917->46918 46919 4db4757 GetLastError 46917->46919 46918->46919 46925 4db4269 46918->46925 46921 4db4257 46919->46921 46922 4db4764 46919->46922 46923 4db4228 46920->46923 46924 4db4274 46920->46924 46934 4db425d 46921->46934 46961 4dabf74 58 API calls 2 library calls 46921->46961 46972 4dabf95 58 API calls __getptd_noexit 46922->46972 46923->46924 46927 4db422e ReadConsoleW 46923->46927 46924->46917 46925->46934 46935 4db453b 46925->46935 46938 4db42ce 46925->46938 46927->46925 46929 4db4251 GetLastError 46927->46929 46928 4db4769 46973 4dabf61 58 API calls __getptd_noexit 46928->46973 46929->46921 46933 4db452c 46934->46933 46965 4dac414 46934->46965 46935->46934 46939 4db4641 ReadFile 46935->46939 46937 4db433a ReadFile 46940 4db435b GetLastError 46937->46940 46950 4db4365 46937->46950 46938->46937 46943 4db43bb 46938->46943 46945 4db4664 GetLastError 46939->46945 46951 4db4672 46939->46951 46940->46950 46941 4db4478 46946 4db4428 MultiByteToWideChar 46941->46946 46964 4db4a42 60 API calls 3 library calls 46941->46964 46942 4db4468 46963 4dabf95 58 API calls __getptd_noexit 46942->46963 46943->46934 46943->46941 46943->46942 46943->46946 46945->46951 46946->46929 46946->46934 46950->46938 46962 4db4a42 60 API calls 3 library calls 46950->46962 46951->46935 46971 4db4a42 60 API calls 3 library calls 46951->46971 46953 4db6e39 46952->46953 46954 4db6e2c 46952->46954 46957 4db6e45 46953->46957 46975 4dabf95 58 API calls __getptd_noexit 46953->46975 46974 4dabf95 58 API calls __getptd_noexit 46954->46974 46956 4db6e31 46956->46916 46957->46916 46959 4db6e66 46976 4db0efc 9 API calls __write_nolock 46959->46976 46961->46934 46962->46950 46963->46934 46964->46946 46966 4dac446 _free 46965->46966 46967 4dac41d RtlFreeHeap 46965->46967 46966->46933 46967->46966 46968 4dac432 46967->46968 46977 4dabf95 58 API calls __getptd_noexit 46968->46977 46970 4dac438 GetLastError 46970->46966 46971->46951 46972->46928 46973->46934 46974->46956 46975->46959 46976->46956 46977->46970 46978 5262c29 46979 5262c45 GetLocaleInfoEx 46978->46979 46980 5262c49 __except_handler4 46978->46980 46981 5262c4e GetLocaleInfoW 46980->46981 46982 4d7bc87 46983 4d77ccd 59 API calls 46982->46983 46984 4d7bca2 46983->46984 46985 4da8bee __cinit 67 API calls 46984->46985 46986 4d7bcac 46985->46986 46990 4d7bcfc 46986->46990 46991 4d78219 46986->46991 46988 4d7bd38 46988->46990 47047 4d77cfb 59 API calls 46988->47047 46992 4d7823d 46991->46992 46993 4d78259 46991->46993 46992->46993 46994 4d78245 46992->46994 46996 4d7920e 90 API calls 46993->46996 47001 4d78718 46993->47001 47056 4d78d0e 142 API calls 46994->47056 46997 4d7826e 46996->46997 46998 4d79237 142 API calls 46997->46998 47030 4d786a1 46997->47030 47005 4d78299 46998->47005 46999 4d78700 47057 4d78d0e 142 API calls 46999->47057 47004 4d77ccd 59 API calls 47001->47004 47011 4d787fa 47001->47011 47012 4d787b0 47001->47012 47046 4d78c73 47001->47046 47002 4d78252 47002->47046 47003 4d77c6d 59 API calls 47006 4d78470 47003->47006 47007 4d787f0 47004->47007 47005->47003 47008 4d7920e 90 API calls 47006->47008 47009 4da8bee __cinit 67 API calls 47007->47009 47019 4d78497 47008->47019 47009->47011 47011->47012 47048 4d80613 47011->47048 47014 4d78a07 47012->47014 47012->47046 47059 4d7412b 69 API calls 47012->47059 47016 4d77c6d 59 API calls 47014->47016 47021 4d78b5d 47014->47021 47015 4d77c6d 59 API calls 47026 4d7888d 47015->47026 47018 4d78b53 47016->47018 47017 4d77c6d 59 API calls 47020 4d78677 47017->47020 47023 4da8bee __cinit 67 API calls 47018->47023 47019->47017 47024 4d7920e 90 API calls 47020->47024 47060 4d77868 59 API calls 47021->47060 47023->47021 47024->47030 47026->47012 47026->47015 47053 4d7920e 47026->47053 47058 4d77cfb 59 API calls 47026->47058 47028 4d78bc6 47061 4d77d60 59 API calls 47028->47061 47030->46999 47030->47001 47031 4d78bdd 47062 4d77891 59 API calls 47031->47062 47033 4d78c10 47034 4d78c30 47033->47034 47035 4d78ca8 47033->47035 47036 4d77c6d 59 API calls 47034->47036 47037 4d78cae 47035->47037 47038 4d78c3e 47036->47038 47064 4d78d0e 142 API calls 47037->47064 47063 4d7929a 142 API calls 47038->47063 47041 4d78c55 47042 4d78c5e 47041->47042 47043 4d78c7b 47041->47043 47044 4d78219 142 API calls 47042->47044 47045 4d78219 142 API calls 47043->47045 47044->47046 47045->47046 47046->46988 47047->46990 47065 4da9e80 47048->47065 47050 4d80646 47077 4d80587 47050->47077 47052 4d8064e 47052->47026 47096 4d80380 47053->47096 47056->47002 47057->47002 47058->47026 47059->47014 47060->47028 47061->47031 47062->47033 47063->47041 47064->47002 47068 4da9eab 47065->47068 47066 4daa00b 47094 4daa01d 59 API calls __except1 47066->47094 47068->47066 47070 4da9ee0 47068->47070 47091 4daa01d 59 API calls __except1 47068->47091 47069 4daa015 47069->47050 47070->47066 47074 4da9efc 47070->47074 47072 4da9ffd 47072->47050 47073 4da9f41 47073->47050 47073->47072 47093 4daa01d 59 API calls __except1 47073->47093 47074->47073 47092 4daa01d 59 API calls __except1 47074->47092 47078 4d8059a 47077->47078 47079 4d805aa 47077->47079 47078->47079 47080 4d80608 47078->47080 47082 4d8f5cd 59 API calls 47079->47082 47081 4da8891 59 API calls 47080->47081 47083 4d80612 47081->47083 47084 4d805fc 47082->47084 47087 4da9e80 __dtol3 59 API calls 47083->47087 47095 4d77ecc 59 API calls 47084->47095 47086 4d80603 47086->47052 47088 4d80646 47087->47088 47089 4d80587 60 API calls 47088->47089 47090 4d8064e 47089->47090 47090->47052 47091->47070 47092->47073 47093->47072 47094->47069 47095->47086 47097 4d7be48 90 API calls 47096->47097 47098 4d7922d 47097->47098 47098->47026 47099 4dacecf 47100 4daced8 47099->47100 47101 4dacedc 47099->47101 47103 4dabf95 58 API calls __getptd_noexit 47101->47103 47103->47100 47104 4db8f22 47105 4db8f63 GetLastError 47104->47105 47106 4db8f32 47104->47106 47126 4dabf74 58 API calls 2 library calls 47105->47126 47106->47105 47120 4db8b74 47106->47120 47109 4db8f88 47127 4dabf95 58 API calls __getptd_noexit 47109->47127 47112 4db8f95 GetFileType 47114 4db8fa0 GetLastError 47112->47114 47113 4db8f8e 47128 4dabf74 58 API calls 2 library calls 47114->47128 47116 4db8fc7 CloseHandle 47116->47109 47117 4db8fd5 47116->47117 47129 4dabf95 58 API calls __getptd_noexit 47117->47129 47119 4db8fda 47119->47109 47121 4db8b7f ___crtIsPackagedApp 47120->47121 47122 4db8bda CreateFileW 47121->47122 47123 4db8b83 GetModuleHandleW GetProcAddress 47121->47123 47124 4db8bf8 47122->47124 47125 4db8ba0 47123->47125 47124->47105 47124->47112 47125->47124 47126->47109 47127->47113 47128->47116 47129->47119 47130 4d97843 47131 4d978a0 47130->47131 47132 4d97850 _memcmp 47130->47132 47133 4da8891 59 API calls 47131->47133 47134 4d978aa 47133->47134 47135 4db4f40 47140 4db4f45 47135->47140 47137 4db4f4f 47148 4db0efc 9 API calls __write_nolock 47137->47148 47139 4db4f5a 47146 4db4f4a 47140->47146 47149 4db9436 60 API calls 2 library calls 47140->47149 47142 4db50fe 47142->47146 47150 4db9436 60 API calls 2 library calls 47142->47150 47144 4db511d 47144->47146 47151 4db9436 60 API calls 2 library calls 47144->47151 47146->47139 47147 4dabf95 58 API calls __getptd_noexit 47146->47147 47147->47137 47148->47139 47149->47142 47150->47144 47151->47146 47152 4dacf86 47155 4dacfa8 LeaveCriticalSection LeaveCriticalSection _fseek 47152->47155 47154 4dacf9a __initptd 47155->47154 47156 4db8c45 47157 4db8c1e 47156->47157 47158 4db8c54 47156->47158 47164 4dabf95 58 API calls __getptd_noexit 47157->47164 47166 4db8c99 LeaveCriticalSection __unlock_fhandle 47158->47166 47160 4db8c23 47165 4db0efc 9 API calls __write_nolock 47160->47165 47163 4db8c2d __initptd 47164->47160 47165->47163 47166->47163 47167 4dad625 47168 4dad62e 47167->47168 47169 4dad633 47167->47169 47181 4db578b GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 47168->47181 47173 4dad648 47169->47173 47172 4dad641 47174 4dad654 __initptd 47173->47174 47178 4dad6a2 ___DllMainCRTStartup 47174->47178 47180 4dad6ff __initptd 47174->47180 47182 4dad4b3 47174->47182 47176 4dad6dc 47177 4dad4b3 __CRT_INIT@12 137 API calls 47176->47177 47176->47180 47177->47180 47178->47176 47179 4dad4b3 __CRT_INIT@12 137 API calls 47178->47179 47178->47180 47179->47176 47180->47172 47181->47169 47183 4dad4bf __initptd 47182->47183 47184 4dad541 47183->47184 47185 4dad4c7 47183->47185 47186 4dad5aa 47184->47186 47187 4dad545 47184->47187 47233 4db3440 GetProcessHeap 47185->47233 47190 4dad5af 47186->47190 47191 4dad60d 47186->47191 47193 4dad566 47187->47193 47199 4dad4d0 __initptd __CRT_INIT@12 47187->47199 47262 4daea57 58 API calls _doexit 47187->47262 47189 4dad4cc 47189->47199 47234 4dafc30 47189->47234 47267 4db58f7 TlsGetValue 47190->47267 47191->47199 47276 4dafac0 58 API calls 2 library calls 47191->47276 47263 4dae92e 60 API calls _free 47193->47263 47196 4dad5ba 47196->47199 47268 4daed00 47196->47268 47199->47178 47200 4dad4dc __RTC_Initialize 47200->47199 47208 4dad4ec GetCommandLineA 47200->47208 47202 4dad56b 47203 4dad57c __CRT_INIT@12 47202->47203 47264 4db4d9f 59 API calls _free 47202->47264 47266 4dad595 61 API calls __mtterm 47203->47266 47207 4dad577 47265 4dafca6 61 API calls 2 library calls 47207->47265 47255 4db582d 63 API calls 2 library calls 47208->47255 47212 4dad5e3 47214 4dad5e9 47212->47214 47215 4dad601 47212->47215 47213 4dad4fc 47256 4db4aeb 62 API calls 6 library calls 47213->47256 47275 4dafb7d 58 API calls 3 library calls 47214->47275 47218 4dac414 _free 58 API calls 47215->47218 47218->47199 47219 4dad506 47221 4dad50a 47219->47221 47222 4dad511 47219->47222 47220 4dad5f1 GetCurrentThreadId 47220->47199 47257 4dafca6 61 API calls 2 library calls 47221->47257 47258 4db547b 71 API calls 3 library calls 47222->47258 47225 4dad516 47226 4dad52a 47225->47226 47259 4db56aa 70 API calls 6 library calls 47225->47259 47232 4dad52f 47226->47232 47261 4db4d9f 59 API calls _free 47226->47261 47229 4dad51f 47229->47226 47260 4daea66 68 API calls 4 library calls 47229->47260 47230 4dad53f 47230->47221 47232->47199 47233->47189 47277 4daeafe EncodePointer 47234->47277 47236 4dafc35 47282 4db61a4 47236->47282 47239 4dafc3e 47289 4dafca6 61 API calls 2 library calls 47239->47289 47242 4dafc43 47242->47200 47244 4dafc5b 47245 4daed00 __calloc_crt 58 API calls 47244->47245 47246 4dafc68 47245->47246 47247 4dafc9d 47246->47247 47290 4db5916 TlsSetValue 47246->47290 47292 4dafca6 61 API calls 2 library calls 47247->47292 47250 4dafc7c 47250->47247 47252 4dafc82 47250->47252 47251 4dafca2 47251->47200 47291 4dafb7d 58 API calls 3 library calls 47252->47291 47254 4dafc8a GetCurrentThreadId 47254->47200 47255->47213 47256->47219 47257->47199 47258->47225 47259->47229 47260->47226 47261->47230 47262->47193 47263->47202 47264->47207 47265->47203 47266->47199 47267->47196 47269 4daed07 47268->47269 47271 4dad5cb 47269->47271 47273 4daed25 47269->47273 47295 4db62aa 47269->47295 47271->47199 47274 4db5916 TlsSetValue 47271->47274 47273->47269 47273->47271 47303 4db5c31 Sleep 47273->47303 47274->47212 47275->47220 47276->47199 47278 4daeb0f __init_pointers __initp_misc_winsig 47277->47278 47293 4dae893 EncodePointer 47278->47293 47280 4daeb27 __init_pointers 47281 4db59a6 34 API calls 47280->47281 47281->47236 47285 4db61b0 47282->47285 47284 4dafc3a 47284->47239 47286 4db58ba 47284->47286 47285->47284 47294 4db5938 InitializeCriticalSectionAndSpinCount 47285->47294 47287 4dafc50 47286->47287 47288 4db58d1 TlsAlloc 47286->47288 47287->47239 47287->47244 47289->47242 47290->47250 47291->47254 47292->47251 47293->47280 47294->47285 47296 4db62b5 47295->47296 47302 4db62d0 47295->47302 47297 4db62c1 47296->47297 47296->47302 47304 4dabf95 58 API calls __getptd_noexit 47297->47304 47298 4db62e0 RtlAllocateHeap 47300 4db62c6 47298->47300 47298->47302 47300->47269 47302->47298 47302->47300 47305 4dae8b1 DecodePointer 47302->47305 47303->47273 47304->47300 47305->47302

    Executed Functions

    Function 04D97A3F Relevance: 84.5, APIs: 6, Strings: 41, Instructions: 2223COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prologXinvalid_argumentstd::_
    • String ID: C@$'`5x$2$>$D$DwKoYBuJCEyytDi$PO$PhOg$Sh;l$Y$Y$]K$^$e$f$f$h8$h";$h&}$h4R$hL4$hPQ$ht$h}?$h1$hS$i$n$r$r$r$r$t$t$x($xbftzkZErMGIHumMcosuOxQ$|h=1$"5$S4$W$r8
    • API String ID: 4014091808-959085074
    • Opcode ID: 414bc61bd3cfc9142c2a374ee631ee33bef2a1723e2123d88dfc1527da3dcda3
    • Instruction ID: 7eb65ce0907aadd25548d417f41912b3bdc8cec54ba37af37988d7e919f22ad1
    • Opcode Fuzzy Hash: 414bc61bd3cfc9142c2a374ee631ee33bef2a1723e2123d88dfc1527da3dcda3
    • Instruction Fuzzy Hash: CD2348B0A042699EEF21DF54CC95BEEBBB4EB05308F1041E9E549B7281DB716E84CF61
    Function 04D9C786 Relevance: 83.5, APIs: 5, Strings: 41, Instructions: 2976COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D9C78B
    • ExtCreateRegion.GDI32(00000000,0000254C,00000000), ref: 04D9F5E1
      • Part of subcall function 04D9BABF: __EH_prolog.LIBCMT ref: 04D9BAC4
    • GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000001,00000003,00000000,00000002,00000000,?,?,0DFE9F48,?,00000000,?,?,00000002), ref: 04D9CF4F
    • GetDesktopWindow.USER32 ref: 04D9D1D6
    • SetWindowLongW.USER32(00000000), ref: 04D9D1DD
      • Part of subcall function 04D738F8: _memmove.LIBCMT ref: 04D73918
      • Part of subcall function 04D84630: __EH_prolog.LIBCMT ref: 04D84635
      • Part of subcall function 04D73943: _memmove.LIBCMT ref: 04D73963
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog$Window_memmove$CreateDesktopLongOverlappedRegionResult
    • String ID: $ $!$!$!'E$'`5x$($*$*$*$:$<$<$AA$G$H$PO$R$[$b$e$e$h&}$l$m$m$n$p$p$p$r$s$t$t$t$t$u$v$v${$#
    • API String ID: 4063478863-2971129802
    • Opcode ID: a8d2b4e8dfa690370a989b939dbeab372a9d1e0b50fc46ed5e653c0b9347d609
    • Instruction ID: c3d4a7fc63b41e53aa29048f3bf29b79f14ecb4f6ff8888edf1cf5ac765d6f33
    • Opcode Fuzzy Hash: a8d2b4e8dfa690370a989b939dbeab372a9d1e0b50fc46ed5e653c0b9347d609
    • Instruction Fuzzy Hash: F5539D70E442699EEF21DF98CC95BEDBBB5AB09304F1040E9D548BB281D7B16E84CF61
    Function 04D97C37 Relevance: 44.9, APIs: 4, Strings: 21, Instructions: 1189COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$Allocate
    • String ID: C@$#$'`5x$2$PO$PhOg$Y$]K$e$f$f$h";$h&}$ht$h1$r$r$t$x($|h=1$S4
    • API String ID: 1811393872-1841768753
    • Opcode ID: 7635ec59ae483fe9d73852fef1cda097dd1446b354a4b994895ddb034cfa83f3
    • Instruction ID: 2cbecc0e5ccadc19723609a0b458a8bbe1759fbfe3d968bb7823c7836a623580
    • Opcode Fuzzy Hash: 7635ec59ae483fe9d73852fef1cda097dd1446b354a4b994895ddb034cfa83f3
    • Instruction Fuzzy Hash: F9C236B0E00269DEEF21DF94CC95BEEBBB4BB05304F1441A9E549B7281E7716A84CF61
    Function 04D97E69 Relevance: 41.4, APIs: 4, Strings: 19, Instructions: 1135COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID: C@$#$'`5x$2$PO$PhOg$Y$]K$e$f$f$h";$h&}$h1$r$r$t$x($|h=1
    • API String ID: 0-247542439
    • Opcode ID: b9f142c5962a70634a9656121db262726a056bacbe1bd797f08ac7510941e834
    • Instruction ID: f9aafab6bc99b0984c1c0e1a61eec7d7deaace9624e34f8b562eaf7357b359a0
    • Opcode Fuzzy Hash: b9f142c5962a70634a9656121db262726a056bacbe1bd797f08ac7510941e834
    • Instruction Fuzzy Hash: 2DB246B0E00269DEEF21DF94CC95AEEBBB4BB05308F1441A9E549B7281D7706E84DF61
    Function 04D97F15 Relevance: 41.3, APIs: 4, Strings: 19, Instructions: 1079COMMON
    Download Yara Rule
    APIs
      • Part of subcall function 04D713C5: _Allocate.LIBCPMT ref: 04D71417
      • Part of subcall function 04D713C5: _Ucopy.LIBCPMT ref: 04D71428
      • Part of subcall function 04D713C5: _Ucopy.LIBCPMT ref: 04D71436
      • Part of subcall function 04D713C5: _Ucopy.LIBCPMT ref: 04D71444
    • ExtCreateRegion.GDI32(00000000,0000254C,00000000), ref: 04D983BC
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$AllocateCreateRegion
    • String ID: C@$#$'`5x$2$PO$PhOg$Y$]K$e$f$f$h";$h&}$h1$r$r$t$x($|h=1
    • API String ID: 2216468127-247542439
    • Opcode ID: e3edeb45877e9968d2ae061842c179aa32992bcd6bfdca6320f6fbf67259bdb0
    • Instruction ID: 781027ab458bbe8d8a47d7349538ce7e4ad86caed97a747fab67d30ab4cb3f1e
    • Opcode Fuzzy Hash: e3edeb45877e9968d2ae061842c179aa32992bcd6bfdca6320f6fbf67259bdb0
    • Instruction Fuzzy Hash: 8FB246B0E00269DEEF21DF94CC95BEEBBB4AB05308F1041A9E549B7281D7716E84DF61
    Function 04D98060 Relevance: 39.7, APIs: 4, Strings: 18, Instructions: 1178COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$Allocate
    • String ID: C@$#$'`5x$PO$PhOg$Y$]K$e$f$f$h";$h&}$h1$r$r$t$x($|h=1
    • API String ID: 1811393872-3020287246
    • Opcode ID: da0202215328dfc5df4b1b3fd286dfaa80c90d5abd41475c9e8117687c55a628
    • Instruction ID: 51bc1a897dfa560a6aa0554fd956a27c5a79614e393275ac9474ce32a20f9f6e
    • Opcode Fuzzy Hash: da0202215328dfc5df4b1b3fd286dfaa80c90d5abd41475c9e8117687c55a628
    • Instruction Fuzzy Hash: 7FB247B0E10269DEEF21DF94CC95AEEBBB4BB05304F1041A9E549B7281E7706E84DF61
    Function 04D98926 Relevance: 28.7, APIs: 3, Strings: 13, Instructions: 716COMMON
    Download Yara Rule
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID:
    • String ID: C@$#$'`5x$PO$PhOg$Y$]K$e$f$f$h&}$r$t
    • API String ID: 0-446310366
    • Opcode ID: 57d6346f4f23aa74cedef5ad5d1a675f90517f9515f50c9c1ebbc1758f668ced
    • Instruction ID: 69c0937cc9251c67f9218d83684761981be3cf04cbe3040f987095f21d133e43
    • Opcode Fuzzy Hash: 57d6346f4f23aa74cedef5ad5d1a675f90517f9515f50c9c1ebbc1758f668ced
    • Instruction Fuzzy Hash: 0E6235B0E002699EEF21DF54CC94AEEBBB4BB15308F5440EAD549B7241EB706E84DF61
    Function 04D94BDD Relevance: 14.6, APIs: 3, Strings: 5, Instructions: 598registrywindowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5414 4d94bdd-4d94bf4 call 4da92b8 5417 4d94bfa-4d94bff 5414->5417 5418 4d953f2-4d953f6 5414->5418 5419 4d953e8-4d953f0 RegUnLoadKeyW 5417->5419 5420 4d94c05-4d94c73 call 4d71868 5417->5420 5421 4d953f8-4d95406 5418->5421 5422 4d9541e EndMenu 5418->5422 5423 4d95424-4d95434 5419->5423 5429 4d94c82-4d94c86 5420->5429 5421->5423 5425 4d95408 5421->5425 5422->5423 5427 4d9540b-4d9541a 5425->5427 5427->5427 5428 4d9541c 5427->5428 5428->5423 5430 4d94c88-4d94c8b 5429->5430 5431 4d94c75-4d94c7f 5429->5431 5432 4d94ca0-4d94ca4 5430->5432 5431->5429 5433 4d94c8d-4d94c9d 5432->5433 5434 4d94ca6-4d94cb2 5432->5434 5433->5432 5435 4d94d29-4d94d2f 5434->5435 5436 4d94cb4-4d94cf2 call 4d71868 call 4d94bdd 5434->5436 5438 4d94daf-4d94db2 5435->5438 5450 4d94d0c-4d94d14 5436->5450 5440 4d94db8-4d94ec5 call 4d739d4 call 4d71868 call 4d95dd0 call 4d96824 5438->5440 5441 4d94d31-4d94d5d 5438->5441 5466 4d94ed0-4d94ed2 5440->5466 5467 4d94ec7-4d94eca 5440->5467 5442 4d94d70-4d94d74 5441->5442 5445 4d94d5f-4d94d6d 5442->5445 5446 4d94d76-4d94d79 5442->5446 5445->5442 5449 4d94d8c-4d94d8f 5446->5449 5452 4d94d7b-4d94d89 5449->5452 5453 4d94d91-4d94dae call 4d95f1f 5449->5453 5454 4d94cf4-4d94d09 5450->5454 5455 4d94d16-4d94d24 call 4d739d4 5450->5455 5452->5449 5453->5438 5454->5450 5455->5436 5464 4d94d26-4d94d28 5455->5464 5464->5435 5469 4d94ed3-4d94ede 5466->5469 5467->5466 5468 4d94ecc-4d94ece 5467->5468 5468->5469 5470 4d94ee0-4d94ee3 5469->5470 5471 4d94ee5 5469->5471 5472 4d94ee7-4d94f21 5470->5472 5471->5472 5473 4d94f2f 5472->5473 5474 4d94f23-4d94f28 5472->5474 5476 4d94f31-4d94f98 call 4d739d4 call 4d942fc 5473->5476 5474->5473 5475 4d94f2a-4d94f2d 5474->5475 5475->5476 5481 4d95015-4d95019 5476->5481 5482 4d94f9a-4d94fa4 5481->5482 5483 4d9501f-4d95040 call 4d79122 5481->5483 5485 4d9500c-4d95010 5482->5485 5495 4d9508a-4d950f5 call 4d71868 5483->5495 5496 4d95042-4d95052 call 4d93f47 5483->5496 5487 4d95012 5485->5487 5488 4d94fa6-4d94fb0 5485->5488 5487->5481 5489 4d94fb9-4d94fc0 5488->5489 5490 4d94fb2-4d94fb5 5488->5490 5493 4d94fc2-4d94fe4 call 4d942fc 5489->5493 5494 4d94fe7-4d95009 call 4d95f8e 5489->5494 5490->5487 5492 4d94fb7 5490->5492 5492->5494 5493->5494 5494->5485 5505 4d950f6-4d950f9 5495->5505 5503 4d95057-4d9505c 5496->5503 5503->5495 5506 4d9505e-4d95085 call 4d93eb9 call 4d82e58 call 4d816c1 5503->5506 5507 4d950fb-4d9510a 5505->5507 5508 4d9510c-4d9510f 5505->5508 5506->5495 5507->5505 5510 4d95238-4d9523c 5508->5510 5512 4d95242-4d952af call 4d739d4 call 4d95ece 5510->5512 5513 4d95114-4d9515c 5510->5513 5528 4d9537f-4d95383 5512->5528 5515 4d9516b-4d9516e 5513->5515 5518 4d9515e-4d95168 5515->5518 5519 4d95170-4d95173 5515->5519 5518->5515 5522 4d95186-4d95189 5519->5522 5524 4d9518b-4d95192 5522->5524 5525 4d95175-4d95183 5522->5525 5527 4d95217-4d9521b 5524->5527 5525->5522 5531 4d95221-4d95235 5527->5531 5532 4d95197-4d951b6 5527->5532 5529 4d95389-4d953b0 call 4d95483 call 4d94058 5528->5529 5530 4d952b4-4d952be 5528->5530 5548 4d953b5-4d953ba 5529->5548 5535 4d952d1-4d952d4 5530->5535 5531->5510 5534 4d951c5-4d951c8 5532->5534 5537 4d951b8-4d951c2 5534->5537 5538 4d951ca-4d951d3 5534->5538 5539 4d952c0-4d952ce 5535->5539 5540 4d952d6-4d952d9 5535->5540 5537->5534 5543 4d9520e-4d95212 5538->5543 5539->5535 5541 4d952e9-4d952ec 5540->5541 5544 4d952db-4d952e6 5541->5544 5545 4d952ee-4d952f1 5541->5545 5546 4d951d5-4d951f0 5543->5546 5547 4d95214 5543->5547 5544->5541 5549 4d9533f 5545->5549 5550 4d952f3-4d95305 5545->5550 5553 4d95203-4d95206 5546->5553 5547->5527 5551 4d953bc-4d953dd call 4d95f8e 5548->5551 5552 4d953e0-4d953e6 5548->5552 5559 4d95341-4d95366 5549->5559 5556 4d9530f-4d95318 5550->5556 5557 4d95307-4d9530d 5550->5557 5551->5552 5552->5423 5554 4d95208-4d9520b 5553->5554 5555 4d951f2-4d95200 5553->5555 5554->5543 5555->5553 5556->5549 5561 4d9531a-4d9531d 5556->5561 5560 4d9533a-4d9533d 5557->5560 5563 4d95368-4d9536b 5559->5563 5564 4d95374-4d95378 5559->5564 5560->5549 5560->5559 5566 4d9531f-4d95324 5561->5566 5567 4d95326 5561->5567 5563->5564 5568 4d9536d-4d95372 5563->5568 5565 4d95379-4d9537c 5564->5565 5565->5528 5566->5567 5569 4d95328-4d95338 5566->5569 5567->5569 5568->5565 5569->5549 5569->5560
    APIs
    • __EH_prolog.LIBCMT ref: 04D94BE2
    • RegUnLoadKeyW.ADVAPI32(00000000,00000000,04D719D1,00000001,00000000), ref: 04D953EA
      • Part of subcall function 04D942FC: QueryDosDeviceW.KERNEL32(00000000,00000000,00000752), ref: 04D94318
    • EndMenu.USER32(04D719D1,00000001,00000000), ref: 04D9541E
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DeviceH_prologLoadMenuQuery
    • String ID: '`5x$PO$Xx$h&}$#
    • API String ID: 2890571477-3551381960
    • Opcode ID: 92a08e9b0a675057034c71a62aa55a3f177f05a807d707e5a1f542ea469b6c73
    • Instruction ID: f392b8a8228158817737e19e78c4fb7b02cdd68029cdf5d7417da40fb0f3c7ed
    • Opcode Fuzzy Hash: 92a08e9b0a675057034c71a62aa55a3f177f05a807d707e5a1f542ea469b6c73
    • Instruction Fuzzy Hash: 27426AB1A01209EFDF14CF98D951AEDBBF5FB08308F5142AAE919BA281D770AD41CF54
    Function 04D925BB Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 664COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5570 4d925bb-4d925dc call 4da92b8 5573 4d925ef-4d925f2 5570->5573 5574 4d925de-4d925ec 5573->5574 5575 4d925f4-4d925fa 5573->5575 5574->5573 5576 4d925fc-4d92625 call 4d93353 5575->5576 5577 4d92647-4d92653 5575->5577 5583 4d9263f-4d92645 5576->5583 5584 4d92627-4d9263d call 4d93cce 5576->5584 5579 4d92663-4d92666 5577->5579 5581 4d92668-4d92672 5579->5581 5582 4d92655-4d92660 5579->5582 5585 4d9270d-4d92710 5581->5585 5582->5579 5583->5576 5583->5577 5584->5583 5587 4d92677-4d92681 5585->5587 5588 4d92716-4d92762 call 4d9373a call 4d71868 call 4d9368f 5585->5588 5590 4d926ed-4d926f0 5587->5590 5609 4d9278c 5588->5609 5610 4d92764-4d92786 5588->5610 5593 4d92683-4d92686 5590->5593 5594 4d926f2-4d926f5 5590->5594 5597 4d92699-4d9269d 5593->5597 5596 4d92705-4d92708 5594->5596 5599 4d9270a 5596->5599 5600 4d926f7-4d92702 5596->5600 5601 4d92688-4d92696 5597->5601 5602 4d9269f-4d926a2 5597->5602 5599->5585 5600->5596 5601->5597 5603 4d926b2-4d926b5 5602->5603 5605 4d926a4-4d926af 5603->5605 5606 4d926b7-4d926d7 call 4d93a16 5603->5606 5605->5603 5614 4d926d9-4d926e3 5606->5614 5615 4d926ea 5606->5615 5613 4d9278e-4d927a3 5609->5613 5610->5609 5612 4d92788-4d9278a 5610->5612 5612->5613 5616 4d927e3-4d927ea 5613->5616 5617 4d927a5-4d927ad 5613->5617 5614->5615 5619 4d926e5-4d926e8 5614->5619 5615->5590 5618 4d92814-4d92818 5616->5618 5620 4d927dc-4d927df 5617->5620 5621 4d9281a-4d9282d call 4d739d4 call 4d93f6e 5618->5621 5622 4d927ec-4d927f4 5618->5622 5619->5614 5619->5615 5623 4d927af-4d927bb 5620->5623 5624 4d927e1 5620->5624 5634 4d92832-4d928a5 call 4d71868 5621->5634 5625 4d92811 5622->5625 5626 4d927f6-4d9280e call 4d9368f 5622->5626 5628 4d927bd-4d927c3 5623->5628 5629 4d927c6-4d927da 5623->5629 5624->5621 5625->5618 5626->5625 5628->5629 5629->5620 5637 4d928b4-4d928b8 5634->5637 5638 4d928ba-4d928bd 5637->5638 5639 4d928a7-4d928b1 5637->5639 5640 4d928d2-4d928d6 5638->5640 5639->5637 5641 4d928d8-4d928e4 5640->5641 5642 4d928bf-4d928cf 5640->5642 5643 4d92940-4d92946 5641->5643 5644 4d928e6-4d928e8 5641->5644 5642->5640 5645 4d929d2-4d929d5 5643->5645 5646 4d928e9-4d928f9 call 4d71868 5644->5646 5648 4d9294b-4d92977 5645->5648 5649 4d929db-4d929f1 call 4d739d4 5645->5649 5655 4d92907-4d9290a 5646->5655 5650 4d9298a-4d9298e 5648->5650 5660 4d92d5c-4d92de8 call 4d71868 5649->5660 5661 4d929f7-4d92a2e 5649->5661 5653 4d92979-4d92987 5650->5653 5654 4d92990-4d92993 5650->5654 5653->5650 5657 4d929a6-4d929a9 5654->5657 5658 4d928fb-4d92904 5655->5658 5659 4d9290c-4d9290f 5655->5659 5663 4d929ab-4d929d1 call 4d93353 5657->5663 5664 4d92995-4d929a3 5657->5664 5658->5655 5665 4d92912-4d9292c 5659->5665 5675 4d92dfa-4d92dfd 5660->5675 5666 4d92a30 5661->5666 5667 4d92a33-4d92a51 5661->5667 5663->5645 5664->5657 5665->5665 5672 4d9292e-4d92939 call 4d739d4 5665->5672 5666->5667 5668 4d92a5d 5667->5668 5669 4d92a53-4d92a56 5667->5669 5674 4d92a5f-4d92a8e 5668->5674 5669->5668 5673 4d92a58-4d92a5b 5669->5673 5672->5646 5685 4d9293b-4d9293f 5672->5685 5673->5674 5678 4d92af6-4d92afa 5674->5678 5679 4d92dea-4d92df7 5675->5679 5680 4d92dff-4d92e3f call 4d9389a 5675->5680 5682 4d92afc-4d92be0 call 4d93d77 call 4d71868 call 4d934ce 5678->5682 5683 4d92a90-4d92a9a 5678->5683 5679->5675 5692 4d92e4a-4d92e4c 5680->5692 5693 4d92e41-4d92e44 5680->5693 5716 4d92d41-4d92d45 5682->5716 5687 4d92aed-4d92af1 5683->5687 5685->5643 5689 4d92a9c-4d92aa6 5687->5689 5690 4d92af3 5687->5690 5695 4d92aa8-4d92aab 5689->5695 5696 4d92aaf-4d92ab5 5689->5696 5690->5678 5698 4d92e4d-4d92e5a 5692->5698 5693->5692 5697 4d92e46-4d92e48 5693->5697 5695->5690 5700 4d92aad 5695->5700 5701 4d92ad1-4d92aea call 4d939ad 5696->5701 5702 4d92ab7-4d92ace call 4d93d77 5696->5702 5697->5698 5703 4d92e5d-4d92e97 5698->5703 5704 4d92e5c 5698->5704 5700->5701 5701->5687 5702->5701 5705 4d92e99-4d92e9f 5703->5705 5706 4d92ea6 5703->5706 5704->5703 5705->5706 5710 4d92ea1-4d92ea4 5705->5710 5711 4d92ea8-4d92ee9 call 4d739d4 call 4d73943 5706->5711 5710->5711 5718 4d92d4b-4d92d5a call 4d739d4 5716->5718 5719 4d92be5-4d92c2e 5716->5719 5718->5660 5722 4d92c3d-4d92c41 5719->5722 5725 4d92c30-4d92c3a 5722->5725 5726 4d92c43-4d92c46 5722->5726 5725->5722 5727 4d92c59-4d92c5c 5726->5727 5728 4d92c48-4d92c56 5727->5728 5729 4d92c5e-4d92c65 5727->5729 5728->5727 5730 4d92d1c-4d92d20 5729->5730 5731 4d92c6a-4d92c89 5730->5731 5732 4d92d26-4d92d3e 5730->5732 5733 4d92c9c-4d92ca0 5731->5733 5732->5716 5734 4d92c8b-4d92c99 5733->5734 5735 4d92ca2-4d92cab 5733->5735 5734->5733 5736 4d92d13-4d92d17 5735->5736 5737 4d92d19 5736->5737 5738 4d92cad-4d92ccc 5736->5738 5737->5730 5739 4d92cdf-4d92ce3 5738->5739 5740 4d92cce-4d92cdc 5739->5740 5741 4d92ce5-4d92d10 call 4d93bc2 5739->5741 5740->5739 5741->5736
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID: !$'`5x$PO$Xx$h&}$#
    • API String ID: 3519838083-2769257566
    • Opcode ID: 9f04767a7744db994432ce11b95548045b4ed67d0a980f755f6a1e37ddefd2b8
    • Instruction ID: a1e38c232a479d08cc3bda580666a58228acc04cf31f5d8a909b370ca87ffccd
    • Opcode Fuzzy Hash: 9f04767a7744db994432ce11b95548045b4ed67d0a980f755f6a1e37ddefd2b8
    • Instruction Fuzzy Hash: C1525EB0E0021AEFDF14CF94C885AEEBBB5FB45304F208569E515BB280D7756A85CFA1
    Function 04D94590 Relevance: 8.0, APIs: 5, Instructions: 485COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 6060 4d94590-4d945a6 call 4da92b8 6063 4d945ac-4d945b0 6060->6063 6064 4d94b4e-4d94b60 call 4d94527 6060->6064 6066 4d945cb-4d94612 call 4d71868 call 4d95483 6063->6066 6067 4d945b2-4d945c0 6063->6067 6072 4d94b63-4d94b72 6064->6072 6076 4d94622-4d94625 6066->6076 6070 4d945c2 6067->6070 6071 4d945c4-4d945c6 6067->6071 6070->6071 6071->6072 6077 4d94614-4d9461f 6076->6077 6078 4d94627-4d9462e 6076->6078 6077->6076 6079 4d9465c-4d9465f 6078->6079 6080 4d94661-4d94664 6079->6080 6081 4d94630-4d94659 call 4d95483 6079->6081 6083 4d946a5-4d946a9 6080->6083 6081->6079 6084 4d946ab-4d946df call 4d739d4 call 4da8913 6083->6084 6085 4d94666-4d94675 6083->6085 6096 4d946ef-4d946f3 6084->6096 6088 4d9469d-4d946a0 6085->6088 6089 4d946a2 6088->6089 6090 4d94677-4d9467d 6088->6090 6089->6083 6092 4d9469a 6090->6092 6093 4d9467f-4d94694 GetDesktopWindow GetDC GetTextExtentPointW 6090->6093 6092->6088 6093->6092 6097 4d946e1-4d946ec 6096->6097 6098 4d946f5-4d946fc 6096->6098 6097->6096 6099 4d9475f-4d94763 6098->6099 6100 4d946fe-4d9470c 6099->6100 6101 4d94765-4d9476b 6099->6101 6104 4d94719-4d9471c 6100->6104 6105 4d9470e-4d94713 GetSysColorBrush 6100->6105 6102 4d9476d-4d94784 6101->6102 6103 4d94786-4d94799 6101->6103 6102->6102 6102->6103 6107 4d9479b-4d947a2 6103->6107 6108 4d947c0-4d947da call 4d95e39 6103->6108 6106 4d94756-4d9475a 6104->6106 6105->6104 6110 4d9475c 6106->6110 6111 4d9471e-4d94737 call 4d95fc5 6106->6111 6112 4d947f5-4d9481b call 4d79122 6107->6112 6113 4d947a4-4d947be call 4d95e79 6107->6113 6108->6112 6120 4d947dc-4d947ed call 4d95f1f 6108->6120 6110->6099 6123 4d94739-4d94750 call 4d95ece 6111->6123 6124 4d94753 6111->6124 6127 4d9481e-4d94842 call 4d71868 6112->6127 6122 4d947f2 6113->6122 6120->6122 6122->6112 6123->6124 6124->6106 6131 4d94854-4d94858 6127->6131 6132 4d9485a-4d94864 6131->6132 6133 4d94844-4d94851 6131->6133 6134 4d9486a-4d9486c 6132->6134 6135 4d94a4f-4d94a5c call 4d739d4 6132->6135 6133->6131 6136 4d9486d-4d9488f 6134->6136 6142 4d94b33 6135->6142 6143 4d94a62-4d94a78 call 4d79122 6135->6143 6138 4d9489f-4d948a2 6136->6138 6140 4d94891-4d9489c 6138->6140 6141 4d948a4-4d948a7 6138->6141 6140->6138 6144 4d948b7-4d948ba 6141->6144 6146 4d94b36-4d94b3e 6142->6146 6143->6142 6160 4d94a7e-4d94a84 6143->6160 6148 4d948a9-4d948b4 6144->6148 6149 4d948bc-4d948bf 6144->6149 6147 4d94b40-4d94b43 6146->6147 6147->6072 6151 4d94b45-4d94b4c call 4dac63a 6147->6151 6148->6144 6152 4d948d2-4d948d5 6149->6152 6151->6072 6154 4d948c1-4d948cf 6152->6154 6155 4d948d7-4d948dd 6152->6155 6154->6152 6158 4d948f8-4d948fa 6155->6158 6159 4d948df-4d948f2 6155->6159 6164 4d948fb-4d94924 6158->6164 6159->6158 6161 4d948f4-4d948f6 6159->6161 6162 4d94a93-4d94a9b 6160->6162 6163 4d94a86-4d94a8e 6160->6163 6161->6164 6167 4d94abb-4d94ac9 6162->6167 6168 4d94a9d-4d94ab6 call 4da8913 call 4d9689b 6162->6168 6163->6147 6165 4d94975-4d94982 6164->6165 6166 4d94926-4d9492d 6164->6166 6174 4d94984 6165->6174 6175 4d94987-4d949ae 6165->6175 6170 4d9492f-4d94952 call 4d94bdd 6166->6170 6171 4d94955-4d9495c 6166->6171 6172 4d94ad8-4d94b31 call 4d95483 call 4d79122 6167->6172 6173 4d94acb-4d94ad7 call 4d9454c 6167->6173 6168->6167 6170->6171 6178 4d9496d-4d94971 6171->6178 6172->6146 6173->6172 6174->6175 6181 4d949b0-4d949dd 6175->6181 6185 4d9495e-4d94968 6178->6185 6186 4d94973 6178->6186 6188 4d949df-4d949e2 6181->6188 6189 4d949e5-4d94a16 6181->6189 6185->6181 6190 4d9496a 6185->6190 6186->6181 6188->6189 6192 4d94a18-4d94a1e 6189->6192 6193 4d94a24-4d94a26 6189->6193 6190->6178 6192->6193 6194 4d94a20-4d94a22 6192->6194 6195 4d94a27-4d94a46 6193->6195 6194->6195 6195->6136 6197 4d94a4c 6195->6197 6197->6135
    APIs
    • __EH_prolog.LIBCMT ref: 04D94595
    • GetDesktopWindow.USER32 ref: 04D94686
    • GetDC.USER32(00000000), ref: 04D9468D
    • GetTextExtentPointW.GDI32(00000000), ref: 04D94694
    • GetSysColorBrush.USER32(0000196A), ref: 04D94713
      • Part of subcall function 04D95FC5: GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000001,?,04D96141), ref: 04D95FDB
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: BrushColorDesktopExtentH_prologOverlappedPointResultTextWindow
    • String ID:
    • API String ID: 251452265-0
    • Opcode ID: 2b5453814b4345033dd0c29ace4eeacf6e2f3d1df171427d37fe53fcb8bb4f24
    • Instruction ID: 22a873538f5aadd4136902aebe5e5b354271399edb5b50fedd9866e9484a7436
    • Opcode Fuzzy Hash: 2b5453814b4345033dd0c29ace4eeacf6e2f3d1df171427d37fe53fcb8bb4f24
    • Instruction Fuzzy Hash: 79125CB1A4434AAFEF14DF98D885AEE77F5FF05318F100519E921AB281D770AE51CBA0
    Function 05262C29 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • GetLocaleInfoEx.KERNEL32(?,?,00000002,?,?,052636FA,?,?,?,00000002,?,?,?), ref: 05262C45
    • GetLocaleInfoW.KERNEL32(00000000,?,00000002,?,?,052636FA,?,?,?,00000002,?,?,?), ref: 05262C50
    Memory Dump Source
    • Source File: 00000006.00000002.2292494766.0000000005141000.00000020.00001000.00020000.00000000.sdmp, Offset: 05140000, based on PE: true
    • Associated: 00000006.00000002.2292472579.0000000005140000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292599957.000000000529A000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292889798.000000000570D000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292916262.000000000570F000.00000040.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_5140000_rundll32.jbxd
    Similarity
    • API ID: InfoLocale
    • String ID:
    • API String ID: 2299586839-0
    • Opcode ID: 3380c3e1711379748e4851ff1f634e08b48afb4093220cb0a0b35ee5a664fb53
    • Instruction ID: bf4b742a6b8b5f8d72febbdf2a4fbdcacbc2590d64488397abc5b719cb3fed5f
    • Opcode Fuzzy Hash: 3380c3e1711379748e4851ff1f634e08b48afb4093220cb0a0b35ee5a664fb53
    • Instruction Fuzzy Hash: 29D06736424209FF8F019FE1F80AC6A3FA9FF49224B058845F91C85151DE32A560AB65
    Function 04D98A5B Relevance: 28.7, APIs: 3, Strings: 13, Instructions: 657COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 3797 4d98a5b-4d98aa4 call 4d9aedf call 4d739d4 3803 4d98aa5-4d98ad8 3797->3803 3803->3803 3804 4d98ada-4d98b85 call 4d71868 3803->3804 3811 4d98bee-4d98d6e call 4d739d4 call 4d77c6d call 4d71868 3804->3811 3812 4d98b87-4d98b97 call 4d71868 3804->3812 3833 4d98d79-4d98d7b 3811->3833 3834 4d98d70-4d98d73 3811->3834 3818 4d98bac-4d98bb0 3812->3818 3820 4d98b99-4d98ba9 3818->3820 3821 4d98bb2-4d98bb8 3818->3821 3820->3818 3823 4d98bbf-4d98bd9 3821->3823 3823->3823 3825 4d98bdb-4d98be9 call 4d739d4 3823->3825 3825->3812 3831 4d98beb-4d98bed 3825->3831 3831->3811 3835 4d98d7c-4d98dad 3833->3835 3834->3833 3836 4d98d75-4d98d77 3834->3836 3837 4d98db8-4d98dba 3835->3837 3838 4d98daf-4d98db2 3835->3838 3836->3835 3839 4d98dbb-4d98e07 3837->3839 3838->3837 3840 4d98db4-4d98db6 3838->3840 3843 4d98e09-4d98e11 3839->3843 3844 4d98e18 3839->3844 3840->3839 3843->3844 3845 4d98e13-4d98e16 3843->3845 3846 4d98e1a-4d98f00 call 4d739d4 call 4d9a56f 3844->3846 3845->3846 3853 4d9a1a9-4d9a24e call 4d71868 call 4d9ac9b 3846->3853 3854 4d98f06 3846->3854 3863 4d9a46f-4d9a47d call 4d739d4 3853->3863 3864 4d9a254-4d9a256 3853->3864 3855 4d98f0f-4d98f78 call 4d77c9c call 4d96ffc call 4d96fd5 call 4d73987 * 2 3854->3855 3881 4d98f7d-4d98fb4 call 4dacea1 3855->3881 3874 4d9a47f-4d9a54e call 4d738f8 * 3 call 4d73987 call 4d738f8 3863->3874 3867 4d9a257-4d9a469 3864->3867 3867->3863 3888 4d98fb9-4d98fbe 3881->3888 3890 4d9a188-4d9a195 call 4d73987 3888->3890 3891 4d98fc4-4d98fc7 3888->3891 3896 4d9a19a-4d9a1a3 3890->3896 3891->3890 3894 4d98fcd-4d98fe7 call 4daca22 call 4dace35 call 4daca22 3891->3894 3905 4d98fec-4d9900d call 4d85c51 3894->3905 3896->3853 3896->3855 3907 4d99012-4d9904e call 4dac8e7 call 4d9b587 3905->3907 3911 4d99053-4d990c5 call 4d849d0 3907->3911 3914 4d990cb-4d990cf 3911->3914 3915 4d9a14d-4d9a153 3911->3915 3914->3915 3918 4d990d5-4d9918d call 4dad30d 3914->3918 3916 4d9a15d-4d9a183 call 4d73943 call 4d849a6 call 4d73943 3915->3916 3917 4d9a155-4d9a159 3915->3917 3916->3890 3917->3916 3924 4d99193-4d99196 3918->3924 3926 4d99198-4d991ac 3924->3926 3927 4d991ae-4d9920c call 4d9b587 3924->3927 3930 4d9920f-4d99215 3926->3930 3927->3930 3930->3924 3932 4d9921b-4d992b4 3930->3932 3933 4d992b5-4d992b8 3932->3933 3934 4d992ca-4d992f6 3933->3934 3935 4d992ba-4d992c8 3933->3935 3936 4d992fd-4d99303 3934->3936 3935->3936 3936->3933 3937 4d99305-4d9938a 3936->3937 3938 4d9938b-4d9938e 3937->3938 3939 4d993a0-4d993cc 3938->3939 3940 4d99390-4d9939e 3938->3940 3941 4d993d3-4d993d9 3939->3941 3940->3941 3941->3938 3942 4d993db-4d99500 call 4d77c6d * 3 call 4d9741f call 4da897e 3941->3942 3953 4d99501-4d99504 3942->3953 3954 4d99516-4d99544 3953->3954 3955 4d99506-4d99514 3953->3955 3956 4d9954b-4d99551 3954->3956 3955->3956 3956->3953 3957 4d99553-4d99582 call 4d77c6d 3956->3957 3960 4d99585-4d9958b 3957->3960 3961 4d99779-4d997eb 3960->3961 3962 4d99591-4d995ff call 4d96eff call 4d908e6 call 4d738f8 call 4d8e3b4 3960->3962 3963 4d997ec-4d9981f 3961->3963 3980 4d99751-4d99774 call 4d73943 call 4d816c1 3962->3980 3981 4d99605-4d9974c call 4d96eae call 4d717a1 * 3 call 4d9b820 call 4d974e3 call 4d717a1 * 3 call 4d9b820 call 4d974e3 call 4d97b64 call 4d738f8 3962->3981 3963->3963 3965 4d99821-4d99886 call 4d77c6d call 4d908e6 call 4d8e379 call 4d73943 call 4d738f8 3963->3965 3992 4d9988c-4d99904 3965->3992 3993 4d99c43-4d99cb4 3965->3993 3980->3960 3981->3980 3995 4d99905-4d99908 3992->3995 3997 4d99cb5-4d99cb8 3993->3997 3998 4d9991a-4d99946 3995->3998 3999 4d9990a-4d99918 3995->3999 4001 4d99cca-4d99cf6 3997->4001 4002 4d99cba-4d99cc8 3997->4002 4003 4d9994d-4d99953 3998->4003 3999->4003 4005 4d99cfd-4d99d03 4001->4005 4002->4005 4003->3995 4006 4d99955-4d99a47 call 4d77c6d call 4d96ed7 call 4d908e6 call 4d738f8 * 2 4003->4006 4005->3997 4008 4d99d05-4d99dcd call 4d77c6d call 4d908e6 call 4d738f8 4005->4008 4040 4d99a48-4d99a4b 4006->4040 4029 4d99dce-4d99dd1 4008->4029 4032 4d99de3-4d99e0f 4029->4032 4033 4d99dd3-4d99de1 4029->4033 4036 4d99e16-4d99e1c 4032->4036 4033->4036 4036->4029 4039 4d99e1e-4d99ea2 call 4d77c6d call 4d908e6 call 4d738f8 call 4d8e3b4 4036->4039 4064 4d99ea8-4d99ebf call 4d8e379 4039->4064 4065 4d99f65-4d99f75 4039->4065 4043 4d99a5d-4d99a8b 4040->4043 4044 4d99a4d-4d99a5b 4040->4044 4047 4d99a92-4d99a98 4043->4047 4044->4047 4047->4040 4051 4d99a9a-4d99ae8 call 4d77c6d call 4d8d984 4047->4051 4066 4d99aee 4051->4066 4067 4d99c14-4d99c3e call 4d71a13 call 4d738f8 call 4d73943 4051->4067 4064->4065 4083 4d99ec5-4d99f60 call 4d9750b call 4d96eae call 4d9b42f call 4d738f8 * 2 4064->4083 4068 4d99f7b-4d99f81 4065->4068 4069 4d9a0ad-4d9a14b call 4d816c1 call 4d73943 * 2 call 4d738f8 call 4d91897 call 4d97748 call 4d73943 call 4d849a6 call 4d73943 call 4d73987 4065->4069 4072 4d99af1-4d99af8 4066->4072 4067->3993 4075 4d99f87-4d99f89 4068->4075 4069->3896 4073 4d99afe-4d99bef call 4d96f6a call 4d908ac call 4d96ed7 call 4d738f8 call 4d9b30e call 4d816c1 call 4d738f8 call 4d73943 4072->4073 4074 4d99bf4-4d99c0e call 4d84c7b 4072->4074 4073->4074 4074->4067 4074->4072 4081 4d9a09f-4d9a0a7 4075->4081 4082 4d99f8f-4d9a001 call 4d717a1 call 4d9057d call 4d904f7 call 4d738f8 call 4d9b587 4075->4082 4081->4069 4081->4075 4129 4d9a2a8-4d9a2af 4082->4129 4130 4d9a007-4d9a00e 4082->4130 4083->4065 4131 4d9a2b1-4d9a2b3 4129->4131 4132 4d9a2b5 4129->4132 4135 4d9a070-4d9a087 call 4d738f8 4130->4135 4136 4d9a010-4d9a06a call 4d9af6d call 4d9b108 4130->4136 4137 4d9a2b7-4d9a2c0 4131->4137 4132->4137 4135->4082 4149 4d9a08d-4d9a09c 4135->4149 4136->4129 4136->4135 4144 4d9a2c2 4137->4144 4145 4d9a2c4-4d9a32b call 4d90391 call 4d738f8 call 4d816c1 call 4d73943 * 2 call 4d738f8 call 4d91897 call 4d97748 4137->4145 4144->4145 4172 4d9a330-4d9a33e call 4d82e7d 4145->4172 4149->4081 4173 4d9a340-4d9a379 call 4d73943 call 4d849a6 call 4d73943 call 4d73987 4172->4173 4173->3874
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopItemTextWindow
    • String ID: C@$!$#$'`5x$PO$Y$]K$e$f$f$h&}$r$t
    • API String ID: 2254304967-3921538676
    • Opcode ID: b8f915cb1852bf0a6bdb5d77aaf45cb56940db87457ed4d16f37d8a4150865df
    • Instruction ID: 71c85faa1e9f2ad0a572ecb63831c088e65ac49706e409006c9164b175d778e4
    • Opcode Fuzzy Hash: b8f915cb1852bf0a6bdb5d77aaf45cb56940db87457ed4d16f37d8a4150865df
    • Instruction Fuzzy Hash: 246224B0D002699EEF21DF54CC94BEEBBB4AB19308F5440E9D549B7241EB716E84CFA1
    Function 04DB41F5 Relevance: 23.0, APIs: 15, Instructions: 504fileCOMMON
    Download Yara Rule
    APIs
    • GetConsoleMode.KERNEL32(?,?), ref: 04DB421B
    • ReadConsoleW.KERNEL32(?,?,?,?,00000000), ref: 04DB4247
    • GetLastError.KERNEL32 ref: 04DB4251
    • __dosmaperr.LIBCMT ref: 04DB4258
    • ReadFile.KERNEL32(?,?,?,?,00000000), ref: 04DB428B
    • ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 04DB4351
    • GetLastError.KERNEL32 ref: 04DB435B
    • __lseeki64_nolock.LIBCMT ref: 04DB43C6
    • __lseeki64_nolock.LIBCMT ref: 04DB44D5
    • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,?), ref: 04DB44F4
    • _free.LIBCMT ref: 04DB4527
    • ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 04DB465A
    • GetLastError.KERNEL32 ref: 04DB4664
    • __lseeki64_nolock.LIBCMT ref: 04DB46FE
    • GetLastError.KERNEL32(?,?,00000000), ref: 04DB4757
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: ErrorLastRead$File__lseeki64_nolock$Console$ByteCharModeMultiWide__dosmaperr_free
    • String ID:
    • API String ID: 3177247492-0
    • Opcode ID: 6cca11e7112e0426004a7b6084d8692f69dbc916b9251ed904bedfe8a030a46a
    • Instruction ID: ee7908cab1b05617acf2e35f15f4f9622a45011dc69e0e8019d1e83209db6110
    • Opcode Fuzzy Hash: 6cca11e7112e0426004a7b6084d8692f69dbc916b9251ed904bedfe8a030a46a
    • Instruction Fuzzy Hash: 3C02D231A04256DBDF20CFA8D844BEDBBB1FF05314F18855AD9D69B282D674A842CBE1
    Function 04D82852 Relevance: 21.3, APIs: 14, Instructions: 260filewindowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 4512 4d82852-4d82875 call 4d71868 4515 4d82887-4d8288a 4512->4515 4516 4d8288c-4d8288f 4515->4516 4517 4d82877-4d82884 4515->4517 4518 4d8289f-4d828a2 4516->4518 4517->4515 4519 4d82891-4d8289c 4518->4519 4520 4d828a4-4d828aa 4518->4520 4519->4518 4521 4d828b6-4d828b9 4520->4521 4522 4d828bb-4d828be 4521->4522 4523 4d828ac-4d828b3 4521->4523 4524 4d828ff-4d82903 4522->4524 4523->4521 4525 4d828c0-4d828cf 4524->4525 4526 4d82905-4d82916 call 4d739d4 call 4d82421 4524->4526 4528 4d828f7-4d828fa 4525->4528 4536 4d82b59 4526->4536 4537 4d8291c-4d82961 call 4d71d3a call 4d79122 CreateFileMappingW call 4d809bd 4526->4537 4530 4d828fc 4528->4530 4531 4d828d1-4d828d7 4528->4531 4530->4524 4533 4d828d9-4d828ee GetDesktopWindow GetDC GetTextExtentPointW 4531->4533 4534 4d828f4 4531->4534 4533->4534 4534->4528 4539 4d82b5b-4d82b61 4536->4539 4545 4d82971-4d82975 4537->4545 4546 4d82963-4d8296e 4545->4546 4547 4d82977-4d8297e 4545->4547 4546->4545 4548 4d829e6-4d829ea 4547->4548 4549 4d829ec-4d829f2 4548->4549 4550 4d82980-4d8298d 4548->4550 4553 4d82a0d-4d82a18 call 4d809a5 4549->4553 4554 4d829f4-4d82a0b 4549->4554 4551 4d8299a-4d8299d 4550->4551 4552 4d8298f-4d82994 GetSysColorBrush 4550->4552 4555 4d829dd-4d829e1 4551->4555 4552->4551 4553->4536 4562 4d82a1e-4d82a2b 4553->4562 4554->4553 4554->4554 4557 4d8299f-4d829a5 4555->4557 4558 4d829e3 4555->4558 4560 4d829b5-4d829bb 4557->4560 4561 4d829a7-4d829af GetDesktopWindow SetWindowTextW 4557->4561 4558->4548 4565 4d829da 4560->4565 4566 4d829bd-4d829d4 FormatMessageW 4560->4566 4561->4560 4563 4d82a2d-4d82a33 4562->4563 4564 4d82a50-4d82a5d 4562->4564 4567 4d82a7e-4d82a95 call 4d8251b 4563->4567 4568 4d82a35-4d82a4e GetDesktopWindow SetDlgItemInt 4563->4568 4564->4567 4569 4d82a5f-4d82a78 GetDesktopWindow GetDC SetViewportExtEx 4564->4569 4565->4555 4566->4565 4572 4d82ac1-4d82b04 call 4d8254a 4567->4572 4573 4d82a97-4d82aa8 call 4d8208b 4567->4573 4568->4567 4569->4567 4572->4536 4578 4d82b06 4572->4578 4573->4536 4579 4d82aae 4573->4579 4580 4d82b08-4d82b0b 4578->4580 4581 4d82b0d-4d82b0f 4578->4581 4582 4d82abc-4d82abf 4579->4582 4583 4d82ab0-4d82ab6 4579->4583 4580->4536 4580->4581 4581->4536 4584 4d82b11 4581->4584 4585 4d82b28-4d82b4b call 4d79122 MapViewOfFile 4582->4585 4583->4536 4583->4582 4586 4d82b19 4584->4586 4587 4d82b13-4d82b15 4584->4587 4585->4536 4594 4d82b4d-4d82b57 4585->4594 4586->4536 4590 4d82b1b 4586->4590 4587->4536 4589 4d82b17 4587->4589 4589->4586 4592 4d82b1d-4d82b20 4590->4592 4593 4d82b22-4d82b25 4590->4593 4592->4536 4592->4593 4593->4585 4594->4539
    APIs
    • GetDesktopWindow.USER32 ref: 04D828E0
    • GetDC.USER32(00000000), ref: 04D828E7
    • GetTextExtentPointW.GDI32(00000000), ref: 04D828EE
    • CreateFileMappingW.KERNELBASE(00000000,00000002,00000000,00000000,00000000,00000003,75A89CE0,?,00000000), ref: 04D82945
    • GetSysColorBrush.USER32(0000196A), ref: 04D82994
    • GetDesktopWindow.USER32 ref: 04D829A8
    • SetWindowTextW.USER32(00000000), ref: 04D829AF
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000000), ref: 04D829D4
    • GetDesktopWindow.USER32 ref: 04D82A41
    • SetDlgItemInt.USER32(00000000), ref: 04D82A48
    • GetDesktopWindow.USER32 ref: 04D82A6A
    • GetDC.USER32(00000000), ref: 04D82A71
    • SetViewportExtEx.GDI32(00000000), ref: 04D82A78
    • MapViewOfFile.KERNEL32(00000004,04D82769,?,?,?,?,?,?,?,04DCCF60,00000000), ref: 04D82B44
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$FileText$BrushColorCreateExtentFormatItemMappingMessagePointViewViewport
    • String ID:
    • API String ID: 2213085167-0
    • Opcode ID: f8ad10c2bc73af7de6249b27ffaa118e3a904ec599237d62ca181b1b54cd8c41
    • Instruction ID: 65c42532e9617e20e39ed78d3e6ae80659165456336b61b4d391c69c97f81310
    • Opcode Fuzzy Hash: f8ad10c2bc73af7de6249b27ffaa118e3a904ec599237d62ca181b1b54cd8c41
    • Instruction Fuzzy Hash: 16A167B0E40309EFEB10AFA4C8949FDBBB9FF45314F14829DE5516B281D7346A85CBA0
    Function 04D820BE Relevance: 19.8, APIs: 13, Instructions: 288filewindowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 4595 4d820be-4d820e1 call 4d71868 4598 4d820f3-4d820f6 4595->4598 4599 4d820f8-4d820fb 4598->4599 4600 4d820e3-4d820f0 4598->4600 4601 4d8210b-4d8210e 4599->4601 4600->4598 4602 4d820fd-4d82108 4601->4602 4603 4d82110-4d82119 4601->4603 4602->4601 4604 4d82121-4d82124 4603->4604 4605 4d8211b-4d8211e 4604->4605 4606 4d82126-4d82129 4604->4606 4605->4604 4607 4d8216d-4d82171 4606->4607 4608 4d8212b-4d8213a 4607->4608 4609 4d82173-4d821a6 call 4d739d4 4607->4609 4611 4d82165-4d82168 4608->4611 4615 4d821b6-4d821b9 4609->4615 4612 4d8216a 4611->4612 4613 4d8213c-4d82143 4611->4613 4612->4607 4616 4d82162 4613->4616 4617 4d82145-4d82160 GetDesktopWindow GetDC GetTextExtentPointW 4613->4617 4618 4d821a8-4d821b3 4615->4618 4619 4d821bb-4d821c2 4615->4619 4616->4611 4617->4616 4618->4615 4620 4d82233-4d82237 4619->4620 4621 4d82239-4d8223f 4620->4621 4622 4d821c4-4d821d2 4620->4622 4623 4d8225a-4d82274 4621->4623 4624 4d82241-4d82258 4621->4624 4625 4d821e1-4d821e4 4622->4625 4626 4d821d4-4d821df GetSysColorBrush 4622->4626 4627 4d8229a-4d822a8 4623->4627 4628 4d82276-4d8227d 4623->4628 4624->4623 4624->4624 4629 4d8222a-4d8222e 4625->4629 4626->4625 4632 4d822ce-4d822e5 4627->4632 4634 4d822aa-4d822c3 GetDesktopWindow GetDC SetViewportExtEx 4627->4634 4628->4632 4633 4d8227f-4d82298 GetDesktopWindow SetDlgItemInt 4628->4633 4630 4d82230 4629->4630 4631 4d821e6-4d821ed 4629->4631 4630->4620 4636 4d821ff-4d82206 4631->4636 4637 4d821ef-4d821fd GetDesktopWindow SetWindowTextW 4631->4637 4638 4d82418-4d8241e 4632->4638 4639 4d822eb-4d82302 4632->4639 4635 4d822c9-4d822cc 4633->4635 4634->4635 4635->4632 4642 4d82208-4d82225 FormatMessageW 4636->4642 4643 4d82227 4636->4643 4637->4636 4640 4d8230a-4d82310 4639->4640 4641 4d82304 4639->4641 4644 4d82318-4d8231e 4640->4644 4645 4d82312 4640->4645 4641->4640 4642->4643 4643->4629 4646 4d82320 4644->4646 4647 4d82326-4d82339 4644->4647 4645->4644 4646->4647 4648 4d8233b 4647->4648 4649 4d8233d-4d82343 4647->4649 4648->4649 4650 4d82348-4d8235b 4649->4650 4651 4d82345 4649->4651 4652 4d8235d 4650->4652 4653 4d82362-4d82368 4650->4653 4651->4650 4652->4653 4654 4d8236a 4653->4654 4655 4d8236c-4d82372 4653->4655 4654->4655 4656 4d82379-4d8237f 4655->4656 4657 4d82374 4655->4657 4658 4d82381 4656->4658 4659 4d82386-4d8238d 4656->4659 4657->4656 4658->4659 4660 4d8238f 4659->4660 4661 4d82391-4d823b3 call 4d79122 CreateFileW call 4d809bd 4659->4661 4660->4661 4665 4d823b8-4d823c2 call 4d809a5 4661->4665 4668 4d823ff-4d82415 call 4d79122 call 4d8242a 4665->4668 4669 4d823c4-4d823d6 4665->4669 4668->4638 4671 4d823d8-4d823f2 call 4d79122 4669->4671 4672 4d823f4-4d823f7 4669->4672 4671->4638 4672->4638 4675 4d823f9-4d823fd 4672->4675 4675->4638
    APIs
    • GetDesktopWindow.USER32 ref: 04D8214C
    • GetDC.USER32(00000000), ref: 04D82153
    • GetTextExtentPointW.GDI32(00000000), ref: 04D8215A
    • GetSysColorBrush.USER32(0000196A), ref: 04D821D9
    • GetDesktopWindow.USER32 ref: 04D821F0
    • SetWindowTextW.USER32(00000000), ref: 04D821F7
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,75A89CE0,?,00000000), ref: 04D8221F
    • GetDesktopWindow.USER32 ref: 04D8228B
    • SetDlgItemInt.USER32(00000000), ref: 04D82292
    • GetDesktopWindow.USER32 ref: 04D822B5
    • GetDC.USER32(00000000), ref: 04D822BC
    • SetViewportExtEx.GDI32(00000000), ref: 04D822C3
    • CreateFileW.KERNEL32(000000F2,00000000,5C6F1BF5,8F93905C,00000000,00000003,75A89CE0,?,00000000), ref: 04D823AE
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorCreateExtentFileFormatItemMessagePointViewport
    • String ID:
    • API String ID: 349340697-0
    • Opcode ID: a80f41ee469a1324eed5f993ce967a9322bacc990dd652b44af2c9c725ba91cd
    • Instruction ID: 126f5719b3483fb1a2ca63ee7e948207e059189e8f45dc226e9e7aa3bccff362
    • Opcode Fuzzy Hash: a80f41ee469a1324eed5f993ce967a9322bacc990dd652b44af2c9c725ba91cd
    • Instruction Fuzzy Hash: CFA1A070E04304EAFB14AF99D8597BD7BB4FF44711F24C4ADE955AA2C0D7789A40CB60
    Function 04D98EBB Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 446COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 4681 4d98ebb-4d98f00 call 4d9a693 4688 4d9a1a9-4d9a24e call 4d71868 call 4d9ac9b 4681->4688 4689 4d98f06 4681->4689 4698 4d9a46f-4d9a47d call 4d739d4 4688->4698 4699 4d9a254-4d9a256 4688->4699 4690 4d98f0f-4d98fbe call 4d77c9c call 4d96ffc call 4d96fd5 call 4d73987 * 2 call 4dacea1 4689->4690 4725 4d9a188-4d9a195 call 4d73987 4690->4725 4726 4d98fc4-4d98fc7 4690->4726 4709 4d9a47f-4d9a54e call 4d738f8 * 3 call 4d73987 call 4d738f8 4698->4709 4702 4d9a257-4d9a469 4699->4702 4702->4698 4731 4d9a19a-4d9a1a3 4725->4731 4726->4725 4729 4d98fcd-4d990c5 call 4daca22 call 4dace35 call 4daca22 call 4d85c51 call 4dac8e7 call 4d9b587 call 4d849d0 4726->4729 4749 4d990cb-4d990cf 4729->4749 4750 4d9a14d-4d9a153 4729->4750 4731->4688 4731->4690 4749->4750 4753 4d990d5-4d9918d call 4dad30d 4749->4753 4751 4d9a15d-4d9a183 call 4d73943 call 4d849a6 call 4d73943 4750->4751 4752 4d9a155-4d9a159 4750->4752 4751->4725 4752->4751 4759 4d99193-4d99196 4753->4759 4761 4d99198-4d991ac 4759->4761 4762 4d991ae-4d9920c call 4d9b587 4759->4762 4765 4d9920f-4d99215 4761->4765 4762->4765 4765->4759 4767 4d9921b-4d992b4 4765->4767 4768 4d992b5-4d992b8 4767->4768 4769 4d992ca-4d992f6 4768->4769 4770 4d992ba-4d992c8 4768->4770 4771 4d992fd-4d99303 4769->4771 4770->4771 4771->4768 4772 4d99305-4d9938a 4771->4772 4773 4d9938b-4d9938e 4772->4773 4774 4d993a0-4d993cc 4773->4774 4775 4d99390-4d9939e 4773->4775 4776 4d993d3-4d993d9 4774->4776 4775->4776 4776->4773 4777 4d993db-4d99500 call 4d77c6d * 3 call 4d9741f call 4da897e 4776->4777 4788 4d99501-4d99504 4777->4788 4789 4d99516-4d99544 4788->4789 4790 4d99506-4d99514 4788->4790 4791 4d9954b-4d99551 4789->4791 4790->4791 4791->4788 4792 4d99553-4d99582 call 4d77c6d 4791->4792 4795 4d99585-4d9958b 4792->4795 4796 4d99779-4d997eb 4795->4796 4797 4d99591-4d995ff call 4d96eff call 4d908e6 call 4d738f8 call 4d8e3b4 4795->4797 4798 4d997ec-4d9981f 4796->4798 4815 4d99751-4d99774 call 4d73943 call 4d816c1 4797->4815 4816 4d99605-4d9974c call 4d96eae call 4d717a1 * 3 call 4d9b820 call 4d974e3 call 4d717a1 * 3 call 4d9b820 call 4d974e3 call 4d97b64 call 4d738f8 4797->4816 4798->4798 4800 4d99821-4d99886 call 4d77c6d call 4d908e6 call 4d8e379 call 4d73943 call 4d738f8 4798->4800 4827 4d9988c-4d99904 4800->4827 4828 4d99c43-4d99cb4 4800->4828 4815->4795 4816->4815 4830 4d99905-4d99908 4827->4830 4832 4d99cb5-4d99cb8 4828->4832 4833 4d9991a-4d99946 4830->4833 4834 4d9990a-4d99918 4830->4834 4836 4d99cca-4d99cf6 4832->4836 4837 4d99cba-4d99cc8 4832->4837 4838 4d9994d-4d99953 4833->4838 4834->4838 4840 4d99cfd-4d99d03 4836->4840 4837->4840 4838->4830 4841 4d99955-4d99a47 call 4d77c6d call 4d96ed7 call 4d908e6 call 4d738f8 * 2 4838->4841 4840->4832 4843 4d99d05-4d99dcd call 4d77c6d call 4d908e6 call 4d738f8 4840->4843 4875 4d99a48-4d99a4b 4841->4875 4864 4d99dce-4d99dd1 4843->4864 4867 4d99de3-4d99e0f 4864->4867 4868 4d99dd3-4d99de1 4864->4868 4871 4d99e16-4d99e1c 4867->4871 4868->4871 4871->4864 4874 4d99e1e-4d99ea2 call 4d77c6d call 4d908e6 call 4d738f8 call 4d8e3b4 4871->4874 4899 4d99ea8-4d99ebf call 4d8e379 4874->4899 4900 4d99f65-4d99f75 4874->4900 4878 4d99a5d-4d99a8b 4875->4878 4879 4d99a4d-4d99a5b 4875->4879 4882 4d99a92-4d99a98 4878->4882 4879->4882 4882->4875 4886 4d99a9a-4d99ae8 call 4d77c6d call 4d8d984 4882->4886 4901 4d99aee 4886->4901 4902 4d99c14-4d99c3e call 4d71a13 call 4d738f8 call 4d73943 4886->4902 4899->4900 4918 4d99ec5-4d99f60 call 4d9750b call 4d96eae call 4d9b42f call 4d738f8 * 2 4899->4918 4903 4d99f7b-4d99f81 4900->4903 4904 4d9a0ad-4d9a14b call 4d816c1 call 4d73943 * 2 call 4d738f8 call 4d91897 call 4d97748 call 4d73943 call 4d849a6 call 4d73943 call 4d73987 4900->4904 4907 4d99af1-4d99af8 4901->4907 4902->4828 4910 4d99f87-4d99f89 4903->4910 4904->4731 4908 4d99afe-4d99bef call 4d96f6a call 4d908ac call 4d96ed7 call 4d738f8 call 4d9b30e call 4d816c1 call 4d738f8 call 4d73943 4907->4908 4909 4d99bf4-4d99c0e call 4d84c7b 4907->4909 4908->4909 4909->4902 4909->4907 4916 4d9a09f-4d9a0a7 4910->4916 4917 4d99f8f-4d9a001 call 4d717a1 call 4d9057d call 4d904f7 call 4d738f8 call 4d9b587 4910->4917 4916->4904 4916->4910 4964 4d9a2a8-4d9a2af 4917->4964 4965 4d9a007-4d9a00e 4917->4965 4918->4900 4966 4d9a2b1-4d9a2b3 4964->4966 4967 4d9a2b5 4964->4967 4970 4d9a070-4d9a087 call 4d738f8 4965->4970 4971 4d9a010-4d9a06a call 4d9af6d call 4d9b108 4965->4971 4972 4d9a2b7-4d9a2c0 4966->4972 4967->4972 4970->4917 4984 4d9a08d-4d9a09c 4970->4984 4971->4964 4971->4970 4979 4d9a2c2 4972->4979 4980 4d9a2c4-4d9a33e call 4d90391 call 4d738f8 call 4d816c1 call 4d73943 * 2 call 4d738f8 call 4d91897 call 4d97748 call 4d82e7d 4972->4980 4979->4980 5008 4d9a340-4d9a379 call 4d73943 call 4d849a6 call 4d73943 call 4d73987 4980->5008 4984->4916 5008->4709
    APIs
      • Part of subcall function 04D77C9C: char_traits.LIBCPMT ref: 04D77CB5
    • _fseek.LIBCMT ref: 04D98FD3
    • _fseek.LIBCMT ref: 04D98FE7
      • Part of subcall function 04DACA22: __lock_file.LIBCMT ref: 04DACA67
      • Part of subcall function 04DACA22: __fseek_nolock.LIBCMT ref: 04DACA76
    • __fread_nolock.LIBCMT ref: 04D9902D
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _fseek$__fread_nolock__fseek_nolock__lock_filechar_traits
    • String ID: C@$#$Y$]K$e$f$r$t
    • API String ID: 15111844-2411602883
    • Opcode ID: 3241dd352ad6c87f7b7aa5b325d757fa4f0f931e758ed4a57b4f2acf04c5f0ae
    • Instruction ID: 6c768c4412ea1ee061577dde58bc8f1df971dd20365e2175aef23f89038e6e57
    • Opcode Fuzzy Hash: 3241dd352ad6c87f7b7aa5b325d757fa4f0f931e758ed4a57b4f2acf04c5f0ae
    • Instruction Fuzzy Hash: B41238B1D0126CAAEF21DB54CC98BDEBBB8AB15304F4041D9D549B7281EB716F88CF61
    Function 04D98EAB Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 441COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5018 4d98eab-4d98eae 5019 4d98eb0-4d98ee5 5018->5019 5020 4d98ee7-4d98f00 5018->5020 5019->5020 5024 4d9a1a9-4d9a24e call 4d71868 call 4d9ac9b 5020->5024 5025 4d98f06 5020->5025 5034 4d9a46f-4d9a47d call 4d739d4 5024->5034 5035 4d9a254-4d9a256 5024->5035 5026 4d98f0f-4d98f78 call 4d77c9c call 4d96ffc call 4d96fd5 call 4d73987 * 2 5025->5026 5052 4d98f7d-4d98fb4 call 4dacea1 5026->5052 5045 4d9a47f-4d9a54e call 4d738f8 * 3 call 4d73987 call 4d738f8 5034->5045 5038 4d9a257-4d9a469 5035->5038 5038->5034 5059 4d98fb9-4d98fbe 5052->5059 5061 4d9a188-4d9a195 call 4d73987 5059->5061 5062 4d98fc4-4d98fc7 5059->5062 5067 4d9a19a-4d9a1a3 5061->5067 5062->5061 5065 4d98fcd-4d98fe7 call 4daca22 call 4dace35 call 4daca22 5062->5065 5076 4d98fec-4d9900d call 4d85c51 5065->5076 5067->5024 5067->5026 5078 4d99012-4d9904e call 4dac8e7 call 4d9b587 5076->5078 5082 4d99053-4d990c5 call 4d849d0 5078->5082 5085 4d990cb-4d990cf 5082->5085 5086 4d9a14d-4d9a153 5082->5086 5085->5086 5089 4d990d5-4d9918d call 4dad30d 5085->5089 5087 4d9a15d-4d9a183 call 4d73943 call 4d849a6 call 4d73943 5086->5087 5088 4d9a155-4d9a159 5086->5088 5087->5061 5088->5087 5095 4d99193-4d99196 5089->5095 5097 4d99198-4d991ac 5095->5097 5098 4d991ae-4d9920c call 4d9b587 5095->5098 5101 4d9920f-4d99215 5097->5101 5098->5101 5101->5095 5103 4d9921b-4d992b4 5101->5103 5104 4d992b5-4d992b8 5103->5104 5105 4d992ca-4d992f6 5104->5105 5106 4d992ba-4d992c8 5104->5106 5107 4d992fd-4d99303 5105->5107 5106->5107 5107->5104 5108 4d99305-4d9938a 5107->5108 5109 4d9938b-4d9938e 5108->5109 5110 4d993a0-4d993cc 5109->5110 5111 4d99390-4d9939e 5109->5111 5112 4d993d3-4d993d9 5110->5112 5111->5112 5112->5109 5113 4d993db-4d99500 call 4d77c6d * 3 call 4d9741f call 4da897e 5112->5113 5124 4d99501-4d99504 5113->5124 5125 4d99516-4d99544 5124->5125 5126 4d99506-4d99514 5124->5126 5127 4d9954b-4d99551 5125->5127 5126->5127 5127->5124 5128 4d99553-4d99582 call 4d77c6d 5127->5128 5131 4d99585-4d9958b 5128->5131 5132 4d99779-4d997eb 5131->5132 5133 4d99591-4d995ff call 4d96eff call 4d908e6 call 4d738f8 call 4d8e3b4 5131->5133 5134 4d997ec-4d9981f 5132->5134 5151 4d99751-4d99774 call 4d73943 call 4d816c1 5133->5151 5152 4d99605-4d9974c call 4d96eae call 4d717a1 * 3 call 4d9b820 call 4d974e3 call 4d717a1 * 3 call 4d9b820 call 4d974e3 call 4d97b64 call 4d738f8 5133->5152 5134->5134 5136 4d99821-4d99886 call 4d77c6d call 4d908e6 call 4d8e379 call 4d73943 call 4d738f8 5134->5136 5163 4d9988c-4d99904 5136->5163 5164 4d99c43-4d99cb4 5136->5164 5151->5131 5152->5151 5166 4d99905-4d99908 5163->5166 5168 4d99cb5-4d99cb8 5164->5168 5169 4d9991a-4d99946 5166->5169 5170 4d9990a-4d99918 5166->5170 5172 4d99cca-4d99cf6 5168->5172 5173 4d99cba-4d99cc8 5168->5173 5174 4d9994d-4d99953 5169->5174 5170->5174 5176 4d99cfd-4d99d03 5172->5176 5173->5176 5174->5166 5177 4d99955-4d99a47 call 4d77c6d call 4d96ed7 call 4d908e6 call 4d738f8 * 2 5174->5177 5176->5168 5179 4d99d05-4d99dcd call 4d77c6d call 4d908e6 call 4d738f8 5176->5179 5211 4d99a48-4d99a4b 5177->5211 5200 4d99dce-4d99dd1 5179->5200 5203 4d99de3-4d99e0f 5200->5203 5204 4d99dd3-4d99de1 5200->5204 5207 4d99e16-4d99e1c 5203->5207 5204->5207 5207->5200 5210 4d99e1e-4d99ea2 call 4d77c6d call 4d908e6 call 4d738f8 call 4d8e3b4 5207->5210 5235 4d99ea8-4d99ebf call 4d8e379 5210->5235 5236 4d99f65-4d99f75 5210->5236 5214 4d99a5d-4d99a8b 5211->5214 5215 4d99a4d-4d99a5b 5211->5215 5218 4d99a92-4d99a98 5214->5218 5215->5218 5218->5211 5222 4d99a9a-4d99ae8 call 4d77c6d call 4d8d984 5218->5222 5237 4d99aee 5222->5237 5238 4d99c14-4d99c3e call 4d71a13 call 4d738f8 call 4d73943 5222->5238 5235->5236 5254 4d99ec5-4d99f60 call 4d9750b call 4d96eae call 4d9b42f call 4d738f8 * 2 5235->5254 5239 4d99f7b-4d99f81 5236->5239 5240 4d9a0ad-4d9a14b call 4d816c1 call 4d73943 * 2 call 4d738f8 call 4d91897 call 4d97748 call 4d73943 call 4d849a6 call 4d73943 call 4d73987 5236->5240 5243 4d99af1-4d99af8 5237->5243 5238->5164 5246 4d99f87-4d99f89 5239->5246 5240->5067 5244 4d99afe-4d99bef call 4d96f6a call 4d908ac call 4d96ed7 call 4d738f8 call 4d9b30e call 4d816c1 call 4d738f8 call 4d73943 5243->5244 5245 4d99bf4-4d99c0e call 4d84c7b 5243->5245 5244->5245 5245->5238 5245->5243 5252 4d9a09f-4d9a0a7 5246->5252 5253 4d99f8f-4d9a001 call 4d717a1 call 4d9057d call 4d904f7 call 4d738f8 call 4d9b587 5246->5253 5252->5240 5252->5246 5300 4d9a2a8-4d9a2af 5253->5300 5301 4d9a007-4d9a00e 5253->5301 5254->5236 5302 4d9a2b1-4d9a2b3 5300->5302 5303 4d9a2b5 5300->5303 5306 4d9a070-4d9a087 call 4d738f8 5301->5306 5307 4d9a010-4d9a06a call 4d9af6d call 4d9b108 5301->5307 5308 4d9a2b7-4d9a2c0 5302->5308 5303->5308 5306->5253 5320 4d9a08d-4d9a09c 5306->5320 5307->5300 5307->5306 5315 4d9a2c2 5308->5315 5316 4d9a2c4-4d9a32b call 4d90391 call 4d738f8 call 4d816c1 call 4d73943 * 2 call 4d738f8 call 4d91897 call 4d97748 5308->5316 5315->5316 5343 4d9a330-4d9a33e call 4d82e7d 5316->5343 5320->5252 5344 4d9a340-4d9a379 call 4d73943 call 4d849a6 call 4d73943 call 4d73987 5343->5344 5344->5045
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _fseek$__fread_nolock
    • String ID: C@$#$Y$]K$e$f$r$t
    • API String ID: 1795926144-2411602883
    • Opcode ID: 900d8b4765faa08b8f93b6f77b1a30e8e64cb852209fda78c7e73d2c79bf42cb
    • Instruction ID: 81210b191a256c73855b73b61dd3f8c22471db31bbaabb7e778571b9e864a558
    • Opcode Fuzzy Hash: 900d8b4765faa08b8f93b6f77b1a30e8e64cb852209fda78c7e73d2c79bf42cb
    • Instruction Fuzzy Hash: 281237B1D0126CAAEF21DB54CC98BDEBBB8AB15308F4041D9D549B7241EB716F88CF61
    Function 04D825AC Relevance: 18.2, APIs: 12, Instructions: 178windowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5354 4d825ac-4d825ce call 4d71868 5357 4d825e0-4d825e3 5354->5357 5358 4d825d0-4d825dd 5357->5358 5359 4d825e5-4d825e8 5357->5359 5358->5357 5360 4d825f8-4d825fb 5359->5360 5361 4d825ea-4d825f5 5360->5361 5362 4d825fd-4d82600 5360->5362 5361->5360 5363 4d8260c-4d82610 5362->5363 5364 4d82602-4d82609 5363->5364 5365 4d82612-4d8261b 5363->5365 5364->5363 5366 4d8265c-4d82660 5365->5366 5367 4d8261d-4d8262c 5366->5367 5368 4d82662-4d82673 call 4d739d4 call 4d827dd 5366->5368 5369 4d82653-4d82657 5367->5369 5378 4d8267c-4d82691 call 4d80806 call 4d82421 5368->5378 5379 4d82675-4d82677 5368->5379 5371 4d82659 5369->5371 5372 4d8262e-4d82635 5369->5372 5371->5366 5374 4d82650 5372->5374 5375 4d82637-4d8264e GetDesktopWindow GetDC GetTextExtentPointW 5372->5375 5374->5369 5375->5374 5378->5379 5385 4d82693-4d826aa 5378->5385 5381 4d827d5-4d827da 5379->5381 5386 4d826ac-4d826be 5385->5386 5387 4d826c2-4d826c9 5385->5387 5386->5386 5388 4d826c0 5386->5388 5389 4d82736-4d8273a 5387->5389 5388->5387 5390 4d826cb-4d826d9 5389->5390 5391 4d8273c-4d82742 5389->5391 5394 4d826e8-4d826eb 5390->5394 5395 4d826db-4d826e6 GetSysColorBrush 5390->5395 5392 4d8275d-4d82764 call 4d82852 5391->5392 5393 4d82744-4d8275b 5391->5393 5400 4d82769-4d8276b 5392->5400 5393->5392 5393->5393 5397 4d8272d-4d82731 5394->5397 5395->5394 5398 4d826ed-4d826f4 5397->5398 5399 4d82733 5397->5399 5403 4d82702-4d82709 5398->5403 5404 4d826f6-4d82700 GetDesktopWindow SetWindowTextW 5398->5404 5399->5389 5401 4d82779-4d82788 5400->5401 5402 4d8276d-4d82774 call 4d82800 5400->5402 5406 4d827a9-4d827b6 5401->5406 5407 4d8278a-4d82790 5401->5407 5402->5379 5408 4d8272a 5403->5408 5409 4d8270b-4d82728 FormatMessageW 5403->5409 5404->5403 5412 4d827d3 5406->5412 5413 4d827b8-4d827cd GetDesktopWindow GetDC SetViewportExtEx 5406->5413 5411 4d82792-4d827a7 GetDesktopWindow SetDlgItemInt 5407->5411 5407->5412 5408->5397 5409->5408 5411->5412 5412->5381 5413->5412
    APIs
    • GetDesktopWindow.USER32 ref: 04D8263E
    • GetDC.USER32(00000000), ref: 04D82641
    • GetTextExtentPointW.GDI32(00000000,?,?), ref: 04D82648
    • GetSysColorBrush.USER32(0000196A), ref: 04D826E0
    • GetDesktopWindow.USER32 ref: 04D826F7
    • SetWindowTextW.USER32(00000000), ref: 04D826FA
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000002,00000021,00000003,?,?,?,00000000,00000000), ref: 04D82722
    • GetDesktopWindow.USER32 ref: 04D8279E
    • SetDlgItemInt.USER32(00000000,?,?), ref: 04D827A1
    • GetDesktopWindow.USER32 ref: 04D827C3
    • GetDC.USER32(00000000), ref: 04D827C6
    • SetViewportExtEx.GDI32(00000000,?,?), ref: 04D827CD
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatItemMessagePointViewport
    • String ID:
    • API String ID: 1998102902-0
    • Opcode ID: 88e0c22347199db3bad8911975488e66c986957782dc67211ec8446cff9da052
    • Instruction ID: 5876e4f7e11a7fd8c27d3ab4c5fdd5a0b0801d1f084aea1cc03bf3dfc618209d
    • Opcode Fuzzy Hash: 88e0c22347199db3bad8911975488e66c986957782dc67211ec8446cff9da052
    • Instruction Fuzzy Hash: 6F615AB0E00248FFDB11AFA5C8496BEBFB4FF45315F10C49EE855AA281D774A685CB60
    Function 04DB4F40 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 194COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5744 4db4f40-4db4f43 5745 4db4f68-4db4f6d 5744->5745 5746 4db4f45-4db4f48 5744->5746 5747 4db4f77-4db4f83 5745->5747 5748 4db4f4a-4db4f55 call 4dabf95 call 4db0efc 5746->5748 5749 4db4f61-4db4f74 5746->5749 5751 4db4f89 5747->5751 5752 4db5150-4db5162 5747->5752 5765 4db4f5a-4db4f5c 5748->5765 5749->5747 5755 4db4f90-4db4f92 5751->5755 5752->5748 5761 4db5168-4db5178 call 4db9418 5752->5761 5758 4db4f98-4db4f9e 5755->5758 5759 4db509f-4db50a4 5755->5759 5762 4db502e-4db5031 5758->5762 5763 4db4fa4 5758->5763 5759->5752 5764 4db50aa-4db50ad 5759->5764 5773 4db517d-4db5182 5761->5773 5769 4db5083-4db5088 5762->5769 5770 4db5033-4db5036 5762->5770 5767 4db501c-4db5020 5763->5767 5768 4db4fa6-4db4fa9 5763->5768 5771 4db50b2-4db50b5 5764->5771 5772 4db51a7-4db51ad 5765->5772 5774 4db508a-4db508c 5767->5774 5776 4db5022-4db502c 5767->5776 5777 4db4faf-4db4fb2 5768->5777 5778 4db5090-4db5099 5768->5778 5769->5774 5775 4db508e 5769->5775 5779 4db5038-4db5039 5770->5779 5780 4db5073-4db5079 5770->5780 5781 4db50af 5771->5781 5782 4db50b7-4db50c9 call 4db82ce 5771->5782 5773->5765 5784 4db5188-4db51a4 5773->5784 5774->5778 5775->5778 5776->5778 5785 4db5006-4db5009 5777->5785 5786 4db4fb4-4db4fb5 5777->5786 5778->5755 5778->5759 5787 4db503b-4db503e 5779->5787 5788 4db5066-4db5068 5779->5788 5780->5774 5783 4db507b-4db5081 5780->5783 5781->5771 5782->5748 5801 4db50cf-4db50d5 5782->5801 5783->5778 5784->5772 5785->5774 5791 4db500b-4db501a 5785->5791 5792 4db4ffa-4db5001 5786->5792 5793 4db4fb7-4db4fba 5786->5793 5794 4db5059-4db505b 5787->5794 5795 4db5040-4db5043 5787->5795 5788->5774 5790 4db506a-4db5071 5788->5790 5790->5778 5791->5778 5792->5774 5797 4db4fe9-4db4fec 5793->5797 5798 4db4fbc-4db4fbf 5793->5798 5794->5774 5800 4db505d-4db5064 5794->5800 5795->5748 5799 4db5049-4db504f 5795->5799 5797->5774 5803 4db4ff2-4db4ff5 5797->5803 5804 4db4fde-4db4fe4 5798->5804 5805 4db4fc1-4db4fc4 5798->5805 5799->5774 5806 4db5051-4db5057 5799->5806 5800->5778 5802 4db50da-4db50dd 5801->5802 5807 4db50df-4db50e3 5802->5807 5808 4db50d7 5802->5808 5803->5778 5804->5778 5805->5748 5809 4db4fc6-4db4fc9 5805->5809 5806->5778 5807->5748 5810 4db50e9-4db50ef 5807->5810 5808->5802 5809->5774 5811 4db4fcf-4db4fd9 5809->5811 5810->5810 5812 4db50f1-4db5103 call 4db9436 5810->5812 5811->5778 5815 4db5110-4db5122 call 4db9436 5812->5815 5816 4db5105-4db510e 5812->5816 5819 4db512f-4db5141 call 4db9436 5815->5819 5820 4db5124-4db512d 5815->5820 5816->5752 5819->5748 5823 4db5147-4db514a 5819->5823 5820->5752 5823->5752
    APIs
    • __wcsnicmp.LIBCMT ref: 04DB50F9
    • __wcsnicmp.LIBCMT ref: 04DB5118
      • Part of subcall function 04DABF95: __getptd_noexit.LIBCMT ref: 04DABF95
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: __wcsnicmp$__getptd_noexit
    • String ID: UNICODE$UTF-16LE$UTF-8$ccs
    • API String ID: 78897640-3573488595
    • Opcode ID: 17615e9e6a9f76fefd754ede959f0ae187c9695e0ac657d0e5e4794325628fbc
    • Instruction ID: ddea9b7e50f53f389da4b3d4b0886b973ccbea67d75a19ffcaffd9c26bfe46fd
    • Opcode Fuzzy Hash: 17615e9e6a9f76fefd754ede959f0ae187c9695e0ac657d0e5e4794325628fbc
    • Instruction Fuzzy Hash: 74513372F04702FAEB344E69B825BF53690BB0435CF18456AEDCB97281F6B4F28096D1
    Function 04D9600C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 495COMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5824 4d9600c-4d96023 call 4da92b8 5827 4d96029-4d9602d 5824->5827 5828 4d96656-4d9665c 5824->5828 5831 4d96631-4d9663d 5827->5831 5832 4d96033-4d9603f 5827->5832 5829 4d9666c-4d9666d GetFileSize 5828->5829 5830 4d9665e-4d9666a ExtCreateRegion 5828->5830 5834 4d96673-4d96683 5829->5834 5830->5834 5833 4d9663f 5831->5833 5831->5834 5835 4d96052-4d96056 5832->5835 5836 4d96642-4d96652 5833->5836 5837 4d96058-4d9605e 5835->5837 5838 4d96041-4d9604f 5835->5838 5836->5836 5839 4d96654 5836->5839 5840 4d960ae-4d960b3 5837->5840 5841 4d96060-4d96086 call 4d9555e 5837->5841 5838->5835 5839->5834 5842 4d960bf-4d96103 call 4d71868 call 4d9555e 5840->5842 5843 4d960b5-4d960ba 5840->5843 5848 4d960a9-4d960ac 5841->5848 5849 4d96088-4d960a6 call 4d9600c 5841->5849 5854 4d96150-4d96154 5842->5854 5843->5834 5848->5840 5848->5841 5849->5848 5855 4d96105-4d96113 5854->5855 5856 4d96156-4d96183 call 4d739d4 call 4d79122 5854->5856 5858 4d96125-4d96128 5855->5858 5859 4d96115-4d96122 call 4d95da7 5855->5859 5856->5843 5873 4d96189-4d961f0 call 4dac540 call 4d71868 * 2 call 4d94b73 5856->5873 5862 4d96147-4d9614b 5858->5862 5859->5858 5863 4d9612a-4d96131 5862->5863 5864 4d9614d 5862->5864 5868 4d96133-4d96141 call 4d95fc5 5863->5868 5869 4d96144 5863->5869 5864->5854 5868->5869 5869->5862 5882 4d96205-4d96208 5873->5882 5883 4d9620a-4d96211 5882->5883 5884 4d961f2-4d96202 5882->5884 5885 4d96228-4d9622e 5883->5885 5886 4d96213-4d96225 call 4d95e39 5883->5886 5884->5882 5888 4d96231-4d96242 5885->5888 5886->5885 5890 4d96252-4d96256 5888->5890 5891 4d96258-4d96262 5890->5891 5892 4d96244-4d9624f 5890->5892 5893 4d96268-4d9629e call 4d71868 5891->5893 5894 4d9633f-4d96360 call 4d9456b 5891->5894 5892->5890 5899 4d962b3-4d962b6 5893->5899 5894->5888 5900 4d96366-4d9637f call 4d739d4 * 2 5894->5900 5901 4d962b8-4d962bb 5899->5901 5902 4d962a0-4d962b0 5899->5902 5911 4d96381-4d96383 5900->5911 5912 4d96387-4d96393 5900->5912 5904 4d962cb-4d962ce 5901->5904 5902->5899 5907 4d962bd-4d962c8 5904->5907 5908 4d962d0-4d96339 call 4d739d4 5904->5908 5907->5904 5908->5893 5908->5894 5911->5912 5914 4d963a6-4d963aa 5912->5914 5915 4d963ac-4d963b2 5914->5915 5916 4d96395-4d963a3 5914->5916 5917 4d963b4-4d963e4 call 4d95f6e call 4d94b73 5915->5917 5918 4d963e6-4d9640c call 4d79122 GetVolumeInformationW 5915->5918 5916->5914 5917->5918 5918->5843 5924 4d96412-4d9641f 5918->5924 5925 4d9642f-4d96432 5924->5925 5927 4d96421-4d9642c 5925->5927 5928 4d96434-4d9643e 5925->5928 5927->5925 5929 4d964f1-4d964f4 5928->5929 5930 4d964fa-4d9655c call 4d71868 call 4d95ca7 5929->5930 5931 4d96443-4d9644d 5929->5931 5946 4d9655e-4d96581 5930->5946 5947 4d96587-4d96589 5930->5947 5932 4d964cd-4d964d0 5931->5932 5934 4d9644f-4d96452 5932->5934 5935 4d964d6-4d964d9 5932->5935 5938 4d96465-4d96469 5934->5938 5937 4d964e9-4d964ec 5935->5937 5940 4d964db-4d964e6 5937->5940 5941 4d964ee 5937->5941 5942 4d9646b-4d9646e 5938->5942 5943 4d96454-4d96462 5938->5943 5940->5937 5941->5929 5945 4d9647e-4d96481 5942->5945 5943->5938 5949 4d96470-4d9647b 5945->5949 5950 4d96483-4d9648a 5945->5950 5946->5947 5951 4d96583-4d96585 5946->5951 5948 4d9658a-4d9659f 5947->5948 5952 4d965db-4d965de 5948->5952 5953 4d965a1-4d965a7 5948->5953 5949->5945 5954 4d9648c-4d964b0 call 4d943b5 5950->5954 5955 4d964b1-4d964b7 5950->5955 5951->5948 5957 4d9661b-4d9661f 5952->5957 5956 4d965d4-4d965d7 5953->5956 5954->5955 5959 4d964b9-4d964c3 5955->5959 5960 4d964ca 5955->5960 5962 4d965a9-4d965b5 5956->5962 5963 4d965d9 5956->5963 5964 4d96621-4d9662f call 4d739d4 5957->5964 5965 4d965e0-4d96618 call 4d95ca7 5957->5965 5959->5960 5961 4d964c5-4d964c8 5959->5961 5960->5932 5961->5959 5961->5960 5967 4d965c0-4d965d1 5962->5967 5968 4d965b7-4d965bd 5962->5968 5963->5964 5964->5834 5965->5957 5967->5956 5968->5967
    APIs
    • __EH_prolog.LIBCMT ref: 04D96011
    • GetVolumeInformationW.KERNEL32(00000002,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000003,00000003), ref: 04D96408
    • ExtCreateRegion.GDI32(00000000,0000254C,00000000), ref: 04D96664
    • GetFileSize.KERNEL32(00000000,00000000,00000002,00000004,00000000), ref: 04D9666D
      • Part of subcall function 04D95CA7: GetDesktopWindow.USER32 ref: 04D95CC6
      • Part of subcall function 04D95CA7: SetDlgItemTextW.USER32(00000000,?,04D95559), ref: 04D95CCD
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: CreateDesktopFileH_prologInformationItemRegionSizeTextVolumeWindow
    • String ID: !$x(
    • API String ID: 2925256546-3571294847
    • Opcode ID: 048d216a037152410d8069d4cfd1f63dbf0bf219969f52b793ec3ab9c7b29e82
    • Instruction ID: b9a88fc7848cff632e70d840c20782b6be9cea0b871eab3a19c128e2dedade56
    • Opcode Fuzzy Hash: 048d216a037152410d8069d4cfd1f63dbf0bf219969f52b793ec3ab9c7b29e82
    • Instruction Fuzzy Hash: EA1245B0E4421AEFEF10DF98C991AEEB7F5FB04304F104469E915BB281D7B5AA44CB61
    Function 04D80806 Relevance: 10.6, APIs: 7, Instructions: 135windowCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 5973 4d80806-4d80829 call 4d71868 5976 4d8083b-4d8083e 5973->5976 5977 4d8082b-4d80838 5976->5977 5978 4d80840-4d80843 5976->5978 5977->5976 5979 4d80853-4d80856 5978->5979 5980 4d80858-4d8085b 5979->5980 5981 4d80845-4d80850 5979->5981 5982 4d80867-4d8086b 5980->5982 5981->5979 5983 4d8085d-4d80864 5982->5983 5984 4d8086d-4d80876 5982->5984 5983->5982 5985 4d808b4-4d808b8 5984->5985 5986 4d80878-4d80887 5985->5986 5987 4d808ba-4d808cc call 4d739d4 call 4d81268 5985->5987 5988 4d808ab-4d808af 5986->5988 5997 4d8098f-4d80997 call 4d820be 5987->5997 5998 4d808d2-4d808e5 5987->5998 5990 4d80889-4d8088f 5988->5990 5991 4d808b1 5988->5991 5994 4d808a8 5990->5994 5995 4d80891-4d808a2 GetDesktopWindow GetDC GetTextExtentPointW 5990->5995 5991->5985 5994->5988 5995->5994 6003 4d8099c-4d809a2 5997->6003 5999 4d808f5-4d808f9 5998->5999 6001 4d808fb-4d80902 5999->6001 6002 4d808e7-4d808f2 5999->6002 6004 4d80966-4d8096a 6001->6004 6002->5999 6005 4d8096c-4d80972 6004->6005 6006 4d80904-4d80911 6004->6006 6005->6003 6007 4d80974-4d8098b 6005->6007 6008 4d8091e-4d80921 6006->6008 6009 4d80913-4d80918 GetSysColorBrush 6006->6009 6007->6007 6010 4d8098d 6007->6010 6011 4d8095d-4d80961 6008->6011 6009->6008 6010->6003 6012 4d80923-4d80929 6011->6012 6013 4d80963 6011->6013 6014 4d8092b-4d8092f GetDesktopWindow SetWindowTextW 6012->6014 6015 4d80935-4d8093b 6012->6015 6013->6004 6014->6015 6016 4d8095a 6015->6016 6017 4d8093d-4d80954 FormatMessageW 6015->6017 6016->6011 6017->6016
    APIs
    • GetDesktopWindow.USER32 ref: 04D80898
    • GetDC.USER32(00000000), ref: 04D8089B
    • GetTextExtentPointW.GDI32(00000000), ref: 04D808A2
    • GetSysColorBrush.USER32(0000196A), ref: 04D80918
    • GetDesktopWindow.USER32 ref: 04D8092C
    • SetWindowTextW.USER32(00000000), ref: 04D8092F
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,75A89CE0,?,00000000), ref: 04D80954
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$DesktopText$BrushColorExtentFormatMessagePoint
    • String ID:
    • API String ID: 627555471-0
    • Opcode ID: 9e64fca325f04e780376efd24a93a0f52a05c6e7e158305946de6e2f996842b6
    • Instruction ID: 1740f555f34d6a5c0a7f2747023d8938547d976a0f8419d8d3f9d73808f6b9ec
    • Opcode Fuzzy Hash: 9e64fca325f04e780376efd24a93a0f52a05c6e7e158305946de6e2f996842b6
    • Instruction Fuzzy Hash: E05147B0E0020CFFEB11EF99C4949ADBBB4FB05315F15C15EE9696A241D334A689CF90
    Function 04DB8F22 Relevance: 10.6, APIs: 7, Instructions: 62fileCOMMON
    Download Yara Rule

    Control-flow Graph

    • Executed
    • Not Executed
    control_flow_graph 6018 4db8f22-4db8f30 6019 4db8f63-4db8f88 GetLastError call 4dabf74 6018->6019 6020 4db8f32-4db8f36 6018->6020 6025 4db8f89-4db9408 call 4dabf95 6019->6025 6020->6019 6022 4db8f38-4db8f61 call 4db8b74 6020->6022 6022->6019 6028 4db8f95-4db8f9e GetFileType 6022->6028 6030 4db8fa0-4db8fd3 GetLastError call 4dabf74 CloseHandle 6028->6030 6030->6025 6034 4db8fd5-4db8fe0 call 4dabf95 6030->6034 6034->6025
    APIs
    • ___createFile.LIBCMT ref: 04DB8F53
      • Part of subcall function 04DB8B74: ___crtIsPackagedApp.LIBCMT ref: 04DB8B7A
      • Part of subcall function 04DB8B74: GetModuleHandleW.KERNEL32(kernel32.dll,CreateFile2,00000001,?,00000001,?,00000000,00000109), ref: 04DB8B8D
      • Part of subcall function 04DB8B74: GetProcAddress.KERNEL32(00000000), ref: 04DB8B94
    • GetLastError.KERNEL32 ref: 04DB8F7C
    • __dosmaperr.LIBCMT ref: 04DB8F83
    • GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 04DB8F96
    • GetLastError.KERNEL32 ref: 04DB8FB9
    • __dosmaperr.LIBCMT ref: 04DB8FC2
    • CloseHandle.KERNEL32(?), ref: 04DB8FCB
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: ErrorFileHandleLast__dosmaperr$AddressCloseModulePackagedProcType___create___crt
    • String ID:
    • API String ID: 569456945-0
    • Opcode ID: 3b9445919200a701da683f157c2604a5fa54d79e3f392c9b87ff011fca97d56b
    • Instruction ID: 6b2163d996bb1fb4c95a6fa7bc397f1184abe15bdd17b289f3cf35bb3d9e5a7a
    • Opcode Fuzzy Hash: 3b9445919200a701da683f157c2604a5fa54d79e3f392c9b87ff011fca97d56b
    • Instruction Fuzzy Hash: D211E431B00202DFEB096F64DC54AAD7B25FF05214B18421AF9638B3D0DB39F811EB90
    Function 04DAFC30 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE
    Download Yara Rule

    Control-flow Graph

    APIs
    • __init_pointers.LIBCMT ref: 04DAFC30
      • Part of subcall function 04DAEAFE: EncodePointer.KERNEL32(00000000,00000001,04DAFC35,04DAD4DC,04DC8CE0,00000008,04DAD6A2,?,00000001,?,04DC8D00,0000000C,04DAD641,?,00000001,?), ref: 04DAEB01
      • Part of subcall function 04DAEAFE: __initp_misc_winsig.LIBCMT ref: 04DAEB1C
      • Part of subcall function 04DAEAFE: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 04DB59AD
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 04DB59C1
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 04DB59D4
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 04DB59E7
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 04DB59FA
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 04DB5A0D
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 04DB5A20
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 04DB5A33
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 04DB5A46
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 04DB5A59
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 04DB5A6C
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 04DB5A7F
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 04DB5A92
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 04DB5AA5
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 04DB5AB8
      • Part of subcall function 04DAEAFE: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 04DB5ACB
    • __mtinitlocks.LIBCMT ref: 04DAFC35
    • __mtterm.LIBCMT ref: 04DAFC3E
      • Part of subcall function 04DAFCA6: DeleteCriticalSection.KERNEL32(?,?,?,?,04DAD5A7,04DAD58D,04DC8CE0,00000008,04DAD6A2,?,00000001,?,04DC8D00,0000000C,04DAD641,?), ref: 04DB60BE
      • Part of subcall function 04DAFCA6: _free.LIBCMT ref: 04DB60C5
      • Part of subcall function 04DAFCA6: DeleteCriticalSection.KERNEL32(04DCC4B8,?,?,04DAD5A7,04DAD58D,04DC8CE0,00000008,04DAD6A2,?,00000001,?,04DC8D00,0000000C,04DAD641,?,00000001), ref: 04DB60E7
    • __calloc_crt.LIBCMT ref: 04DAFC63
    • __initptd.LIBCMT ref: 04DAFC85
    • GetCurrentThreadId.KERNEL32 ref: 04DAFC8C
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
    • String ID:
    • API String ID: 3567560977-0
    • Opcode ID: ef02e65ff7d81e6768fbe31e1a743ae17d84a112a07221039d3a2607c8b3e8cc
    • Instruction ID: 0325c575c1b6e1097e361351e01cab1df330faf6fcbb9be26040672a159ee5b4
    • Opcode Fuzzy Hash: ef02e65ff7d81e6768fbe31e1a743ae17d84a112a07221039d3a2607c8b3e8cc
    • Instruction Fuzzy Hash: 01F02B3230A3126AF6347B757C52A8B2B80DF01378B100A5DE8A5D61D4EF14F41185F0
    Function 04DAC722 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
    • String ID:
    • API String ID: 3877424927-0
    • Opcode ID: 489aa8885060dc1f206dc58b40215f1e2c3fff13f482bd878ea38537d7812e47
    • Instruction ID: d2a3a04fdc6bb372c749cfaaf9f848f675335561d69e7249e30c0ccda470d25f
    • Opcode Fuzzy Hash: 489aa8885060dc1f206dc58b40215f1e2c3fff13f482bd878ea38537d7812e47
    • Instruction Fuzzy Hash: B351C230B10309DBEB248F79C88066E77A1BF41B30F148729E875962D0E770F9719B92
    Function 04D95B6B Relevance: 6.1, APIs: 4, Instructions: 100COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentH_prologPoint32TextWindow
    • String ID:
    • API String ID: 4235267150-0
    • Opcode ID: e68d06b41ad6247b2388806c6c1779f07d5541e547b9d44f8989ff6eae5863eb
    • Instruction ID: eacfbadee57b36ef3c8580422471137a5c814ad1b8567b69c34824092296d562
    • Opcode Fuzzy Hash: e68d06b41ad6247b2388806c6c1779f07d5541e547b9d44f8989ff6eae5863eb
    • Instruction Fuzzy Hash: 7531C772905245FEEF11DF60EDA4AEE7BE9EB05318F140169E845E7380D735AD04CBA1
    Function 04DA7B07 Relevance: 6.1, APIs: 4, Instructions: 70windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04DA7B57
    • GetDesktopWindow.USER32 ref: 04DA7B6B
    • SetWindowTextW.USER32(00000000), ref: 04DA7B72
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000002,00000000), ref: 04DA7B97
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: d61e758aa5bbae0c3d7d81d1e974cae70bfe7f50b5408f40a64c11d4515e9d61
    • Instruction ID: 262518a1cb59fef20d310f010093757a405bf079e4aa30f2ccc97c849fe79f29
    • Opcode Fuzzy Hash: d61e758aa5bbae0c3d7d81d1e974cae70bfe7f50b5408f40a64c11d4515e9d61
    • Instruction Fuzzy Hash: 8E2157B0E4430CFFEB00DF98D4949ADBF78EB04315F148199E85167381C3359A98CB50
    Function 04D97843 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _memcmp
    • String ID: h.I$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 2931989736-3166254412
    • Opcode ID: 4b7e77bb818eb6550f78a5edf61150678d8b24c53a9da0acf4a4e74350b63b28
    • Instruction ID: 2f1867b13b6dee0257aed7308e1799633ab63030ad014b2054df64917d9eacc8
    • Opcode Fuzzy Hash: 4b7e77bb818eb6550f78a5edf61150678d8b24c53a9da0acf4a4e74350b63b28
    • Instruction Fuzzy Hash: 2A11E23170421EFFEF049E689C41DEA37AAEB04704F104524FE14EB5D1E2B2ED218AE5
    Function 04D7315C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • _Allocate.LIBCPMT ref: 04D73182
    • std::_Xinvalid_argument.LIBCPMT ref: 04D731A1
      • Part of subcall function 04DA8863: std::exception::exception.LIBCMT ref: 04DA8876
      • Part of subcall function 04DA8863: __CxxThrowException@8.LIBCMT ref: 04DA888B
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 2227214630-3797114014
    • Opcode ID: 60f60e57e04d8dc213b308a0dabe58bbf2528177431f8ea2f13aab4561af154e
    • Instruction ID: ada2f777b9a20fadaa7ea606155f0254a1dc63167e56ba73e99cc5c3291c8ade
    • Opcode Fuzzy Hash: 60f60e57e04d8dc213b308a0dabe58bbf2528177431f8ea2f13aab4561af154e
    • Instruction Fuzzy Hash: EDF0A072104345AF9720DF29D4404A6B7E8EA56670320883FDDE9C3650FA30F4419B61
    Function 04DA7DA6 Relevance: 4.6, APIs: 3, Instructions: 74COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04DA7E31
    • GetDC.USER32(00000000), ref: 04DA7E38
    • GetTextExtentPointW.GDI32(00000000), ref: 04DA7E3F
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentPointTextWindow
    • String ID:
    • API String ID: 2168015606-0
    • Opcode ID: 71ed35dcb02656b4a4d898e3dd079b510e7d5a9a1d35b94afdf61a4fc8502ac8
    • Instruction ID: 7d7f3888bec6512eeadf66b7a41c8e0534cf1bebe0f86148dbf0f630e58d48cd
    • Opcode Fuzzy Hash: 71ed35dcb02656b4a4d898e3dd079b510e7d5a9a1d35b94afdf61a4fc8502ac8
    • Instruction Fuzzy Hash: B82124B0E00209EFDF119FA4C8959EEFFB8FF04719F5084AAE55566241D734AA91CF90
    Function 04DA8A6D Relevance: 4.5, APIs: 3, Instructions: 29COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • _malloc.LIBCMT ref: 04DA8A85
      • Part of subcall function 04DAC44C: __FF_MSGBANNER.LIBCMT ref: 04DAC463
      • Part of subcall function 04DAC44C: __NMSG_WRITE.LIBCMT ref: 04DAC46A
      • Part of subcall function 04DAC44C: RtlAllocateHeap.NTDLL(030F0000,00000000,00000001,00000001,04D918DB,04D918DB,?,04DABDB1,00000001,00000000,00000003,00000000,?,04DABCEB,04DA887B,?), ref: 04DAC48F
    • std::exception::exception.LIBCMT ref: 04DA8AA3
    • __CxxThrowException@8.LIBCMT ref: 04DA8AB8
      • Part of subcall function 04DA9254: RaiseException.KERNEL32(?,?,04DA8890,04D918DB,00000003,?,?,?,?,?,04DA8890,04D918DB,04DC8A94,00000003), ref: 04DA92A9
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
    • String ID:
    • API String ID: 3074076210-0
    • Opcode ID: 06b42f43b10f08b5c0b1045d9bd09ab9a8ec7f90a691c54d7750d572fcdbd42c
    • Instruction ID: 0167a9416660ba57be466d6743f86fc04f728f630cf957b25bd1c3533015d115
    • Opcode Fuzzy Hash: 06b42f43b10f08b5c0b1045d9bd09ab9a8ec7f90a691c54d7750d572fcdbd42c
    • Instruction Fuzzy Hash: BEE0307060420AA6EB01FBA4CC008AF7778EF00218F508565AC14A6691EF71FA25A5A1
    Function 04DAC902 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: __lock_file_memset
    • String ID:
    • API String ID: 26237723-0
    • Opcode ID: 52f1cbc98947fa1b8a001d047cb3efa54debe4612aec9751f8b6e13b1b3d4a94
    • Instruction ID: d2143fe76c3bd05adbb46bf3ec2b150b7343b59b42672e173830aac26ea6067f
    • Opcode Fuzzy Hash: 52f1cbc98947fa1b8a001d047cb3efa54debe4612aec9751f8b6e13b1b3d4a94
    • Instruction Fuzzy Hash: 2D01D471A00309EBDF22AF698C0099E7B61FF45735F088515F81416150D731E631DFA1
    Function 04DAC6AB Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
    Download Yara Rule
    APIs
      • Part of subcall function 04DABF95: __getptd_noexit.LIBCMT ref: 04DABF95
    • __lock_file.LIBCMT ref: 04DAC6F0
      • Part of subcall function 04DB3959: __lock.LIBCMT ref: 04DB397C
    • __fclose_nolock.LIBCMT ref: 04DAC6FB
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
    • String ID:
    • API String ID: 2800547568-0
    • Opcode ID: e2de542e199bbb59c7310b0364f9dc59700c941973c4010b0c0549d004cab5b1
    • Instruction ID: 4d7902c2762a5265bbc9e4aa06401766ece656a3410d91543b07039baed02be1
    • Opcode Fuzzy Hash: e2de542e199bbb59c7310b0364f9dc59700c941973c4010b0c0549d004cab5b1
    • Instruction Fuzzy Hash: 1EF0F071A107019BFB21BF35880476E67A0AF40738F1C89099454AB1E0DB7CB5129E66
    Function 04DACE35 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
    Download Yara Rule
    APIs
    • __lock_file.LIBCMT ref: 04DACE69
    • __ftell_nolock.LIBCMT ref: 04DACE74
      • Part of subcall function 04DABF95: __getptd_noexit.LIBCMT ref: 04DABF95
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: __ftell_nolock__getptd_noexit__lock_file
    • String ID:
    • API String ID: 2999321469-0
    • Opcode ID: dac625914eb882388da85c3d9b6810f956481dd6930f64a5c30af457a60106d2
    • Instruction ID: d5c045e0b173e18148008394f0c42f34e24b17dca6ff0118b1a6c97b5f2f8dee
    • Opcode Fuzzy Hash: dac625914eb882388da85c3d9b6810f956481dd6930f64a5c30af457a60106d2
    • Instruction Fuzzy Hash: BBF0A771F206019AFB10BF7488017AE77A09F40739F154E059010EB1C0CF78BA529B65
    Function 05258BC4 Relevance: 3.0, APIs: 2, Instructions: 21memoryCOMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • RtlFreeHeap.NTDLL(00000000,00000000), ref: 05258BD8
      • Part of subcall function 05258EDB: __getptd_noexit.LIBCMT ref: 05258EDB
    • GetLastError.KERNEL32(00000000), ref: 05258BEA
    Memory Dump Source
    • Source File: 00000006.00000002.2292494766.0000000005141000.00000020.00001000.00020000.00000000.sdmp, Offset: 05140000, based on PE: true
    • Associated: 00000006.00000002.2292472579.0000000005140000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292599957.000000000529A000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292889798.000000000570D000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292916262.000000000570F000.00000040.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_5140000_rundll32.jbxd
    Similarity
    • API ID: ErrorFreeHeapLast__getptd_noexit
    • String ID:
    • API String ID: 269751013-0
    • Opcode ID: 222e2a7e45364701c2da895944ea63534b23412daab3518d5b26c41f77db4570
    • Instruction ID: bdd8ee98b1b20d22059a08aaf7d245e2c8b9e6aa87b980274be93e33bd14b1f7
    • Opcode Fuzzy Hash: 222e2a7e45364701c2da895944ea63534b23412daab3518d5b26c41f77db4570
    • Instruction Fuzzy Hash: 4BE0ECB2224706EBDB256FA4A809B993FE8BF04265F209029F94AD6050EEB485919784
    Function 04D9237A Relevance: 1.7, APIs: 1, Instructions: 176COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: 934c0878d956f86586ff1062507744a1bc6f3e07d59b4458be1a404c30e033c4
    • Instruction ID: 434e47d6d2a906affaa90c50ba6cac7e2af133f2ca0aeda111c92373254f62f4
    • Opcode Fuzzy Hash: 934c0878d956f86586ff1062507744a1bc6f3e07d59b4458be1a404c30e033c4
    • Instruction Fuzzy Hash: 42616C71E4020AEFDF10CFD8C9859EEBBB5FB04705F20456AE655BA280D370AE41CB91
    Function 04DA77D0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04DA77D5
      • Part of subcall function 04D824D8: __EH_prolog.LIBCMT ref: 04D824DD
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: d7b3d7b419587e2c00622b055a21a6b6cff6d052ccdbf1ad7b1f03d5f1d43d13
    • Instruction ID: 031cd990a8a4003386f3986848d415f346a7b3f8d094eaa7c77adfe44b860b16
    • Opcode Fuzzy Hash: d7b3d7b419587e2c00622b055a21a6b6cff6d052ccdbf1ad7b1f03d5f1d43d13
    • Instruction Fuzzy Hash: 1321D271B00209AFEB04EFA888949FE7BA8FF09314F0041ADE855AB341DB70BA11C771
    Function 04DA7BE3 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: bfd8470808671b864b447fd95df1951401748f1a651de1df5ddfd3d1f19af70c
    • Instruction ID: ddc749c274c3b301e23cc87e947bb54ff25862b105ea5415c6b4ff7147ef8b28
    • Opcode Fuzzy Hash: bfd8470808671b864b447fd95df1951401748f1a651de1df5ddfd3d1f19af70c
    • Instruction Fuzzy Hash: 90219336A01208EBDF15FFA4C594AEDBBB5EF59304F24419DD806A7281DB31AF18C6B1
    Function 04D93F6E Relevance: 1.5, APIs: 1, Instructions: 45COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D93F73
      • Part of subcall function 04D95B6B: __EH_prolog.LIBCMT ref: 04D95B70
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: de3e0a13ffa4137abcda8ca26dfd299ffd5a55060135a39bafa1c801f464ac14
    • Instruction ID: 869695514de860df845960c532e7997324a5e95903058d05966175d52a3b5d3d
    • Opcode Fuzzy Hash: de3e0a13ffa4137abcda8ca26dfd299ffd5a55060135a39bafa1c801f464ac14
    • Instruction Fuzzy Hash: 36012171E01218BBDB20EA95C849FDF7F7CEB45A78F044159F849A6241C770A604C7F1
    Function 04D9B587 Relevance: 1.5, APIs: 1, Instructions: 41windowCOMMON
    Download Yara Rule
    APIs
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,?,04D9B55F,00000002,00000001,00000B83,00005234,00000001,000069A2,00005100), ref: 04D9B5CB
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: FormatMessage
    • String ID:
    • API String ID: 1306739567-0
    • Opcode ID: ba1eb5fe05a45674083ebf7f696d027c669cc83010b1e2fdcbd012f2092ab60e
    • Instruction ID: f8026b0e131c4562fa8fc5d41cba8581b2a8968d9698d17ee30b78acecb89673
    • Opcode Fuzzy Hash: ba1eb5fe05a45674083ebf7f696d027c669cc83010b1e2fdcbd012f2092ab60e
    • Instruction Fuzzy Hash: B1F04F71244249AFFF119E64E84ABFA3BA8EB41718F080185F94DCA5D2C675ACA5C760
    Function 04D8DA35 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID:
    • API String ID: 3519838083-0
    • Opcode ID: 17db06e865cc6cba060df53d4dfffcd13a9b5ef934ce121c111249a8b51ab29c
    • Instruction ID: a82fe6d6644787a4940a9af7e236a71940566b4564ff66cd57b93a63cb42759c
    • Opcode Fuzzy Hash: 17db06e865cc6cba060df53d4dfffcd13a9b5ef934ce121c111249a8b51ab29c
    • Instruction Fuzzy Hash: A8E08CB0A14158CBFB14FF48D4002FDB7B5EB94608F00068EA44A93380DFB47E0087E1

    Non-executed Functions

    Function 04D8C8F0 Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 319windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D8C989
    • GetDC.USER32(00000000), ref: 04D8C98C
    • GetTextExtentPointW.GDI32(00000000,?,00000000), ref: 04D8C98F
    • GetSysColorBrush.USER32(0000196A), ref: 04D8C9F7
    • GetDesktopWindow.USER32 ref: 04D8CA0E
    • SetWindowTextW.USER32(00000000), ref: 04D8CA11
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,?,?,00000000), ref: 04D8CA39
    • GetDesktopWindow.USER32 ref: 04D8CA98
    • SetDlgItemInt.USER32(00000000,?,00000000), ref: 04D8CA9B
    • GetDesktopWindow.USER32 ref: 04D8CABE
    • GetDC.USER32(00000000), ref: 04D8CAC1
    • SetViewportExtEx.GDI32(00000000,?,00000000), ref: 04D8CAC4
    • _memset.LIBCMT ref: 04D8CB4D
    • _memset.LIBCMT ref: 04D8CBA1
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text_memset$BrushColorExtentFormatItemMessagePointViewport
    • String ID: jt$jt
    • API String ID: 967997722-2819724509
    • Opcode ID: 87e0a8e123b951d0920b95d195849eaa097c9fc702b4a3fb4fae713a438c1c16
    • Instruction ID: 52b6e6dfac3483619b849939e010832135da081fda9afac589e130d0cd8e8b14
    • Opcode Fuzzy Hash: 87e0a8e123b951d0920b95d195849eaa097c9fc702b4a3fb4fae713a438c1c16
    • Instruction Fuzzy Hash: 13C1C1B0E1434AEADB15EFA8C8847BEBFB4FF85B04F14819DD4916B281D3746645CBA0
    Function 04D78D0E Relevance: 24.8, APIs: 1, Strings: 13, Instructions: 284libraryloaderCOMMON
    Download Yara Rule
    APIs
    • GetProcAddress.KERNEL32(?,?), ref: 04D790FE
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AddressProc
    • String ID: "$%$'$($.$4$;$A$B$T$V$W$^
    • API String ID: 190572456-504311776
    • Opcode ID: 488c34f78fa4749e59f5c102f52d347c34073eb4894beabde1a5147ee2b23483
    • Instruction ID: 0a1368f59dbefba4048bf6f54defaf8dd71d8412e4650c4bbc6343a45ab9c22e
    • Opcode Fuzzy Hash: 488c34f78fa4749e59f5c102f52d347c34073eb4894beabde1a5147ee2b23483
    • Instruction Fuzzy Hash: 52E18C709082DDCEEF05CBB8D5587EDBFF0AB06309F1441AED495A7282E3795A44DB21
    Function 04D8FAE6 Relevance: 19.7, APIs: 13, Instructions: 185windowCOMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D8FAEB
    • GetDesktopWindow.USER32 ref: 04D8FB7F
    • GetDC.USER32(00000000), ref: 04D8FB82
    • GetTextExtentPointW.GDI32(00000000), ref: 04D8FB89
    • GetSysColorBrush.USER32(0000196A), ref: 04D8FC04
    • GetDesktopWindow.USER32 ref: 04D8FC1B
    • SetWindowTextW.USER32(00000000), ref: 04D8FC1E
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,?,00000002), ref: 04D8FC46
    • GetDesktopWindow.USER32 ref: 04D8FCC8
    • SetDlgItemInt.USER32(00000000), ref: 04D8FCCB
    • GetDesktopWindow.USER32 ref: 04D8FCEE
    • GetDC.USER32(00000000), ref: 04D8FCF1
    • SetViewportExtEx.GDI32(00000000), ref: 04D8FCF8
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatH_prologItemMessagePointViewport
    • String ID:
    • API String ID: 3397956014-0
    • Opcode ID: f166ed5d9f2b078aa0584721abc1a1180f1548eebfa3a421d5498fb62633fe36
    • Instruction ID: 78df8054acd18d68bf5881bff7bb740e8f6ff8c30eb179b6c9420822c4880805
    • Opcode Fuzzy Hash: f166ed5d9f2b078aa0584721abc1a1180f1548eebfa3a421d5498fb62633fe36
    • Instruction Fuzzy Hash: FF715FB0E0425ADFDB14EFA8D9596FEBBB4FF44305F20445DE905B6280D7346A80CBA1
    Function 04D841D7 Relevance: 19.7, APIs: 13, Instructions: 179windowCOMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D841DC
    • GetDesktopWindow.USER32 ref: 04D84270
    • GetDC.USER32(00000000), ref: 04D84273
    • GetTextExtentPointW.GDI32(00000000), ref: 04D8427A
    • GetSysColorBrush.USER32(0000196A), ref: 04D84303
    • GetDesktopWindow.USER32 ref: 04D8431A
    • SetWindowTextW.USER32(00000000), ref: 04D8431D
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 04D84345
    • GetDesktopWindow.USER32 ref: 04D843AE
    • SetDlgItemInt.USER32(00000000), ref: 04D843B1
    • GetDesktopWindow.USER32 ref: 04D843D3
    • GetDC.USER32(00000000), ref: 04D843D6
    • SetViewportExtEx.GDI32(00000000), ref: 04D843DD
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatH_prologItemMessagePointViewport
    • String ID:
    • API String ID: 3397956014-0
    • Opcode ID: e91c9e875b681555a1123e6be8d6999b39ee303497ab4bde373e3cb0f66f4424
    • Instruction ID: 7829e04c36de35d13f4e0a98e4d3c6973cea6ab4731c29e271a7e67c7404b1f9
    • Opcode Fuzzy Hash: e91c9e875b681555a1123e6be8d6999b39ee303497ab4bde373e3cb0f66f4424
    • Instruction Fuzzy Hash: CE714A74E0520AEBDB14EFA8C4496FEBBB5FF44315F20815EE8557B280E7345A40CBA1
    Function 04D91281 Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 370COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _memmove$Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 1771113911-141594409
    • Opcode ID: 6e7d40ac24d4717de0a3a62eab71dbbd1de287e673dbd9b7d64878d52d342fcf
    • Instruction ID: 8ea9ac435bcff5311815ca4b58b2380cacea6503703c81019ee7b0b81f4e5d13
    • Opcode Fuzzy Hash: 6e7d40ac24d4717de0a3a62eab71dbbd1de287e673dbd9b7d64878d52d342fcf
    • Instruction Fuzzy Hash: 42D12671B0060AEBEF60CF58D98199EB7F5FB48744B144929E986CB600E730FE51CBA1
    Function 04D855A1 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 154windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04D855F6
    • GetDesktopWindow.USER32 ref: 04D8560A
    • SetWindowTextW.USER32(00000000), ref: 04D8560D
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,null,00000000,00000000), ref: 04D85632
    • GetDesktopWindow.USER32 ref: 04D8569F
    • SetDlgItemInt.USER32(00000000), ref: 04D856A2
    • GetDesktopWindow.USER32 ref: 04D856C4
    • GetDC.USER32(00000000), ref: 04D856C7
    • SetViewportExtEx.GDI32(00000000), ref: 04D856CE
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport
    • String ID: \u%04X$null
    • API String ID: 654738355-3369567502
    • Opcode ID: d126bb7a12fd89e05911a32fac81c600e0fd5894dc03d77165a25dd140e40a70
    • Instruction ID: 49b1a13f7a6f98978106437954e3b06a3f9f89fc5abe9606893f3b3fe01d2b33
    • Opcode Fuzzy Hash: d126bb7a12fd89e05911a32fac81c600e0fd5894dc03d77165a25dd140e40a70
    • Instruction Fuzzy Hash: 325199B0E84349FBEF10EFA4A8A99FDBBB4FF01354F14849DE4516B281D2356A44CB60
    Function 04D853DF Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 154windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04D85434
    • GetDesktopWindow.USER32 ref: 04D85448
    • SetWindowTextW.USER32(00000000), ref: 04D8544B
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,null,00000000,00000000), ref: 04D85470
    • GetDesktopWindow.USER32 ref: 04D854DD
    • SetDlgItemInt.USER32(00000000), ref: 04D854E0
    • GetDesktopWindow.USER32 ref: 04D85502
    • GetDC.USER32(00000000), ref: 04D85505
    • SetViewportExtEx.GDI32(00000000), ref: 04D8550C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport
    • String ID: \u%04X$null
    • API String ID: 654738355-3369567502
    • Opcode ID: 22c9572caa0d4b94411c2758e81e5be5ec96af33c41cecb8792adae702c46e33
    • Instruction ID: a0640053ce010e57ae46e8b474094264832366a7ac7c4cfe7a2050978f102354
    • Opcode Fuzzy Hash: 22c9572caa0d4b94411c2758e81e5be5ec96af33c41cecb8792adae702c46e33
    • Instruction Fuzzy Hash: 98518BB0E84359FBEF10EFA8A8689BEBFB5FF01315F14809DE4516B281D63566448B60
    Function 04D90120 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 143memoryCOMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _memmove$_memset$AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 2080731275-3797114014
    • Opcode ID: 3b76ceba6d4237f5e15e635ddc5eafc09266ab8689e03417526ee1d3713ae827
    • Instruction ID: db667004b573eeb01775f24d5960074327d905a1ff5a5f71850f8ca65d545c90
    • Opcode Fuzzy Hash: 3b76ceba6d4237f5e15e635ddc5eafc09266ab8689e03417526ee1d3713ae827
    • Instruction Fuzzy Hash: 2C414AB160011AAFDB05EF7CDD949AABBE8FF49214B148629F819D7240D730FD60DBA0
    Function 04D89536 Relevance: 18.2, APIs: 12, Instructions: 187windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D895C8
    • GetDC.USER32(00000000), ref: 04D895CB
    • GetTextExtentPointW.GDI32(00000000), ref: 04D895D2
    • GetDesktopWindow.USER32 ref: 04D8962B
    • SetDlgItemInt.USER32(00000000), ref: 04D8962E
    • GetDesktopWindow.USER32 ref: 04D89651
    • GetDC.USER32(00000000), ref: 04D89654
    • SetViewportExtEx.GDI32(00000000), ref: 04D8965B
    • GetSysColorBrush.USER32(0000196A), ref: 04D896F3
    • GetDesktopWindow.USER32 ref: 04D8970A
    • SetWindowTextW.USER32(00000000), ref: 04D8970D
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,Function_00010C5B,00000000,?,00000000,00003CD6), ref: 04D89735
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatItemMessagePointViewport
    • String ID:
    • API String ID: 1998102902-0
    • Opcode ID: 788dd4fc676051746683beec19a1160e2ea49c8919c88a0f96e73941637ee586
    • Instruction ID: a2cd474f6e7ef7e6a22140c12222cf76c68f2618531df803b9415f60702f35cd
    • Opcode Fuzzy Hash: 788dd4fc676051746683beec19a1160e2ea49c8919c88a0f96e73941637ee586
    • Instruction Fuzzy Hash: 4B7149B0E04248FEDB11EFA4C859AFEBFB4FF45315F108499E895AA281D735A640CF60
    Function 04D892F3 Relevance: 18.2, APIs: 12, Instructions: 187windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D89385
    • GetDC.USER32(00000000), ref: 04D89388
    • GetTextExtentPointW.GDI32(00000000), ref: 04D8938F
    • GetDesktopWindow.USER32 ref: 04D893E8
    • SetDlgItemInt.USER32(00000000), ref: 04D893EB
    • GetDesktopWindow.USER32 ref: 04D8940E
    • GetDC.USER32(00000000), ref: 04D89411
    • SetViewportExtEx.GDI32(00000000), ref: 04D89418
    • GetSysColorBrush.USER32(0000196A), ref: 04D894B0
    • GetDesktopWindow.USER32 ref: 04D894C7
    • SetWindowTextW.USER32(00000000), ref: 04D894CA
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,Function_00010C5B,00000000), ref: 04D894F2
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatItemMessagePointViewport
    • String ID:
    • API String ID: 1998102902-0
    • Opcode ID: cae0eeb1b52e789a941adce81c3b27ff0af1a5da02c361c51d18a876156dc3a2
    • Instruction ID: 36d93eec62ebd8bd7259ad7abd1d8c88b4142865e1a6c0463b023ec91e4eaaa5
    • Opcode Fuzzy Hash: cae0eeb1b52e789a941adce81c3b27ff0af1a5da02c361c51d18a876156dc3a2
    • Instruction Fuzzy Hash: 4D7138B0E04248FADF11EFA8C858AFEBFB4EF45315F10C499E895AA291D3349644CB60
    Function 04D968CB Relevance: 18.2, APIs: 12, Instructions: 173windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D9695D
    • GetDC.USER32(00000000), ref: 04D96960
    • GetTextExtentPointW.GDI32(00000000), ref: 04D96967
    • GetSysColorBrush.USER32(0000196A), ref: 04D969DF
    • GetDesktopWindow.USER32 ref: 04D969F3
    • SetWindowTextW.USER32(00000000), ref: 04D969F6
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000003,FFFFFFFE,?,00000000,00003B8A,?,00000001), ref: 04D96A1B
    • GetDesktopWindow.USER32 ref: 04D96A77
    • SetDlgItemInt.USER32(00000000), ref: 04D96A7A
    • GetDesktopWindow.USER32 ref: 04D96A9C
    • GetDC.USER32(00000000), ref: 04D96A9F
    • SetViewportExtEx.GDI32(00000000), ref: 04D96AA6
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$BrushColorExtentFormatItemMessagePointViewport
    • String ID:
    • API String ID: 1998102902-0
    • Opcode ID: d983f0b58f6e91b6867dcddda83ce7832af6562f4d4b38c65a3a1c39d72c3234
    • Instruction ID: 07c402c215acaa30fa971377bc59bf721c8f8be971fcdf8a2d61058c28792da2
    • Opcode Fuzzy Hash: d983f0b58f6e91b6867dcddda83ce7832af6562f4d4b38c65a3a1c39d72c3234
    • Instruction Fuzzy Hash: 986116B4E84348FFDF10DFA488945AEBFB4FB05315F148499E5A1AB281D235AA45CFA0
    Function 04DAE92E Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • DecodePointer.KERNEL32(?,00000001,04DAD56B,04DC8CE0,00000008,04DAD6A2,?,00000001,?,04DC8D00,0000000C,04DAD641,?,00000001,?), ref: 04DAE936
    • _free.LIBCMT ref: 04DAE94F
      • Part of subcall function 04DAC414: RtlFreeHeap.NTDLL(00000000,00000000,?,04DAFB6E,00000000,00000001,00000000,00000003,00000000,?,04DABCEB,04DA887B,?), ref: 04DAC428
      • Part of subcall function 04DAC414: GetLastError.KERNEL32(00000000,?,04DAFB6E,00000000,00000001,00000000,00000003,00000000,?,04DABCEB,04DA887B,?), ref: 04DAC43A
    • _free.LIBCMT ref: 04DAE962
    • _free.LIBCMT ref: 04DAE980
    • _free.LIBCMT ref: 04DAE992
    • _free.LIBCMT ref: 04DAE9A3
    • _free.LIBCMT ref: 04DAE9AE
    • _free.LIBCMT ref: 04DAE9D2
    • EncodePointer.KERNEL32(03133B30), ref: 04DAE9D9
    • _free.LIBCMT ref: 04DAE9EE
    • _free.LIBCMT ref: 04DAEA04
    • _free.LIBCMT ref: 04DAEA2C
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
    • String ID:
    • API String ID: 3064303923-0
    • Opcode ID: 545ab8eba0ae5d4026cd85294086c09c6c66e3223b7a1fa2d216216da7476b0e
    • Instruction ID: e855dae2efbdba2c23174c7ccf95830000e98b71c2ff4ce5fc3ece9dd1b7b17d
    • Opcode Fuzzy Hash: 545ab8eba0ae5d4026cd85294086c09c6c66e3223b7a1fa2d216216da7476b0e
    • Instruction Fuzzy Hash: 5021C772A412238BEB20AF24F9A056577A1FB05770318453EE44593385CFBCBC61CBB4
    Function 04D9C20F Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 429COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D9C214
    • QueryDosDeviceW.KERNEL32(00000000,00000000,00000752,00000000), ref: 04D9C239
    • char_traits.LIBCPMT ref: 04D9C338
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DeviceH_prologQuerychar_traits
    • String ID: \$\..\
    • API String ID: 1264856077-605892584
    • Opcode ID: ce74011c0ae5a505b51d87df627d27b244f242e9f44735be6c7d60f43eb1a9ed
    • Instruction ID: bd6a4e02d5cd5d80ffdac67f80aa29c26255a89d79e51323b622b77bf98626c0
    • Opcode Fuzzy Hash: ce74011c0ae5a505b51d87df627d27b244f242e9f44735be6c7d60f43eb1a9ed
    • Instruction Fuzzy Hash: 2DF13AB1E14219AFEF14DFA8C885AFEBBB8FB09708F144069E515F6280D7746E41CB61
    Function 04DA48CB Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04DA491F
    • GetDesktopWindow.USER32 ref: 04DA4933
    • SetWindowTextW.USER32(00000000), ref: 04DA4936
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 04DA495B
    • GetDesktopWindow.USER32 ref: 04DA49DB
    • SetDlgItemInt.USER32(00000000), ref: 04DA49DE
    • GetDesktopWindow.USER32 ref: 04DA4A08
    • GetDC.USER32(00000000), ref: 04DA4A0B
    • SetViewportExtEx.GDI32(00000000), ref: 04DA4A12
    • _abort.LIBCMT ref: 04DA4A18
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport_abort
    • String ID:
    • API String ID: 50134168-0
    • Opcode ID: fa5495a2ddfa307165b63b57d7661027579ba39f5c2ca6e87fd0b02b4380a09f
    • Instruction ID: 7cef3db9b141d0c1967b05c4c0cbfc7b553387b91ef55890dfe7190a1cead334
    • Opcode Fuzzy Hash: fa5495a2ddfa307165b63b57d7661027579ba39f5c2ca6e87fd0b02b4380a09f
    • Instruction Fuzzy Hash: F2419DB0E88388FBEB00DFE8989999DBF78EB02315F10859DE5517B281D2B56664CF50
    Function 04D85173 Relevance: 13.6, APIs: 9, Instructions: 125windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04D851E8
    • GetDesktopWindow.USER32 ref: 04D851FC
    • SetWindowTextW.USER32(00000000), ref: 04D851FF
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000400,?,00000000,75A89CE0,00000000), ref: 04D85224
    • GetDesktopWindow.USER32 ref: 04D8528C
    • SetDlgItemInt.USER32(00000000,?,00000000,75A89CE0), ref: 04D8528F
    • GetDesktopWindow.USER32 ref: 04D852B1
    • GetDC.USER32(00000000), ref: 04D852B4
    • SetViewportExtEx.GDI32(00000000,?,00000000,75A89CE0), ref: 04D852BB
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport
    • String ID:
    • API String ID: 654738355-0
    • Opcode ID: db974f6cadbd22b136b006a25ff165a68083b5bc5817c39572a75060747e00e8
    • Instruction ID: df268fbcd2a7d9475fca9207b448cf6313ff1b4f3c7072673da97311e1315d5e
    • Opcode Fuzzy Hash: db974f6cadbd22b136b006a25ff165a68083b5bc5817c39572a75060747e00e8
    • Instruction Fuzzy Hash: C5417C70A40389FBDB10EF98A9689EE7BB8EB01309F54455CE8516B381D774AE14DBA0
    Function 04D84ADE Relevance: 13.6, APIs: 9, Instructions: 119windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04D84B4A
    • GetDesktopWindow.USER32 ref: 04D84B61
    • SetWindowTextW.USER32(00000000), ref: 04D84B64
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,?,00000000,00000002), ref: 04D84B8C
    • GetDesktopWindow.USER32 ref: 04D84BF6
    • SetDlgItemInt.USER32(00000000,?,00000000,00000002), ref: 04D84BF9
    • GetDesktopWindow.USER32 ref: 04D84C1C
    • GetDC.USER32(00000000), ref: 04D84C1F
    • SetViewportExtEx.GDI32(00000000,?,00000000,00000002), ref: 04D84C26
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$BrushColorFormatItemMessageTextViewport
    • String ID:
    • API String ID: 654738355-0
    • Opcode ID: e9feca81f4193e9181ce030909c8359f465339ebbf5a1583fef25374a95fecff
    • Instruction ID: a193468ab3b8be221fda1c577f1d64ed59e144613146f88fb4af4a4051cabeaa
    • Opcode Fuzzy Hash: e9feca81f4193e9181ce030909c8359f465339ebbf5a1583fef25374a95fecff
    • Instruction Fuzzy Hash: 1341AF70D04349FEEB04AFA8D848BBDBFB8FF94305F04C19DE45466281E2746685CB50
    Function 04D713C5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89memoryCOMMON
    Download Yara Rule
    APIs
    • _Allocate.LIBCPMT ref: 04D71417
      • Part of subcall function 04D8D594: std::exception::exception.LIBCMT ref: 04DA8848
      • Part of subcall function 04D8D594: __CxxThrowException@8.LIBCMT ref: 04DA885D
    • _Ucopy.LIBCPMT ref: 04D71436
    • _Ucopy.LIBCPMT ref: 04D71444
    • _Ucopy.LIBCPMT ref: 04D71428
      • Part of subcall function 04D71575: _memmove.LIBCMT ref: 04D71589
    • _Ucopy.LIBCPMT ref: 04D7147D
    • std::_Xinvalid_argument.LIBCPMT ref: 04D714A8
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Ucopy$AllocateException@8ThrowXinvalid_argument_memmovestd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 1826209128-3797114014
    • Opcode ID: 37f695e8087a3e37179db14833452ea3d9433976c98889cfb385809326a613aa
    • Instruction ID: 73d50b66cc4bf401c6d134c5a474bf09d89ca5654141c4885e648e6efe3979d2
    • Opcode Fuzzy Hash: 37f695e8087a3e37179db14833452ea3d9433976c98889cfb385809326a613aa
    • Instruction Fuzzy Hash: 85214F75A00119BFDB159F68CC49D6EBBB9FB44314B144729F81597350EB31FD20DA90
    Function 04DAD30D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69COMMON
    Download Yara Rule
    APIs
    • FindCompleteObject.LIBCMT ref: 04DAD32E
    • FindMITargetTypeInstance.LIBCMT ref: 04DAD367
      • Part of subcall function 04DACFCD: PMDtoOffset.LIBCMT ref: 04DAD05F
    • FindVITargetTypeInstance.LIBCMT ref: 04DAD36E
    • PMDtoOffset.LIBCMT ref: 04DAD37F
    • std::bad_exception::bad_exception.LIBCMT ref: 04DAD3A8
    • __CxxThrowException@8.LIBCMT ref: 04DAD3B6
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Find$InstanceOffsetTargetType$CompleteException@8ObjectThrowstd::bad_exception::bad_exception
    • String ID: ekLDdEOoyHpNjyypF
    • API String ID: 1565299582-2829376797
    • Opcode ID: 7634fbc31b31beb87559008602c95feb036adfed66b9550b9a9bb77abdccb05c
    • Instruction ID: 9d5f5e07201a72886890851d5c5ea179861e7bbd06559ec1868a0bcdeb299b5f
    • Opcode Fuzzy Hash: 7634fbc31b31beb87559008602c95feb036adfed66b9550b9a9bb77abdccb05c
    • Instruction Fuzzy Hash: CD219DB2B002059FDF14EFA8CD41AAE7B66FF48714F144449F915A7680DB38F925DBA0
    Function 04D915D5 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 170COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _memmove$Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 1771113911-141594409
    • Opcode ID: 5c8522a3a60e9e1a6936ffe96cba549c52b63f730a35468289ef32773be46cc6
    • Instruction ID: f5e7a0985df9d6d8c6256cc869d6b258b3d6e0720feb664745d83ef0619f3ffa
    • Opcode Fuzzy Hash: 5c8522a3a60e9e1a6936ffe96cba549c52b63f730a35468289ef32773be46cc6
    • Instruction Fuzzy Hash: D0519B31B00207DBFF24CE58D984A6EB7EAFB81740B080A29E886C7640D770FD55DBA1
    Function 04D844E8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 139COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 256744135-141594409
    • Opcode ID: 2e3c9a58d4f1eb4a04651deb4d6c054e7413b224c0591acf3fd15e1343d349e6
    • Instruction ID: d5d7a161b9b2d09c95343e97e492dd129f31ba15c24b3ddeba5eb887a7644399
    • Opcode Fuzzy Hash: 2e3c9a58d4f1eb4a04651deb4d6c054e7413b224c0591acf3fd15e1343d349e6
    • Instruction Fuzzy Hash: C24194713003029FDB34EE69D884A7EB7A9EF41764B04096DE89687681E770F945CBA1
    Function 04D97907 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 111COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _memmove$Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 1771113911-141594409
    • Opcode ID: 8cc41154bcc3554ce768399e649361d3d0e71404b011be9a433140c61b5ab744
    • Instruction ID: 4a8ea49adcd5ebcb98df429bfb87521ef815c47df6d7f49af8ec0a48cf22e8b2
    • Opcode Fuzzy Hash: 8cc41154bcc3554ce768399e649361d3d0e71404b011be9a433140c61b5ab744
    • Instruction Fuzzy Hash: 1D417E35320205EBDF24CF58D88099A77E6FB86704B204A2DE896CB281D731FD44CBA1
    Function 04D877FC Relevance: 10.6, APIs: 7, Instructions: 105COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D87801
    • GetDesktopWindow.USER32 ref: 04D87834
    • SetDlgItemInt.USER32(00000000,?,00000000), ref: 04D8783B
    • GetDesktopWindow.USER32 ref: 04D8785D
    • GetDC.USER32(00000000), ref: 04D87864
    • SetViewportExtEx.GDI32(00000000,?,00000000), ref: 04D8786B
    • __aulldvrm.LIBCMT ref: 04D878C5
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport__aulldvrm
    • String ID:
    • API String ID: 1873070202-0
    • Opcode ID: e48b26cf261ad55c9fdb76818770056530f0d17e959f929bf4512374211b0d68
    • Instruction ID: 73463af976742ab9801e6cfdbea803f6e282a1f41334da6134048588a2ffe403
    • Opcode Fuzzy Hash: e48b26cf261ad55c9fdb76818770056530f0d17e959f929bf4512374211b0d68
    • Instruction Fuzzy Hash: 5A319075E00248EFDF10EFA8D894AEDBBB9FF48744F24845DF505A7280C6306A44CBA1
    Function 04D875C7 Relevance: 10.6, APIs: 7, Instructions: 101COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport__aulldvrm
    • String ID:
    • API String ID: 1873070202-0
    • Opcode ID: fe76c45d43b1282201640ef747eff56cc546aa8f974160f91eb0b7016dd21706
    • Instruction ID: 658bc233eeb29f7478805d3cacd70ea24971cb6ceb64580143c664c4a764cbb0
    • Opcode Fuzzy Hash: fe76c45d43b1282201640ef747eff56cc546aa8f974160f91eb0b7016dd21706
    • Instruction Fuzzy Hash: A4318F71E00248EFEF10EFA8DCA5AEEBBB8EB44754F14405DF505B7281C6345A44CBA1
    Function 04D87929 Relevance: 10.6, APIs: 7, Instructions: 91COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport__aulldvrm
    • String ID:
    • API String ID: 1873070202-0
    • Opcode ID: 70191fa6836fdafb57104e111b8a7935eeed2895e1063ba23672f8cdbd43fc7a
    • Instruction ID: 4ac736543709576056d6269f6c5fa400757dff2b3f339a817cd682701e0fb5c0
    • Opcode Fuzzy Hash: 70191fa6836fdafb57104e111b8a7935eeed2895e1063ba23672f8cdbd43fc7a
    • Instruction Fuzzy Hash: 46313871E00248EFEF10EFE8D894AEDBBB8FF08755F24445DE505A7290D6306A44CBA1
    Function 04D79713 Relevance: 10.6, APIs: 7, Instructions: 79COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D79740
    • GetDC.USER32(00000000), ref: 04D79747
    • GetTextExtentPoint32W.GDI32(00000000,?,?,04D7981D), ref: 04D7974E
    • GetDesktopWindow.USER32 ref: 04D7976E
    • SetWindowTextW.USER32(00000000), ref: 04D79775
    • GetDesktopWindow.USER32 ref: 04D797EB
    • SetDlgItemInt.USER32(00000000,?,?,04D7981D), ref: 04D797F2
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$Text$ExtentItemPoint32
    • String ID:
    • API String ID: 1801697257-0
    • Opcode ID: c95715751512b42b4bc76c1178868aed25f9063d01ab32c05094c8e9d3a92bc6
    • Instruction ID: 0186f356663170b1b3916e8a3c140ecb052d0a9b30a1d362f02741976e7cf656
    • Opcode Fuzzy Hash: c95715751512b42b4bc76c1178868aed25f9063d01ab32c05094c8e9d3a92bc6
    • Instruction Fuzzy Hash: 203182B5E01209EFDB40CFA9D894AEDBBF4BB09751F144596F955E7340E734AA008F60
    Function 04D96E25 Relevance: 10.5, APIs: 7, Instructions: 47COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D96E48
    • GetDC.USER32(00000000), ref: 04D96E4F
    • SetViewportExtEx.GDI32(00000000,?,04D96BDB,00003BF0), ref: 04D96E56
    • GetDesktopWindow.USER32 ref: 04D96E6F
    • GetDC.USER32(00000000), ref: 04D96E76
    • GetTextExtentPointW.GDI32(00000000,?,04D96BDB,00003BF0), ref: 04D96E7D
    • GetSysColorBrush.USER32(0000196A), ref: 04D96E90
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$BrushColorExtentPointTextViewport
    • String ID:
    • API String ID: 3221472952-0
    • Opcode ID: 288b26670c5059c6faa47e1df305f22cc0049405237abc6b06451c5fdb5ddc20
    • Instruction ID: 938f9f2bad5cd0e8e487482f810c0469d11ab26086dff941cbc1fc5f1411c4fe
    • Opcode Fuzzy Hash: 288b26670c5059c6faa47e1df305f22cc0049405237abc6b06451c5fdb5ddc20
    • Instruction Fuzzy Hash: 6D012D71544245EFEF159FA4E81DB9A3BE8BB05701F184884F1199B6E1C3B8E850CB91
    Function 04D85CC2 Relevance: 9.4, APIs: 6, Instructions: 412COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D85CC7
    • GetDesktopWindow.USER32 ref: 04D85F4F
    • SetDlgItemInt.USER32(00000000), ref: 04D85F56
      • Part of subcall function 04D8621B: GetDesktopWindow.USER32 ref: 04D86246
      • Part of subcall function 04D8621B: SetWindowTextW.USER32(00000000), ref: 04D8624D
    • GetDesktopWindow.USER32 ref: 04D861E4
    • GetDC.USER32(00000000), ref: 04D861EB
    • SetViewportExtEx.GDI32(00000000), ref: 04D861F2
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$H_prologItemTextViewport
    • String ID:
    • API String ID: 2267899263-0
    • Opcode ID: 3034632af4e6e98d01d46a2c75624c0ede78e795aefb4cd3bbfa635e94a660a2
    • Instruction ID: b5b92843b153438e02af91d857c689c3ef4bafc7f55f8bbf7f2e75a0751bef98
    • Opcode Fuzzy Hash: 3034632af4e6e98d01d46a2c75624c0ede78e795aefb4cd3bbfa635e94a660a2
    • Instruction Fuzzy Hash: 8EF15FB0E40209BEEB10EF94DC95FFEBBB8FB00758F10409DE5556A181EB75AA44CB61
    Function 04D876E5 Relevance: 9.1, APIs: 6, Instructions: 94COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: 4e5fdc234d8c4833b6d77b62cd6045c9e4a40baa3d14051fc801446a38cfacd9
    • Instruction ID: aae128d1739370bb13b64839afff16faa43131a81f61fbe19f7b3ad473594d46
    • Opcode Fuzzy Hash: 4e5fdc234d8c4833b6d77b62cd6045c9e4a40baa3d14051fc801446a38cfacd9
    • Instruction Fuzzy Hash: 7C31AD71E41258EBDB10EFA8D895AEDBBB9FF08704F24815DE505AB280C7346A44CBA0
    Function 04D868D3 Relevance: 9.1, APIs: 6, Instructions: 90COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: ceef0f537a9a5d6e05387e4534faf20d09201aaef899afc8caed7ae4f567fae1
    • Instruction ID: c4f9a715d3d51822101e55be01a47fe02246c9a6cbcc9e50a1386b4f54fb793c
    • Opcode Fuzzy Hash: ceef0f537a9a5d6e05387e4534faf20d09201aaef899afc8caed7ae4f567fae1
    • Instruction Fuzzy Hash: 6831C172E00258EBDB21FF94C9559FEBB78EB46764F00419DE9097B280D634AE00CBA0
    Function 04D873D2 Relevance: 9.1, APIs: 6, Instructions: 88COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: 584bef183b4ce32e0b546ace3803e2712583c18321ddbb4d0104545bad388d92
    • Instruction ID: 0f6655a11f042b62b3ba505f5278576f0a6272fc70c3f263765f38f7192a551a
    • Opcode Fuzzy Hash: 584bef183b4ce32e0b546ace3803e2712583c18321ddbb4d0104545bad388d92
    • Instruction Fuzzy Hash: 6A31AF70E42248EFEF00DFA8D895AEDBBBAFF05344F24815DE5056B280C7755A04CBA1
    Function 04D874D6 Relevance: 9.1, APIs: 6, Instructions: 79COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: 7cb9f2596c7aae763c5e8408f54ab66829bdf3133f986f64f1fa712cbcd5dd5b
    • Instruction ID: c30f3f958b97bfe2cbe9449ed78c51518aed6e8651b8cc524ec84a238cfee6ec
    • Opcode Fuzzy Hash: 7cb9f2596c7aae763c5e8408f54ab66829bdf3133f986f64f1fa712cbcd5dd5b
    • Instruction Fuzzy Hash: 95314FB1E01248EFEF00EFA8D8A5AEDBBB9FB04345F24815DE5056B280D7755A04CBA1
    Function 04D848BF Relevance: 9.1, APIs: 6, Instructions: 73COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$H_prologItemViewport
    • String ID:
    • API String ID: 582183558-0
    • Opcode ID: bcbebbcfa8abb5d67d8484f30015d9d366d41164fe367cbbeff198f745f5ffca
    • Instruction ID: fb3b61e6dbb5057dceade1a5cbe76f1fd023c1a5fdc52672bcac249947e277f8
    • Opcode Fuzzy Hash: bcbebbcfa8abb5d67d8484f30015d9d366d41164fe367cbbeff198f745f5ffca
    • Instruction Fuzzy Hash: 3C217C71E0025AEBDB20FFE4D8A4AEDBB78FF01744F04815CE5556B290EA346A04CBA1
    Function 04DA857E Relevance: 9.0, APIs: 6, Instructions: 41registryCOMMON
    Download Yara Rule
    APIs
    • RegUnLoadKeyW.ADVAPI32(00000000,00000000,?,04DA8104,?,00000001,000073CF,?), ref: 04DA8599
    • GetDesktopWindow.USER32 ref: 04DA85AD
    • SetWindowTextW.USER32(00000000), ref: 04DA85B4
    • GetDesktopWindow.USER32 ref: 04DA85CE
    • GetDC.USER32(00000000), ref: 04DA85D5
    • SetViewportExtEx.GDI32(00000000,?,04DA8104,?), ref: 04DA85DC
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$LoadTextViewport
    • String ID:
    • API String ID: 145119710-0
    • Opcode ID: 0a6197c6f04444d008d3331017e1a9b413dc7947cd6d39ecb49aa268e3deff0a
    • Instruction ID: 4fa4fb7579f18b5f401d23820aa528b66726fa01b2668e3c925ae88d6305884c
    • Opcode Fuzzy Hash: 0a6197c6f04444d008d3331017e1a9b413dc7947cd6d39ecb49aa268e3deff0a
    • Instruction Fuzzy Hash: 92016270544348EFEB129FA4EC1DBD93B98BB05715F080445FD4D977D1C27899A0DB91
    Function 04D911E9 Relevance: 9.0, APIs: 6, Instructions: 34windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D911FA
    • GetDC.USER32(00000000), ref: 04D91201
    • DrawFocusRect.USER32(00000000), ref: 04D91208
    • GetDesktopWindow.USER32 ref: 04D91221
    • GetDC.USER32(00000000), ref: 04D91228
    • GetTextExtentPointW.GDI32(00000000,?,04D91063,00000000), ref: 04D9122F
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$DrawExtentFocusPointRectText
    • String ID:
    • API String ID: 3079162497-0
    • Opcode ID: c5d2681e1b5c8336ddf8c6d8519d6b0c6966cfb1c1b3bd010e5713d60bd7eedf
    • Instruction ID: e90c082868220b7f49eed655600fa3d4e24083d8b42a47df2d7c4b3ddab45b6d
    • Opcode Fuzzy Hash: c5d2681e1b5c8336ddf8c6d8519d6b0c6966cfb1c1b3bd010e5713d60bd7eedf
    • Instruction Fuzzy Hash: B2F03071648244EBFF156BE0A81EB9D3BDCEB05751F180844F20DC67C0877968508B91
    Function 04D84CB5 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 228COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog__floor_pentium4
    • String ID: false$null$true
    • API String ID: 2354235884-2913297407
    • Opcode ID: 888b40f7059f668eb17cff3fb5a854345a7147341f934b9b21c72dd2f4f229da
    • Instruction ID: 55ad254e2d1540bb9b1048710a1a43a75df4afda75668a4c3edcbda5cefc3898
    • Opcode Fuzzy Hash: 888b40f7059f668eb17cff3fb5a854345a7147341f934b9b21c72dd2f4f229da
    • Instruction Fuzzy Hash: E481B071A04109FFEF15EFA4D894AEEBBB8EF15324F14420EE415A7180EB70AA45CB60
    Function 04D96B29 Relevance: 7.7, APIs: 5, Instructions: 245COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D96DEC
    • SetWindowTextW.USER32(00000000), ref: 04D96DF3
      • Part of subcall function 04D96E25: GetDesktopWindow.USER32 ref: 04D96E48
      • Part of subcall function 04D96E25: GetDC.USER32(00000000), ref: 04D96E4F
      • Part of subcall function 04D96E25: SetViewportExtEx.GDI32(00000000,?,04D96BDB,00003BF0), ref: 04D96E56
      • Part of subcall function 04D96B29: FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 04D96CD4
    • GetDesktopWindow.USER32 ref: 04D96E11
    • SetDlgItemInt.USER32(00000000), ref: 04D96E18
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$FormatItemMessageTextViewport
    • String ID:
    • API String ID: 424236427-0
    • Opcode ID: 2e00efd2d71d773daafc8018b30c6824ef731c9cedc25f25aeb0916741895e4b
    • Instruction ID: 3e365252bb52cc903fa332134756235acb40b6b88cd2940772dec5c121272e76
    • Opcode Fuzzy Hash: 2e00efd2d71d773daafc8018b30c6824ef731c9cedc25f25aeb0916741895e4b
    • Instruction Fuzzy Hash: F6917F70E44249FFEF119F94C891AEDBBB4FB05708F148099F955AB2C1E3B5AA40CB61
    Function 04DB61FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • _malloc.LIBCMT ref: 04DB620B
      • Part of subcall function 04DAC44C: __FF_MSGBANNER.LIBCMT ref: 04DAC463
      • Part of subcall function 04DAC44C: __NMSG_WRITE.LIBCMT ref: 04DAC46A
      • Part of subcall function 04DAC44C: RtlAllocateHeap.NTDLL(030F0000,00000000,00000001,00000001,04D918DB,04D918DB,?,04DABDB1,00000001,00000000,00000003,00000000,?,04DABCEB,04DA887B,?), ref: 04DAC48F
    • _free.LIBCMT ref: 04DB621E
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AllocateHeap_free_malloc
    • String ID:
    • API String ID: 1020059152-0
    • Opcode ID: 033fb0873780a97a1e384f572a7bbd9c16d9243ae2d5754814767f5b6233c0c8
    • Instruction ID: 42f0d5e8a4406698a1466d171845f1e36b4f572da04b46e1e268840fc8778a6b
    • Opcode Fuzzy Hash: 033fb0873780a97a1e384f572a7bbd9c16d9243ae2d5754814767f5b6233c0c8
    • Instruction Fuzzy Hash: 9011A732604215EEFF252F74AC04BA93B98FF44264B144526F9869A280DE75F8518AE2
    Function 04D891BE Relevance: 7.6, APIs: 5, Instructions: 50COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D89120
    • SetDlgItemInt.USER32(00000000), ref: 04D89127
    • GetDesktopWindow.USER32 ref: 04D89149
    • GetDC.USER32(00000000), ref: 04D89150
    • SetViewportExtEx.GDI32(00000000), ref: 04D89157
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$ItemViewport
    • String ID:
    • API String ID: 1989583774-0
    • Opcode ID: 678ff1571be38a2d12e0701135d02696d77e62ee8faf7fd3841a0dadc9aa266c
    • Instruction ID: e863d39efafc1af486f6eae8d51904cf043e22658f1157cb966fa5c558f83cda
    • Opcode Fuzzy Hash: 678ff1571be38a2d12e0701135d02696d77e62ee8faf7fd3841a0dadc9aa266c
    • Instruction Fuzzy Hash: 14115EB4A48344FFCB00EF9498AC9BDBBB8FB01341B0484DCE6895B351D6759A44DB91
    Function 04D93C46 Relevance: 7.5, APIs: 5, Instructions: 47COMMON
    Download Yara Rule
    APIs
    • SetLastError.KERNEL32(00002292,?,04D93D1B,00004322,00000000,00002A47,00000000,00000000,00000001,00003654,?,04D93A0E,00000BFB,00000000,?,00000000), ref: 04D93C62
    • GetDesktopWindow.USER32 ref: 04D93CAB
    • GetDC.USER32(00000000), ref: 04D93CB2
    • SetViewportExtEx.GDI32(00000000,?,04D93D1B,00004322), ref: 04D93CB9
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopErrorLastViewportWindow
    • String ID:
    • API String ID: 3126713311-0
    • Opcode ID: cc9f9a55a50d61954e723bbfcb0d124e0d4eadb1ae47883c34b7480b9f9fe515
    • Instruction ID: 74b5fb7a7baac8fe2ea8010dbff5ee07dae158d367fdf64bd993b86c4f006599
    • Opcode Fuzzy Hash: cc9f9a55a50d61954e723bbfcb0d124e0d4eadb1ae47883c34b7480b9f9fe515
    • Instruction Fuzzy Hash: BE018075200645EFEF116F98D81CBD93BE8FB4A306F084480F9499B391C378ACA1CB91
    Function 04D8D3D4 Relevance: 7.5, APIs: 5, Instructions: 36COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D8D3EF
    • SetDlgItemInt.USER32(00000000,?,04D8CE40,00000000), ref: 04D8D3F6
    • GetDesktopWindow.USER32 ref: 04D8D40F
    • GetDC.USER32(00000000), ref: 04D8D416
    • GetTextExtentPointW.GDI32(00000000,?,04D8CE40,00000000), ref: 04D8D41D
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$ExtentItemPointText
    • String ID:
    • API String ID: 4061458486-0
    • Opcode ID: f3e03a2ad856c0e74aa23c68a2ff95c31d0357e11303bc146b394330cbce641e
    • Instruction ID: be8d46d3ebcfcc246c1945838049f4395ac3864e5f95ed41d43bf34a5d22179f
    • Opcode Fuzzy Hash: f3e03a2ad856c0e74aa23c68a2ff95c31d0357e11303bc146b394330cbce641e
    • Instruction Fuzzy Hash: 08F01DB1680348FBEB126BE4AC0EBE93B9AEB04B41F184444F6095A6D1C6B965508B91
    Function 04D8E1AC Relevance: 7.5, APIs: 5, Instructions: 34COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D8E1D7
    • SetDlgItemInt.USER32(00000000), ref: 04D8E1DE
    • GetDesktopWindow.USER32 ref: 04D8E200
    • GetDC.USER32(00000000), ref: 04D8E207
    • SetViewportExtEx.GDI32(00000000), ref: 04D8E20E
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopWindow$ItemViewport
    • String ID:
    • API String ID: 1989583774-0
    • Opcode ID: 1be64608983851703ab681411dad9fc649908cbdc38375b2c8468ef7581e95e3
    • Instruction ID: b2e6cc3f30d5e83f95fc75f03de221ff6903cc5052308070c2b445086d1f14e0
    • Opcode Fuzzy Hash: 1be64608983851703ab681411dad9fc649908cbdc38375b2c8468ef7581e95e3
    • Instruction Fuzzy Hash: 43F04FB0D88344FBDB10AFF0580DAADBBB8AB01701F088499F145EB382D5395648CFA2
    Function 04D81E98 Relevance: 7.5, APIs: 5, Instructions: 34COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D81ED5
    • GetDC.USER32(00000000), ref: 04D81EDC
    • SetViewportExtEx.GDI32(00000000,?,04D81ACD,00001163), ref: 04D81EE3
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopViewportWindow
    • String ID:
    • API String ID: 1263604042-0
    • Opcode ID: 8a9058c97c9bd83fef4bd5e2612e768cdddc9405ba04d8e6986c905effbd20d7
    • Instruction ID: ada0df86792fe6fa034b5d72be63254e06de447b1b725a75889dde0ec09f1b63
    • Opcode Fuzzy Hash: 8a9058c97c9bd83fef4bd5e2612e768cdddc9405ba04d8e6986c905effbd20d7
    • Instruction Fuzzy Hash: 39F0B471540245FBEF126FE4AC1DFEE3B68FB04702F080444F60A4A2D0CA7995A4CBA1
    Function 04D92EEC Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 296COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$DesktopH_prologLong
    • String ID: x(
    • API String ID: 1792819551-2475313659
    • Opcode ID: dcf8130f8aa0b323e7f27cb429a17f844a456b2d8da6d5de3a3979b9581358d8
    • Instruction ID: cb1cd72706a82610c521964b2d63dfc1c2a9655331139f117c1b6a40e0540959
    • Opcode Fuzzy Hash: dcf8130f8aa0b323e7f27cb429a17f844a456b2d8da6d5de3a3979b9581358d8
    • Instruction Fuzzy Hash: ABC14C74A40249EFEF11DF98C8859EEBBB8FF49308F504059ED04AB281D771AE54CBA1
    Function 04D8F608 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162memoryCOMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D8F60D
    • std::_Xinvalid_argument.LIBCPMT ref: 04D8F660
      • Part of subcall function 04DA8863: std::exception::exception.LIBCMT ref: 04DA8876
      • Part of subcall function 04DA8863: __CxxThrowException@8.LIBCMT ref: 04DA888B
    • _Allocate.LIBCPMT ref: 04D8F676
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AllocateException@8H_prologThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 1962182295-3797114014
    • Opcode ID: 90ec3796fbb72cb738c1a927282aa6729ac5f947c3bb698fd59d4958b0516eec
    • Instruction ID: a06d09db969bc391e79cd7d32d5640bbc1b306f9fa52c3009fda66e5b6186a8a
    • Opcode Fuzzy Hash: 90ec3796fbb72cb738c1a927282aa6729ac5f947c3bb698fd59d4958b0516eec
    • Instruction Fuzzy Hash: 6E515EB2600109EFDF15DF68CD85AAA7BB9FF89214B04866DF8169B254E730E914CB60
    Function 04D831E8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID: false$null$true
    • API String ID: 3519838083-2913297407
    • Opcode ID: 73ce13f2e433c592e64b8310613967c82a6e1ed38bef7c2da4c65456417ac644
    • Instruction ID: b14ce94224ae32ec41a21dadda4e8af74e7de1aab62d8f5b50e9034c90ce43e7
    • Opcode Fuzzy Hash: 73ce13f2e433c592e64b8310613967c82a6e1ed38bef7c2da4c65456417ac644
    • Instruction Fuzzy Hash: 8021C470781308AAEF24FB649851FBD7392AB00F08F44491DED4EAB6C1EBA3F50545A5
    Function 04D84703 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 256744135-141594409
    • Opcode ID: 8bcd0ea46705fad7d218b16787431feea80bee35fef36ec7db7e98a0d0030b62
    • Instruction ID: 21738e59db3a30d8992563b91508820532d545172d44589b15cc9263d2fdbfbb
    • Opcode Fuzzy Hash: 8bcd0ea46705fad7d218b16787431feea80bee35fef36ec7db7e98a0d0030b62
    • Instruction Fuzzy Hash: 0721C7353002059BD724EE68DC80DBABBEDEF42714710092DE5568B641E771F941C7E0
    Function 04D7438B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 256744135-141594409
    • Opcode ID: cca59db1669c5e31a718079cf35ddc8c62c3d89838bb0a1647067b800b8892fd
    • Instruction ID: d51ad7997e94864bf2d52ea8d5d31a234c1fe6b8986fcf6bf011ed39db0f848a
    • Opcode Fuzzy Hash: cca59db1669c5e31a718079cf35ddc8c62c3d89838bb0a1647067b800b8892fd
    • Instruction Fuzzy Hash: EB11E9317403049BDB35DE68DC8095BB7EAFF41718B100A2DE4968B681EBB1F445DBA1
    Function 04D77EFE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argument_memmovestd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 256744135-141594409
    • Opcode ID: f6994770d76868b3441fc8eb51ab556846c69c362d38439961ee280d540d781b
    • Instruction ID: 075401fae672d2a555150ee9d21fa2d097fb40f26683e4df4acd7a4563b713dc
    • Opcode Fuzzy Hash: f6994770d76868b3441fc8eb51ab556846c69c362d38439961ee280d540d781b
    • Instruction Fuzzy Hash: 38117C313003159FDB24DF69D980AAAF7AAFF40754B140D2EF856CB281D770F844CAA5
    Function 04D81268 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D8126D
      • Part of subcall function 04D80F96: __EH_prolog.LIBCMT ref: 04D80F9B
      • Part of subcall function 04D80F96: char_traits.LIBCPMT ref: 04D810B7
    • char_traits.LIBCPMT ref: 04D8129D
    • char_traits.LIBCPMT ref: 04D812B7
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: char_traits$H_prolog
    • String ID: .
    • API String ID: 3393116018-3640953465
    • Opcode ID: a53d638fa375bc45a301bc220b414bd201226b580c45b728d75c0ad47aa17375
    • Instruction ID: 5095e76e95830e1a91b9df9ff36e1cbbbb6afbe6bbc0d35df5a5bdc22ce81068
    • Opcode Fuzzy Hash: a53d638fa375bc45a301bc220b414bd201226b580c45b728d75c0ad47aa17375
    • Instruction Fuzzy Hash: E50196B2E001099FAF10BEA8D882AFEF778EB41138F50065FE455F3680D6307D4685B5
    Function 04D8CC54 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D8CC77
    • GetDC.USER32(00000000), ref: 04D8CC7E
    • SetViewportExtEx.GDI32(00000000,?,04D8D459,000058F1), ref: 04D8CC85
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopViewportWindow
    • String ID: un2l
    • API String ID: 1263604042-2526548122
    • Opcode ID: c2f7820b5b1c65e0542204a5752455444eaaa96eca0142a0f3dfb9bb50fc2d28
    • Instruction ID: 6f6955b8b2b540430ac2051e2dce3f4c5b4243bcd3f460ce6c822199c8893a89
    • Opcode Fuzzy Hash: c2f7820b5b1c65e0542204a5752455444eaaa96eca0142a0f3dfb9bb50fc2d28
    • Instruction Fuzzy Hash: AFF05EB1650649FBEF116EA4AC09BEA3BA9AB05B05F080044F6094A6D1C7B5A4A0D7E1
    Function 04DAE1E8 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AdjustPointer_memmove
    • String ID:
    • API String ID: 1721217611-0
    • Opcode ID: 06467994120b788b9b021a513f29278f4560cae34afaf8a3d4e79100c12233a0
    • Instruction ID: 62cc5a8723f0c57b86d6a1f533a0b8772791386a7976b8532db32edbd01a537d
    • Opcode Fuzzy Hash: 06467994120b788b9b021a513f29278f4560cae34afaf8a3d4e79100c12233a0
    • Instruction Fuzzy Hash: F241C635784303AFFF386E69E890BA933E4EF05319F24451DE845861D0EB35F4A0D661
    Function 04DA07C6 Relevance: 6.2, APIs: 4, Instructions: 158COMMON
    Download Yara Rule
    APIs
    • _memset.LIBCMT ref: 04DA086F
    • GetDesktopWindow.USER32 ref: 04DA0971
    • GetDC.USER32(00000000), ref: 04DA0978
    • SetViewportExtEx.GDI32(00000000), ref: 04DA097F
      • Part of subcall function 04DA468E: GetDesktopWindow.USER32 ref: 04DA4690
      • Part of subcall function 04DA468E: SetWindowTextW.USER32(00000000), ref: 04DA4697
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$Desktop$TextViewport_memset
    • String ID:
    • API String ID: 89821065-0
    • Opcode ID: dec36ad28fd9700b14eb685c79e43d1b8bd8c978587b604cc8a0cdc366027887
    • Instruction ID: e4e4dd72a21ebd94a41fdc710075bf107363f5ed6355fef296e08f04c45874ac
    • Opcode Fuzzy Hash: dec36ad28fd9700b14eb685c79e43d1b8bd8c978587b604cc8a0cdc366027887
    • Instruction Fuzzy Hash: C9516AB5D4024DEFEB01EFE4C8858EEBB78FF05318F14856AD95167240D734AA58CBA1
    Function 04D86AAF Relevance: 6.1, APIs: 4, Instructions: 102COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentH_prologPointTextWindow
    • String ID:
    • API String ID: 170700240-0
    • Opcode ID: 640664ebbe9fb32d6df429ddb9df7496d03f95dd8cd6863ebb4e4677a5466cae
    • Instruction ID: b4a66db05958e38a062e4f640fa1d9f36963ab0e3f98a38251d341182de0a985
    • Opcode Fuzzy Hash: 640664ebbe9fb32d6df429ddb9df7496d03f95dd8cd6863ebb4e4677a5466cae
    • Instruction Fuzzy Hash: E0416AB0A44249EFEB10AF95D851AFE7B74FB04728F10C51DFA696A280D374E610CF91
    Function 04DBB800 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 04DBB836
    • __isleadbyte_l.LIBCMT ref: 04DBB864
    • MultiByteToWideChar.KERNEL32(?,00000009,00000000,?,00000002,00000000,?,00000000,00000000,?,00005234), ref: 04DBB892
    • MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000001,00000002,00000000,?,00000000,00000000,?,00005234), ref: 04DBB8C8
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
    • String ID:
    • API String ID: 3058430110-0
    • Opcode ID: 8609ff5cd1f73c42619024d2a0bbaf6c9ac3f7510ec0ce3ff9b751c45cbec515
    • Instruction ID: 7d5e7785a04ec4c014c00403cc203a80081a9678ec9de392a276358f40cfa59c
    • Opcode Fuzzy Hash: 8609ff5cd1f73c42619024d2a0bbaf6c9ac3f7510ec0ce3ff9b751c45cbec515
    • Instruction Fuzzy Hash: 6B31C138A00246EFDB258E75C844BFA7BA5FF41310F15452AE4E68B590E730F850DBE0
    Function 04DA30CE Relevance: 6.1, APIs: 4, Instructions: 91COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _memmove$_memset
    • String ID:
    • API String ID: 1357608183-0
    • Opcode ID: 83208bb365ac6273134597c007199f908af698a054711ead73dd72d1acbf0f5e
    • Instruction ID: deece7134aabd11ea6504eacc2529750364e0c039424d0d5b6680e6e6032c16f
    • Opcode Fuzzy Hash: 83208bb365ac6273134597c007199f908af698a054711ead73dd72d1acbf0f5e
    • Instruction Fuzzy Hash: E821A8726003056BDF189F19DC89E5B37AAFF40324F044469FC19DB245E634F925CBA4
    Function 04DA437E Relevance: 6.1, APIs: 4, Instructions: 91COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: _memmove$_memset
    • String ID:
    • API String ID: 1357608183-0
    • Opcode ID: d0a66a7d6acb7acb60fa4a8b92752cbd559b609400514f1492ace66b6d358352
    • Instruction ID: 7918432ceb2041309195a30cc3076c6bfd18fbdeee9a0b44688117571fbeba81
    • Opcode Fuzzy Hash: d0a66a7d6acb7acb60fa4a8b92752cbd559b609400514f1492ace66b6d358352
    • Instruction Fuzzy Hash: 1821E7B26002056BEF109F18CC85EAA37A9FF44728F154569FD19DB246E6F4F920CBD4
    Function 04D82B88 Relevance: 6.1, APIs: 4, Instructions: 90COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D82B8D
    • GetDesktopWindow.USER32 ref: 04D82C76
    • GetDC.USER32(00000000), ref: 04D82C7D
    • GetTextExtentPointW.GDI32(00000000,?,04D8F486), ref: 04D82C84
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentH_prologPointTextWindow
    • String ID:
    • API String ID: 170700240-0
    • Opcode ID: 9f5d21806b915e87e25fc80fcc0a6e9355a3d270925b2aa8768844b5ffe6b580
    • Instruction ID: 527793e344efa66b5ae87e487e7969a06c100c13030521276195233effad5273
    • Opcode Fuzzy Hash: 9f5d21806b915e87e25fc80fcc0a6e9355a3d270925b2aa8768844b5ffe6b580
    • Instruction Fuzzy Hash: 6B316BB4E0521AEFDB10EF94DC84AFEBBB4FF08705F50095EE95666280D3706A40CBA0
    Function 04D8FF98 Relevance: 6.1, APIs: 4, Instructions: 76windowCOMMON
    Download Yara Rule
    APIs
      • Part of subcall function 04D8FDB5: _memmove.LIBCMT ref: 04D8FDEF
    • GetSysColorBrush.USER32(0000196A), ref: 04D90002
    • GetDesktopWindow.USER32 ref: 04D90016
    • SetWindowTextW.USER32(00000000), ref: 04D9001D
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 04D90042
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText_memmove
    • String ID:
    • API String ID: 3230339316-0
    • Opcode ID: 8361af50945d4b8400e38457fa78b61e859c30af8c813e38d6f003f0d6030922
    • Instruction ID: 7da7a1fae3daf8967f05446d64bf121a02b54f19cddaeb851752a6280430290f
    • Opcode Fuzzy Hash: 8361af50945d4b8400e38457fa78b61e859c30af8c813e38d6f003f0d6030922
    • Instruction Fuzzy Hash: 543158B4604248FFEB01DF14D8949AD7BA4EB05369F14C11EFC689F381D236AA84DB60
    Function 04D8873C Relevance: 6.1, APIs: 4, Instructions: 75windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04D8878C
    • GetDesktopWindow.USER32 ref: 04D887A3
    • SetWindowTextW.USER32(00000000), ref: 04D887AA
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000000), ref: 04D887D2
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: 292cb94f8a7c4f8a5c8f3aeb6d13fbeb06628a78c74a0dc30affbc74973b73e7
    • Instruction ID: eb199d00b6142f5d634560438980746df7c93ed9c3132c45a23bc7ec6e3c36a9
    • Opcode Fuzzy Hash: 292cb94f8a7c4f8a5c8f3aeb6d13fbeb06628a78c74a0dc30affbc74973b73e7
    • Instruction Fuzzy Hash: 3B315674E04308FFEB10EF9AD8886BDBBB5FB84305F94C1A9E46466281D3752685EB10
    Function 04D9BABF Relevance: 6.1, APIs: 4, Instructions: 74COMMON
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentH_prologPoint32TextWindow
    • String ID:
    • API String ID: 4235267150-0
    • Opcode ID: 97a4a68b3f210c42b4d9e5ba559917d0774d6207627e0ffa3ce2a8be599ee9fb
    • Instruction ID: cf1ac08e552e0e8f03f8291b07e836921aade1f23998aef732b63986f3f9f763
    • Opcode Fuzzy Hash: 97a4a68b3f210c42b4d9e5ba559917d0774d6207627e0ffa3ce2a8be599ee9fb
    • Instruction Fuzzy Hash: 8521AC71A00148BBEF10EFA4DC59EEF7BB8EF85708F00414AF505A7290DA75AE14CBA1
    Function 04D88669 Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04D886B6
    • GetDesktopWindow.USER32 ref: 04D886CA
    • SetWindowTextW.USER32(00000000), ref: 04D886D1
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,00000000), ref: 04D886F6
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: a64988ca9c8bc53ba9b3c69337cddfe634b66f3228c292d0bf810e27018df733
    • Instruction ID: d711bb1422d7d20d084385ba7a852a71fe72d2017ddf3761d16f817b5872810f
    • Opcode Fuzzy Hash: a64988ca9c8bc53ba9b3c69337cddfe634b66f3228c292d0bf810e27018df733
    • Instruction Fuzzy Hash: B82144B4D44348FEEB00EFA8C8995ADBFB4FB00315F948999E450A6381D2365685DB50
    Function 04D8E23E Relevance: 6.1, APIs: 4, Instructions: 64windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04D8E28B
    • GetDesktopWindow.USER32 ref: 04D8E29F
    • SetWindowTextW.USER32(00000000), ref: 04D8E2A6
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 04D8E2CB
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: 038a60011d780afdfcdd596a3b69c05312d4c2a2337e6aeac40f9903a98b05cd
    • Instruction ID: fa8797355d9d6f92677eba62a97d17992a854ce89be9fd0bec6d183c6607bf59
    • Opcode Fuzzy Hash: 038a60011d780afdfcdd596a3b69c05312d4c2a2337e6aeac40f9903a98b05cd
    • Instruction Fuzzy Hash: 9A2122B0E4934CFEEB10EFD88499AADBFB4EB05305F508299E560A6382C2356685CF50
    Function 04D7BB5E Relevance: 6.1, APIs: 4, Instructions: 60COMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D7BBD0
    • SetWindowLongW.USER32(00000000), ref: 04D7BBD7
    • SetLastError.KERNEL32(00002292), ref: 04D7BC00
    • GetUserDefaultUILanguage.KERNEL32 ref: 04D7BC08
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$DefaultDesktopErrorLanguageLastLongUser
    • String ID:
    • API String ID: 1756640285-0
    • Opcode ID: 1d1d31bd3fea092bd284f232e8a377431e4e135a6baceee089a0832215659b40
    • Instruction ID: 43a73139a490417c190913f0b7b71f1d375c31f071fd258d3b27f6d970a21b9f
    • Opcode Fuzzy Hash: 1d1d31bd3fea092bd284f232e8a377431e4e135a6baceee089a0832215659b40
    • Instruction Fuzzy Hash: 38217FB4E04259DFDB40CFA9C994AEDBBF4BB09600F1440AAE855E7340E735AA00CF61
    Function 04D7F97D Relevance: 6.1, APIs: 4, Instructions: 57windowCOMMON
    Download Yara Rule
    APIs
    • GetDesktopWindow.USER32 ref: 04D7F9BF
    • GetDC.USER32(00000000), ref: 04D7F9C6
    • DrawFocusRect.USER32(00000000), ref: 04D7F9CD
    • GetSysColorBrush.USER32(0000196A), ref: 04D7F9F0
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: BrushColorDesktopDrawFocusRectWindow
    • String ID:
    • API String ID: 2851196967-0
    • Opcode ID: edd6567f8eb97178959b71376a7abf5848481eec1d73c924bdd6a5c3da907487
    • Instruction ID: c6457dd6825f7101492d7d0e74f0af40e9138480fee4a3dea78207d9aa2b682c
    • Opcode Fuzzy Hash: edd6567f8eb97178959b71376a7abf5848481eec1d73c924bdd6a5c3da907487
    • Instruction Fuzzy Hash: 3E21F7B0E00209EFDB50CFA9C845AAEBBF4FB09740F14405AF954E7381E734EA109BA1
    Function 04D7B9C7 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
    Download Yara Rule
    APIs
    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000000), ref: 04D7BA0D
    • GetDesktopWindow.USER32 ref: 04D7BA34
    • GetDC.USER32(00000000), ref: 04D7BA3B
    • GetTextExtentPointW.GDI32(00000000,?,04D7BFFD,00000718), ref: 04D7BA42
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentLookupPointPrivilegeTextValueWindow
    • String ID:
    • API String ID: 2870449056-0
    • Opcode ID: 97098f63073b151af5f812a51745fecfe5d7150d86d446579c419688f7a79f7d
    • Instruction ID: 5e7dd4c1d823ae6951c58cad19ee82294acecd14be208413edd0cb536e173766
    • Opcode Fuzzy Hash: 97098f63073b151af5f812a51745fecfe5d7150d86d446579c419688f7a79f7d
    • Instruction Fuzzy Hash: 4511C670E04209EFDB50DFA9D845BAEBBF4FB08711F144456F955E7381E674EA008BA0
    Function 04DAFF0E Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
    • String ID:
    • API String ID: 3016257755-0
    • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
    • Instruction ID: 8a1be8cddb6a3788cfbdc845b4593f5d56e3112413fb936adda96c58ce43824d
    • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
    • Instruction Fuzzy Hash: 6001893200414EFFCF125F84CC01CEE3F22BB1A344B08899AFA5898171D736E5B6AB91
    Function 04DADB2C Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
    Download Yara Rule
    APIs
    • ___BuildCatchObject.LIBCMT ref: 04DADB43
      • Part of subcall function 04DAE15A: ___AdjustPointer.LIBCMT ref: 04DAE1A3
    • _UnwindNestedFrames.LIBCMT ref: 04DADB5A
    • ___FrameUnwindToState.LIBCMT ref: 04DADB6C
    • CallCatchBlock.LIBCMT ref: 04DADB90
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
    • String ID:
    • API String ID: 2633735394-0
    • Opcode ID: 8b30573c538f3b1fc18e63ca7426e9ddefb9c98fc61009f8d964c6abd2916d26
    • Instruction ID: 73fea17b4a2afff0b0cbc2f5cb7bff2e4b353a9fac50ad4229718060cb683eb0
    • Opcode Fuzzy Hash: 8b30573c538f3b1fc18e63ca7426e9ddefb9c98fc61009f8d964c6abd2916d26
    • Instruction Fuzzy Hash: 89011032100108BBDF12AF55CC04EEA7BBAFF89758F058414FA1866520D332F9B1EBA0
    Function 04D9B42F Relevance: 6.0, APIs: 4, Instructions: 46COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D9B434
    • GetDesktopWindow.USER32 ref: 04D9B497
    • GetDC.USER32(00000000), ref: 04D9B49E
    • GetTextExtentPoint32W.GDI32(00000000,?,04D9A53B,?), ref: 04D9B4A5
      • Part of subcall function 04D9B820: __EH_prolog.LIBCMT ref: 04D9B825
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog$DesktopExtentPoint32TextWindow
    • String ID:
    • API String ID: 2853833731-0
    • Opcode ID: a20bb41d087de1aff95c4f8350573c455e3edca3be4fa71ae379e4c1cc389932
    • Instruction ID: fb9f831a7680f7205b0faaa67d90f03dff6deed9aadcd3a4ecfcca331c453734
    • Opcode Fuzzy Hash: a20bb41d087de1aff95c4f8350573c455e3edca3be4fa71ae379e4c1cc389932
    • Instruction Fuzzy Hash: 70115E30A00109EBEF05EFA0E959BEC7BB4FF0070CF108149E50666281DB786A14DBA1
    Function 04D93353 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
    Download Yara Rule
    APIs
    • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000000), ref: 04D933A3
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: LookupPrivilegeValue
    • String ID:
    • API String ID: 3899507212-0
    • Opcode ID: 97e90c32b27cdc6a0893ccacd1ff84ec07de06be73ad9254ce9e66c3f14777c2
    • Instruction ID: 7e71e0574cb81261db55cb61a34d5f70b454cc57a0ba640943d5b47425f92015
    • Opcode Fuzzy Hash: 97e90c32b27cdc6a0893ccacd1ff84ec07de06be73ad9254ce9e66c3f14777c2
    • Instruction Fuzzy Hash: 3B010871544245EFDF019FA8E848BA97BE8FB4A315F080485FC4987351CB75AC90CB90
    Function 04D71F3C Relevance: 6.0, APIs: 4, Instructions: 41windowCOMMON
    Download Yara Rule
    APIs
    • GetSysColorBrush.USER32(0000196A), ref: 04D71F65
    • GetDesktopWindow.USER32 ref: 04D71F8F
    • SetWindowTextW.USER32(00000000), ref: 04D71F96
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 04D71FC2
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Window$BrushColorDesktopFormatMessageText
    • String ID:
    • API String ID: 4286015720-0
    • Opcode ID: ba5b90cebbcce6578db1b9d60c37b27ad97191d5aa5b53f0fb059b0e2f311e09
    • Instruction ID: ed2ecaeaefa2090b51b2c61b84ea88a4a8fe0943f40757854415b57e11573132
    • Opcode Fuzzy Hash: ba5b90cebbcce6578db1b9d60c37b27ad97191d5aa5b53f0fb059b0e2f311e09
    • Instruction Fuzzy Hash: AB014075A48768DAEB109FA8DC59BEDFFB0BB05705F040706F145BA3C1E77895009B20
    Function 04D862EB Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON
    Download Yara Rule
    APIs
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,?,04D863C0,00000000,00003AF7,000005E3,00000003,?,04D86385,00000000), ref: 04D86327
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: FormatMessage
    • String ID:
    • API String ID: 1306739567-0
    • Opcode ID: c6f52d117df45cc631fd66cfa6c9a4dfa900cb73d50d2d02bcdbcddde5c617ad
    • Instruction ID: 59ee08722fb4310652ecdd29fa2024f518d67a6f80e9763ec25e420f09e38ec9
    • Opcode Fuzzy Hash: c6f52d117df45cc631fd66cfa6c9a4dfa900cb73d50d2d02bcdbcddde5c617ad
    • Instruction Fuzzy Hash: 0FF030B1685348FFFB016AA0AD0DFBA3B9CE704715F0C0444FA0DDA6D2D6B9999086A1
    Function 04D93DCD Relevance: 6.0, APIs: 4, Instructions: 38windowCOMMON
    Download Yara Rule
    APIs
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000), ref: 04D93DF4
    • GetDesktopWindow.USER32 ref: 04D93E0B
    • GetDC.USER32(00000000), ref: 04D93E12
    • GetTextExtentPointW.GDI32(00000000), ref: 04D93E19
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentFormatMessagePointTextWindow
    • String ID:
    • API String ID: 2513662917-0
    • Opcode ID: d55035a9d83f36e36d7efca16e85d635ed686950c41d4b41afdddb876695d21c
    • Instruction ID: 09f6acc6dd9b6afecab1987460212b06a7de20b8330dfdffcc71ca6509179dd6
    • Opcode Fuzzy Hash: d55035a9d83f36e36d7efca16e85d635ed686950c41d4b41afdddb876695d21c
    • Instruction Fuzzy Hash: 98F01271645249FAFF116FA05C1AEBB3BADE704705F080444F909DA6C2D6659D6087A1
    Function 04DA8694 Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON
    Download Yara Rule
    APIs
    • FormatMessageW.KERNEL32(000015F0,00000000,00000CCC,0000056E,00000000,00000917,00000000,?,04DA8114), ref: 04DA86BB
    • GetDesktopWindow.USER32 ref: 04DA86D2
    • GetDC.USER32(00000000), ref: 04DA86D9
    • GetTextExtentPointW.GDI32(00000000,?,04DA8114), ref: 04DA86E0
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: DesktopExtentFormatMessagePointTextWindow
    • String ID:
    • API String ID: 2513662917-0
    • Opcode ID: 684b55cd8c6afcc178a8f6a71c990acefe9ebc20cf06312b88d6349fe9eab253
    • Instruction ID: 9c48fffa66723243e411ab023129be21a8481d6fe45665a13a944d1bd4e62a96
    • Opcode Fuzzy Hash: 684b55cd8c6afcc178a8f6a71c990acefe9ebc20cf06312b88d6349fe9eab253
    • Instruction Fuzzy Hash: C8F082B0686348FAFB007BF0AC0EFBA3B9CD704711F0C8845F90D9A6C3C5699A509765
    Function 04D8D613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prologXinvalid_argumentstd::_
    • String ID: NDEkzAepEGOKPahJWoW
    • API String ID: 4014091808-2683528191
    • Opcode ID: d2e4398d4e7bdf8e9bbf6c8992609fc94745d8f61a2e955721212aaea5cd4341
    • Instruction ID: e2a11ec5c0d169ddce06ab0bb63ff3661387e448661674a93fe59b5368743ab5
    • Opcode Fuzzy Hash: d2e4398d4e7bdf8e9bbf6c8992609fc94745d8f61a2e955721212aaea5cd4341
    • Instruction Fuzzy Hash: 7D612534600249DFDB11EF19C484A69BBE6FB45318F19C49DE85A8B2A2C771FC41CBA0
    Function 04D86605 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 04D8672E
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: fb86cc2adbe064409fae5d5900033baec34f31a6062dc0593f5d8cd0a4a62d81
    • Instruction ID: eca3ae0faa33b4efae0945fdbd18e3c1d517d2daf8551761d6dc8ab395aaac50
    • Opcode Fuzzy Hash: fb86cc2adbe064409fae5d5900033baec34f31a6062dc0593f5d8cd0a4a62d81
    • Instruction Fuzzy Hash: 2C412A70700249DFCB24EF58D9849AA77FAFF84764710496EE8928B610EB30F955CBE1
    Function 04D970C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
    Download Yara Rule
    APIs
    • __EH_prolog.LIBCMT ref: 04D970C5
    • std::_Xinvalid_argument.LIBCPMT ref: 04D97118
      • Part of subcall function 04DA8863: std::exception::exception.LIBCMT ref: 04DA8876
      • Part of subcall function 04DA8863: __CxxThrowException@8.LIBCMT ref: 04DA888B
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Exception@8H_prologThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 935663214-3797114014
    • Opcode ID: 6e9898adeb8d5457bfbdffbf7b4f37ccc362da3a5c003ed36a9b2cacf93e2d24
    • Instruction ID: 3113cfe9c0d970a34eed65acc78ec2b1707be41bbebbc1b6727cd19bab6d6265
    • Opcode Fuzzy Hash: 6e9898adeb8d5457bfbdffbf7b4f37ccc362da3a5c003ed36a9b2cacf93e2d24
    • Instruction Fuzzy Hash: 244191B2A0020AEFEF04AF68CC859ADBBE5FF48310F10451AF815D7250DB31AD20DBA0
    Function 04D74476 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 04D74521
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: 8c5772eff2a82cf8b0bd56194b1c1050818ac1088027270fab4c871ef28637e0
    • Instruction ID: 9cffbf2dfe52b2db40d547704b7714c2a992dc05bcca877e70ab7d287f0511a8
    • Opcode Fuzzy Hash: 8c5772eff2a82cf8b0bd56194b1c1050818ac1088027270fab4c871ef28637e0
    • Instruction Fuzzy Hash: 1C11B1313003049BCB31DF68C88899AB7E9FF817587200A2EE49687654FB70F918CBE1
    Function 04D8673E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 04D867E9
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: 583b6e71d7c717bd0cec4ac38c4535afbaff0cb8487b73b1e1393a80ae79e77e
    • Instruction ID: b9f8e2b708039f95afabc056a143ebfc35ab46d13b7b1ad4164461f7fa748f24
    • Opcode Fuzzy Hash: 583b6e71d7c717bd0cec4ac38c4535afbaff0cb8487b73b1e1393a80ae79e77e
    • Instruction Fuzzy Hash: 7611A535300204ABC720EE69DC849AAB7E9FF81764710092DE49287A44EB30F919C7E1
    Function 04D86487 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 04D86527
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: a3b0e46828a229874d2f725702762a16bf24471c459e629a1c6da2936222e467
    • Instruction ID: 40e4bdfd7a2f71927dfa73635726b6b43afb7547d571f185458201ca94a5ff56
    • Opcode Fuzzy Hash: a3b0e46828a229874d2f725702762a16bf24471c459e629a1c6da2936222e467
    • Instruction Fuzzy Hash: B711AC30300219AFC724EE6CD8849AAB7A9FF40764710097DE846CB644DB30F919CBA1
    Function 04D9777C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON
    Download Yara Rule
    APIs
    • std::_Xinvalid_argument.LIBCPMT ref: 04D9781C
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: Xinvalid_argumentstd::_
    • String ID: DwKoYBuJCEyytDi$xbftzkZErMGIHumMcosuOxQ
    • API String ID: 909987262-141594409
    • Opcode ID: 8ec5d75041668873c0643a6f0059fe0f19624e6ffc7a1838491e55e96549786a
    • Instruction ID: 72a8ca44e8bbdd52a6204c8f6542fd32888d79ab42c37dd6ab1b4c20c692d32f
    • Opcode Fuzzy Hash: 8ec5d75041668873c0643a6f0059fe0f19624e6ffc7a1838491e55e96549786a
    • Instruction Fuzzy Hash: 1D117C35310209EBCB24DF6CD88099AB7E9FF44754710092DE856C7650DB70FD58CBA1
    Function 04D87A37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON
    Download Yara Rule
    APIs
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: H_prolog
    • String ID: null$true
    • API String ID: 3519838083-1304502921
    • Opcode ID: 2274a5f4e329b3f1c194a435c3dc49496ea01ff04002c236fa04ea4295dcc8e7
    • Instruction ID: 69d3807a6c338c21a0ebd91fe2131e6b5279d9ebc1046489c592cb1300dfbc54
    • Opcode Fuzzy Hash: 2274a5f4e329b3f1c194a435c3dc49496ea01ff04002c236fa04ea4295dcc8e7
    • Instruction Fuzzy Hash: F8014071E44218B6EB10EA95CC49FDFBF7CEB49B68F004119B948B6280C774A648C7B1
    Function 04D731A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33memoryCOMMON
    Download Yara Rule
    APIs
    • _Allocate.LIBCPMT ref: 04D731CD
    • std::_Xinvalid_argument.LIBCPMT ref: 04D731EC
      • Part of subcall function 04DA8863: std::exception::exception.LIBCMT ref: 04DA8876
      • Part of subcall function 04DA8863: __CxxThrowException@8.LIBCMT ref: 04DA888B
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 2227214630-3797114014
    • Opcode ID: ca1775d4c7d467881ce0fca813880d922b89b521aec942508b4232e43b7f7e52
    • Instruction ID: 803307f69343992c83f11c47268a9c1842a1a80e0a0f41a38d6698e78fa360d8
    • Opcode Fuzzy Hash: ca1775d4c7d467881ce0fca813880d922b89b521aec942508b4232e43b7f7e52
    • Instruction Fuzzy Hash: DAF0A076604305AF9320DF29D4408A6BBECEA456B0320883FD9E9C3740FA32B0419BA0
    Function 04D86A47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33memoryCOMMON
    Download Yara Rule
    APIs
    • _Allocate.LIBCPMT ref: 04D86A6A
    • std::_Xinvalid_argument.LIBCPMT ref: 04D86A88
      • Part of subcall function 04DA8863: std::exception::exception.LIBCMT ref: 04DA8876
      • Part of subcall function 04DA8863: __CxxThrowException@8.LIBCMT ref: 04DA888B
    Strings
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
    • String ID: EQsxisSNUMqiHowmSY
    • API String ID: 2227214630-3797114014
    • Opcode ID: 4d43984083a3814bdbca92cad3aaf299f08b1970c43c42eb1a0dc70b507cd37f
    • Instruction ID: d4290b32468ae1dfe6e1117721902e0846df524b070360d958e5f8ab49424aa6
    • Opcode Fuzzy Hash: 4d43984083a3814bdbca92cad3aaf299f08b1970c43c42eb1a0dc70b507cd37f
    • Instruction Fuzzy Hash: A5F0E576200701AF8320AF7AD8405A7B7E8EA85670320C63FE5E9C3740EA30F4414BA0
    Function 04DAD3CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
    Download Yara Rule
    APIs
    • __CxxThrowException@8.LIBCMT ref: 04DAD3B6
      • Part of subcall function 04DA9254: RaiseException.KERNEL32(?,?,04DA8890,04D918DB,00000003,?,?,?,?,?,04DA8890,04D918DB,04DC8A94,00000003), ref: 04DA92A9
    • std::bad_exception::bad_exception.LIBCMT ref: 04DAD3DD
      • Part of subcall function 04DABC44: std::bad_exception::bad_exception.LIBCMT ref: 04DABC4D
    Strings
    • VzGQCIbqrdwuIsGHNdRpxKtwJdXpetLf, xrefs: 04DAD3D5
    Memory Dump Source
    • Source File: 00000006.00000002.2292140679.0000000004D71000.00000020.00001000.00020000.00000000.sdmp, Offset: 04D70000, based on PE: true
    • Associated: 00000006.00000002.2292117905.0000000004D70000.00000004.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292184178.0000000004DBE000.00000002.00001000.00020000.00000000.sdmpDownload File
    • Associated: 00000006.00000002.2292210435.0000000004DCA000.00000004.00001000.00020000.00000000.sdmpDownload File
    Joe Sandbox IDA Plugin
    • Snapshot File: hcaresult_6_2_4d70000_rundll32.jbxd
    Similarity
    • API ID: std::bad_exception::bad_exception$ExceptionException@8RaiseThrow
    • String ID: VzGQCIbqrdwuIsGHNdRpxKtwJdXpetLf
    • API String ID: 1432139112-2565811093
    • Opcode ID: a373771c3bb36525e53903d56f26db9282d3275eecf371d18ba6cea2f6898ad6
    • Instruction ID: b7f3bb66e052d809990adb8481a331291941c3354f45609942b43c579d66b969
    • Opcode Fuzzy Hash: a373771c3bb36525e53903d56f26db9282d3275eecf371d18ba6cea2f6898ad6
    • Instruction Fuzzy Hash: 75E01276B002059FDF04DBA4C941AED7770AB0531AF150459E412B7550D774B968DF61