Edit tour

Windows Analysis Report
PSAbout.dll

Overview

General Information

Sample name:	PSAbout.dll
Analysis ID:	1530831
MD5:	63bc611e8759bdf6d8d5f8be08942fe9
SHA1:	5ebc4ccd7c7014e4bcba59a45f73362d30c97f69
SHA256:	229a826e1a0f3cadcc0410465038d53f62499998f13db4c1f55d07cd563a8388
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Creates a process in suspended mode (likely to inject code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

One or more processes crash

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 7120 cmdline: loaddll32.exe "C:\Users\user\Desktop\PSAbout.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)

conhost.exe (PID: 6376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5824 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

rundll32.exe (PID: 6536 cmdline: rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 5728 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 3164 cmdline: rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_GetAppVersion@8 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6892 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 2160 cmdline: rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_ShowAbout@4 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 4612 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 632 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 6744 cmdline: rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_ShowAboutExt@8 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6740 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 632 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 1888 cmdline: rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_GetAppVersion@8 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 4320 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 352 cmdline: rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowAbout@4 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 2756 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 6704 cmdline: rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowAboutExt@8 MD5: 889B99C52A60DD49227C5E485A016679)

WerFault.exe (PID: 6968 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

rundll32.exe (PID: 6220 cmdline: rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowSplash@4 MD5: 889B99C52A60DD49227C5E485A016679)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: PSAbout.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: Amcache.hve.10.dr

String found in binary or memory: http://upx.sf.net

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10004558 appears 80 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 1000455E appears 80 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 628

Source: PSAbout.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL

Source: classification engine

Classification label: clean5.winDLL@27/28@0/0

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2160
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3164
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess352
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6376:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1888
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6704
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6744
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6536

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\fd3a4f3c-0fdf-4d75-a833-920eb4fbf4dc

Jump to behavior

Source: PSAbout.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\PSAbout.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_GetAppVersion@8
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 628
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 648
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_ShowAbout@4
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 632
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_ShowAboutExt@8
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 632
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_GetAppVersion@8
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowAbout@4
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowAboutExt@8
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowSplash@4
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 628
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 628
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 628
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_GetAppVersion@8	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_ShowAbout@4	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_ShowAboutExt@8	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_GetAppVersion@8	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowAbout@4	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowAboutExt@8	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowSplash@4	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10004B04 push eax; ret	4_2_10004B22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_10004B04 push eax; ret	12_2_10004B22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 15_2_10004B04 push eax; ret	15_2_10004B22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_10004B04 push eax; ret	19_2_10004B22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 20_2_10004B04 push eax; ret	20_2_10004B22

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 5.5 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 12_2_10001830 #537,#860,#941,#941,#941,#941,#941,#941,#941,LdrInitializeThunk,#941,#2818,#860,#939,#941,#941,#941,#941,#941,#941,#941,#941,#800,

12_2_10001830

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Rundll32	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PSAbout.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.10.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530831
Start date and time:	2024-10-10 15:36:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PSAbout.dll
Detection:	CLEAN
Classification:	clean5.winDLL@27/28@0/0
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 51 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .dll

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 6220 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: PSAbout.dll

Simulations

Behavior and APIs

Time	Type	Description
09:37:23	API Interceptor	7x Sleep call for process: WerFault.exe modified
09:37:25	API Interceptor	1x Sleep call for process: loaddll32.exe modified

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ac7a4fc5b84473d26fc49234f984b16b262e2c8_7522e4b5_3d48e3d7-7135-41ac-a87c-8d7dc7ca6b79\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8561609264385781
Encrypted:	false
SSDEEP:	192:6QiSbOvW0BU/wjeTyzuiFrZ24IO8dci9:5iSiv9BU/wjeGzuiFrY4IO8dci
MD5:	AA998DD0D56DB0EB07EF6106E196513B
SHA1:	09A5D626E83E9B7D2F9FAA536B2582BFF04D04B4
SHA-256:	0A4EF9FFD5467CC0CAD3C2C46F0835FA2839A287D5C0CB4D5B882EDB7EDA9340
SHA-512:	FA95C0F17A8EE35DDAFDAC3297079FF201A75B27A701CBABD5AF9C1F8BAD62CE74C506E0B22FAC8FF096571A52AEC735DF611DBCD6284464858C0132AD4DA9BC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.4.1.0.3.7.7.0.8.5.0.3.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.0.4.1.0.3.8.3.0.2.2.6.0.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.d.4.8.e.3.d.7.-.7.1.3.5.-.4.1.a.c.-.a.8.7.c.-.8.d.7.d.c.7.c.a.6.b.7.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.b.b.e.4.8.b.7.-.f.3.0.3.-.4.b.3.f.-.9.4.8.1.-.9.5.a.b.4.e.c.4.4.4.e.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.8.8.-.0.0.0.1.-.0.0.1.4.-.a.0.4.5.-.3.9.8.5.1.9.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ac7a4fc5b84473d26fc49234f984b16b262e2c8_7522e4b5_56d3a75f-5829-405b-ad15-41ebb152a4ec\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8559880310968484
Encrypted:	false
SSDEEP:	96:NOFo616iOhVyBZsj94sFmLbfTQXIDcQvc6QcEVcw3cE/O/a/z+HbHg/BQAS/YyN4:AaiOOBZW0BU/wjeTyzuiFrZ24IO8dci
MD5:	E99CFD10253373EB10C25C3F2C463C2F
SHA1:	DD2499CEBDF088735D2FD24EA7B8FD6F8C63380E
SHA-256:	270011CD50D48A31A00B9C4720C3ACD87E2072F56988639A9556F8A5A002FA2E
SHA-512:	2F5E80C3EC70FB0778F4C23848500B005C9485B613BD9D33006C5EFDA28CD5D146DAD15B190975A46CBFAA019A0ECAD97B463E852A41A0ECA166438DE7CF396C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.4.1.0.3.7.7.0.8.6.5.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.0.4.1.0.3.8.2.2.4.2.7.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.6.d.3.a.7.5.f.-.5.8.2.9.-.4.0.5.b.-.a.d.1.5.-.4.1.e.b.b.1.5.2.a.4.e.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.e.1.0.3.1.0.-.f.d.7.8.-.4.9.c.d.-.8.1.c.e.-.8.3.9.b.e.9.4.8.3.c.a.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.5.c.-.0.0.0.1.-.0.0.1.4.-.4.5.4.6.-.3.9.8.5.1.9.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ac7a4fc5b84473d26fc49234f984b16b262e2c8_7522e4b5_808f954a-53f1-4397-b5c1-6356f3c5f3fc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8560658260762943
Encrypted:	false
SSDEEP:	96:qFFCQ36iKhVyQsj94sFmLbfTQXIDcQvc6QcEVcw3cE/O/a/z+HbHg/BQAS/YyNle:G4riKOQW0BU/wjeTyzuiFrZ24IO8dci
MD5:	80BA0DC72A8A6A59E8BA664776683ECD
SHA1:	95A4991C1B6118AA3D5F580716A0F7E6EF6D427A
SHA-256:	6553E3C797F282B4A5257EB57008E15AE9D3D46774056500520AB41FA9DC6369
SHA-512:	C2E93EDF51633A952B1F02406BEE073B59A97D222BF0982620F12077DE90E8FDDB37A5DEF7F4BABDEAAE7456E56B4B4E25FA9B79F330FA66A34A2884B9FE9DF0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.6.4.6.6.3.2.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.7.1.8.5.0.7.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.8.f.9.5.4.a.-.5.3.f.1.-.4.3.9.7.-.b.5.c.1.-.6.3.5.6.f.3.c.5.f.3.f.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.0.4.e.6.8.2.-.3.7.d.2.-.4.0.0.1.-.a.b.0.2.-.2.3.d.1.3.7.8.0.9.a.b.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.6.0.-.0.0.0.1.-.0.0.1.4.-.d.2.e.e.-.b.9.8.a.1.9.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d6e6e8b58b7a0a9a6bb978481c3782f98cadcf_7522e4b5_38ca8843-afa9-4f41-a8ef-8e9775b40cf2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8759022251941168
Encrypted:	false
SSDEEP:	192:Q9/i9O720BU/wjeTV/zuiFrZ24IO8dci:w/i07dBU/wjeZzuiFrY4IO8dci
MD5:	8B50912A12CD264DE261CDF437541584
SHA1:	E49767A75A52313E12D36824FC9DAE794FFBC0A8
SHA-256:	11A13AE271BE313E499524CE9E8A567393B71E34FE3008E60565985DE5F9C144
SHA-512:	A981547E0230291638C73B223221DFA30602216F8E6490E99D342A257433213E284429AC39C28DADEB4D1498882BA4E68E573EAB23F951125A42F2A3C80E85E2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.2.5.6.6.2.8.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.2.9.4.1.2.8.8.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.c.a.8.8.4.3.-.a.f.a.9.-.4.f.4.1.-.a.8.e.f.-.8.e.9.7.7.5.b.4.0.c.f.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.8.8.e.1.5.f.9.-.e.c.0.3.-.4.a.0.6.-.9.c.3.2.-.4.2.9.e.0.c.3.1.e.4.3.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.5.8.-.0.0.0.1.-.0.0.1.4.-.2.e.6.0.-.e.c.8.8.1.9.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d6e6e8b58b7a0a9a6bb978481c3782f98cadcf_7522e4b5_6122d459-8098-4c10-8204-ad092330c3b0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8759263453046413
Encrypted:	false
SSDEEP:	192:Y21kPizOJ20BU/wjeTV/zuiFrZ24IO8dci:0i6JdBU/wjeZzuiFrY4IO8dci
MD5:	7869A0B8A57EE5447BC4852E651B7DAC
SHA1:	05E1009F610802AB07EEB69C30B5369E4D95A88D
SHA-256:	740ECD64017316DA1ADDAEE2CC70967557678377E6596E305828FFFEFC77E660
SHA-512:	C6735F0B6D9AC24C610DD0D7B1AA62001032107DBBC40F71CE1557D0D7F85FB6237AF671F20440507EF53EF05BE80A6EC942A8A7E1A07976728B183177BDDA18
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.6.3.8.6.4.1.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.7.3.0.8.3.0.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.1.2.2.d.4.5.9.-.8.0.9.8.-.4.c.1.0.-.8.2.0.4.-.a.d.0.9.2.3.3.0.c.3.b.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.4.8.e.3.1.7.-.2.f.2.a.-.4.d.9.5.-.8.f.c.c.-.f.b.2.8.6.6.f.2.e.d.a.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.0.-.0.0.0.1.-.0.0.1.4.-.a.2.3.7.-.b.c.8.a.1.9.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d6e6e8b58b7a0a9a6bb978481c3782f98cadcf_7522e4b5_79daa82b-bcfe-4dc5-a6f2-0092226be9e7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8756490178827419
Encrypted:	false
SSDEEP:	192:bqhiQO420BU/wjeTV/zuiFrZ24IO8dci:miB4dBU/wjeZzuiFrY4IO8dci
MD5:	ACDE10C3D71BA89B3097C8EE400E4E71
SHA1:	A930CF38566A858FE444D4930B4E6532513C2143
SHA-256:	67E2A1C6B6DBA99512FB5E64CEDD4EE922C124D2DD07276CABA16008ED926019
SHA-512:	9C24F2E81D6C1A4CC11297C945E8E61E978E30E6063D1E757DCBA1484C5DBDB4E99013BBEC70419436EE1A491C66E1A3B208B97A8FDD0A8449E002F7FB9D4116
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.4.1.0.3.9.8.6.9.3.5.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.0.2.2.8.7.2.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.9.d.a.a.8.2.b.-.b.c.f.e.-.4.d.c.5.-.a.6.f.2.-.0.0.9.2.2.2.6.b.e.9.e.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.9.3.1.7.4.8.9.-.b.9.7.7.-.4.d.c.e.-.9.2.b.2.-.b.e.3.3.a.4.7.4.a.d.a.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.8.7.0.-.0.0.0.1.-.0.0.1.4.-.4.a.6.1.-.1.4.8.7.1.9.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d6e6e8b58b7a0a9a6bb978481c3782f98cadcf_7522e4b5_dfd94030-e641-470d-9dff-0a9fb81ecb98\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8758638086453132
Encrypted:	false
SSDEEP:	192:YZZziAO+20BU/wjeTV/zuiFrZ24IO8dci:ozix+dBU/wjeZzuiFrY4IO8dci
MD5:	38BA0D16FE7914AFF2AF6C14D5F77AD8
SHA1:	3009AEF52F5799A3F598E817242E1B6ED81ED6A0
SHA-256:	956F3419EA077A14E9FB387BE84AC326D727C37443BAA285323D171CCE4E6410
SHA-512:	772D104BB5F383DFBEEB27DCE2E678CB88B86979316C0F37488E9394094D2F7DBC6DED9B590D87389425CC46520D8513AE789CE5FEC319BAB9905CC1F4D43A47
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.6.3.5.4.2.0.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.0.4.1.0.4.7.3.3.8.6.2.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.f.d.9.4.0.3.0.-.e.6.4.1.-.4.7.0.d.-.9.d.f.f.-.0.a.9.f.b.8.1.e.c.b.9.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.e.e.7.d.5.4.0.-.7.9.f.0.-.4.1.0.0.-.8.8.f.6.-.d.9.d.1.1.4.2.9.e.2.c.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.1.6.0.-.0.0.0.1.-.0.0.1.4.-.9.a.2.3.-.b.b.8.a.1.9.1.b.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.f.a.8.8.9.e.4.5.6.a.a.6.4.6.a.4.d.0.a.4.3.4.9.9.7.7.4.3.0.c.e.5.f.a.5.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2714.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 10 13:37:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45638
Entropy (8bit):	1.871200998695336
Encrypted:	false
SSDEEP:	96:5U8hRBWeDLVgJTJs6YqOduawKMDlthioi75I4v4NuO5rxZz5oleO1gq2E6AL2V0c:tTBBAuBIfPO5H4DzEtxwN33dUtu
MD5:	AEEEDF467098312F902A0A0CD53E5FEE
SHA1:	979AA8F6F802B142C1A4E84A3464AF5141475EB3
SHA-256:	3496595C390B10226B06C9A690CB100F8E4C81FACBA976817825FEA4CD4B3718
SHA-512:	B8249A5846607A678978A32186C7E7E9D77FD26654F59D756FE866218D8FDB7973920D4207FF7E71195B4D2F28F302409CF80E31EF81540A8CC018AB9109079D
Malicious:	false
Preview:	MDMP..a..... ..........g.........................................(..........T.......8...........T...............6...........<...........(...............................................................................eJ..............GenuineIntel............T.......\......g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2733.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 10 13:37:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43298
Entropy (8bit):	1.9642106665953796
Encrypted:	false
SSDEEP:	192:tTAuBof6qPO5H4XpEb0WXbNBUNGNs6O7xt:JAaJL5Huy06BUNG2bxt
MD5:	D960BCA8A8176B783757B2F027967EA5
SHA1:	FFA0AFA76E75FAA01111BEAC722E9587184C24F8
SHA-256:	49552BD4561BFDC97B5E05FA615BA85593A1F3A8205D78135C8DFF5621A71922
SHA-512:	178D6240ADA2329FDDDBE7047D92865EA9C3D0994862640EC2BA19C894CA1D5FE4E9D3A80C1549FFD8EB755A77E4B23191D8E23168BABAF752818FBADED1B291
Malicious:	false
Preview:	MDMP..a..... ..........g.........................................(..........T.......8...........T...........`..............<...........(...............................................................................eJ..............GenuineIntel............T..............g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER280F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8262
Entropy (8bit):	3.68940672433702
Encrypted:	false
SSDEEP:	192:R6l7wVeJlE6Ime6Y2s6SgmfTDKTvprr89bWqsfjSm:R6lXJG6Ime6Yt6SgmfTDKaWJfn
MD5:	0F1520E382C0D7EA644CF11E90E82D7D
SHA1:	B7F50C5C47455583E298AC71A3CD4D680754A23C
SHA-256:	A891FB11F523F85B89217A91178BF23251E7FBBD3297AFD8AA66F6F5C1233A0C
SHA-512:	23CF3F92233929760E7E5DB730F5E08E7200AB419BC479EB05929B0FDB7DB6BF46F641526D1A505729F3C6FBA69348F60688F94DECBAFBDC0AAD18384A35306F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER282F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4644
Entropy (8bit):	4.460032681230618
Encrypted:	false
SSDEEP:	48:cvIwWl8zsaJg77aI9HkXWpW8VYGJYm8M4JCdPZFd+q8/cmC/GScSLd:uIjfoI7im7VhYJ0fJ3Ld
MD5:	F3E7EED00D2BF74300EE478D9DF03800
SHA1:	BC6615A18ED7AB3CD430BAD6EC589D3E04944D5F
SHA-256:	90A5A7B6B60C9411635F0E56934ABD68C621FE5703EB6B2A3E1AF148D1A55215
SHA-512:	709C9A1A4C46852515434091F9F93222164598E44A969DB2C925A1E6654A3FEEC2A6FC8DD33C1FD696F61366B7C15551BE17B7FCFEDA2F55A7EA9546465E5DD8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="537399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER287D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8256
Entropy (8bit):	3.691393481881838
Encrypted:	false
SSDEEP:	192:R6l7wVeJzQ6Im766YYp6sgmfTDKTvprG89bBXsf6Lm:R6lXJk6Im766YG6sgmfTDKZBcff
MD5:	3B9A46EEEEC2882F019BE80EE43138B7
SHA1:	33AD85E93680D831DED42A617A16C4648666F4EC
SHA-256:	282C9E6DBE22B967D4D8B81A3824B22167367DEE939B71CA28C2B212E97EAA56
SHA-512:	07082AF7D0B6FC4F29474B434C7C2E3848486455E9A0256BDB0A182FF246203B3B084020FC3497E255CDA24BF3E2C52A6335D159E2FC9A8B67846F00EF5DFC83
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER289D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4644
Entropy (8bit):	4.46134449168974
Encrypted:	false
SSDEEP:	48:cvIwWl8zsaJg77aI9HkXWpW8VYG0Ym8M4JCdPZFQ+q8/cbGScSOd:uIjfoI7im7VhBJFFJ3Od
MD5:	4D5B106C04287B20A4C9DADC1D02C494
SHA1:	9DC5A7A29D5ABFD2876014121D265B42967EBF7F
SHA-256:	9B941F36A21811D68C39369DB2BFD2417F4ABC077499AC7BF9A0C56E1A54782B
SHA-512:	8A7FC19F6B2DF007BDC56C9AE8E92F74822612695B1C130E4A4EC7FEEA1D475583096C43998A77885FD016DB563039BBB850089B694969D57488C8DD8FC3ED45
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="537399" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F8F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 10 13:37:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45958
Entropy (8bit):	2.1484280379853034
Encrypted:	false
SSDEEP:	192:iPTc9BoO5H4HVs/6eESxvUUEslre5S/0FCPHWUBMlRf3:YQDv5Hf/dESCzcC4/0FCPHW8Mz
MD5:	80B9862914FFA1668F6C64352FF296C0
SHA1:	C5653652C8A4FBB3965E3144CCDA24C070CCF111
SHA-256:	40A573A7BBC02FE1AC5BE0A73EE4A0D766AAC6E18590880EFFDBC8493027FB23
SHA-512:	D8AAF76519580A50FEBD087849C0B5FB71E03F4943DBC0384F30DC538C31D978BE9E8E2B920DC6654C451472A9BE1B70368669B014A258B6696AD627F837C443
Malicious:	false
Preview:	MDMP..a..... ..........g....................................$................)..........`.......8...........T...........8...N.......................................................................................................eJ......\.......GenuineIntel............T.......p......g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER300D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	3.6883314118336394
Encrypted:	false
SSDEEP:	192:R6l7wVeJQn6I7q6Y2m6kgmfTD8NTvpr989b6dsfb7+m:R6lXJY6I7q6Yn6kgmfTDKM6Wfv
MD5:	2930ED431B4F0CCDD88557D2DEB10E5D
SHA1:	AA07645E6B5618E0089E8431047CE35BB5BD958F
SHA-256:	D0622DC50D1A708E7BBAF51CE1533749A032AEA0B0AB690A22B6EE946ED5100F
SHA-512:	DB659373D61BB07D2C3FA9F3D9A975BB6502AC9C2A94922E390B60FA72F1F4F8BE6399C3217C6640659ACB6366F525F7B9B6748D0671278C504652A793D0039A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.1.6.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER303D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4644
Entropy (8bit):	4.458141725878348
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9HkXWpW8VYGFYm8M4JCdPnFOty+q8/c1VGScSnd:uIjfvI7im7Vh0JNy3VJ3nd
MD5:	3488B0BF1B5A05FAE3FB145343FDC93E
SHA1:	9BC5DE6397AA7FB6DBFB715E09448D4A4BF2AFFD
SHA-256:	C5050A6540613FAFF55122842D4F3DFE95703D8E06C5CDBB676B11CE07D69B46
SHA-512:	6E9C0B8B6C0165656C9D9C4FD5FC066ED7B33C3D7BC13607563CD18087EFE2F237ED075F973EDDF1C6AB4542326FE2C65EA0FF1D853591DCE4CFB0A2B9A48A59
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="537400" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A0F.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 10 13:37:22 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	46280
Entropy (8bit):	2.146436662618237
Encrypted:	false
SSDEEP:	192:ri3ccK8FUO5H4QF9dKotxxFIjAeeZYax4PHa7A++YFBdz:ojp5HdhTxCjAp777lVz
MD5:	1C2C9BFAECA42D3AAE56A4EBAE16C197
SHA1:	899DD273DDDAB7E0CC99F3C2E365404F0F97BFC6
SHA-256:	C43C34A951F5A4E4BC312C005F8D0BCBDF3A598082C7EE8D54DDBF5B1AEB57C2
SHA-512:	388C1392858E841B932CEA017C6BA88405F2A3F9197708D7541B2237FD25FDE82088E03729E31D38B2C92C0FADDA2D5951D230AE64557F3FCEC62746968FD46D
Malicious:	false
Preview:	MDMP..a..... ..........g....................................$................)..........`.......8...........T.......................................................................................................................eJ......\.......GenuineIntel............T.......X......g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A7D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8256
Entropy (8bit):	3.6899294655381394
Encrypted:	false
SSDEEP:	192:R6l7wVeJkx6IP56Y2Y6rgmfTD8NTvprG89bINsfvYm:R6lXJa6IP56YJ6rgmfTDK5IGf1
MD5:	91C31396375C65C91314E075506AE487
SHA1:	F3EC5196AD138DE14D7624FCE088E2C3A88F8C7A
SHA-256:	F8DBFAA29256EEBA6F81D306584A7EF3C5188363F81F222647B9330F2F0B1DE3
SHA-512:	872079EF9228513D88BF02B4B840530DF82EA781151DBB2B70017DED7B72A7DACBBDB5DA6D8D6220758DFC8DEC6C8FF2D28E9D4A58CE59C29FA096CB4015178B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AAD.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4644
Entropy (8bit):	4.456504835444898
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9HkXWpW8VYGdYm8M4JCdPnFe+q8/csTGScSrd:uIjfvI7im7Vh8JdKTJ3rd
MD5:	641E355BC5A1893D830055C86975B4AF
SHA1:	0A6DF2D7EF3DF2971C50FD5F6C8A92CDF7421CB2
SHA-256:	B11DCCD7F3C57EBB58CFD67D660A078EDCD851775CADE92900ECFB013498246C
SHA-512:	58D8D122FFBB6ACB6C25C714C7DC5C045C1C5C174BFC2CFE71FAE4FF9BD07AC9B62052039B2CEBC74FFAFB79BCFEC1B52F38A5E09F022329B819D405ED1EBDA1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="537400" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER48F3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 10 13:37:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	44952
Entropy (8bit):	2.1816250024290538
Encrypted:	false
SSDEEP:	96:5e89ijjQ1qJjo0fBmIpOts08zrBpTtVKRNzoi75I4v4CamSt3gzyw+8cMRGI/KxP:X9mcbIWNkO5H4AyilKxnzIeFx7NRzYY
MD5:	B9A191DDC153244502E06F1A3541F8C1
SHA1:	685CDFE67DD24B7264EAD8D465449FD65535CDCA
SHA-256:	429549527938B1E5E17BDAD8C480E4E09945EF26BA8381F0273103A4CCEA3010
SHA-512:	BA6488E682730187F458ADAEC50D10FF31E1E1D5A73B1874DDFA4B34DCA428787CDC09DE01F8FE0F434D6D41944F7AFA99A84ED508BBC1FBE1120C7C906F752D
Malicious:	false
Preview:	MDMP..a..... ..........g....................................$................)..........`.......8...........T.......................................................................................................................eJ......\.......GenuineIntel............T.......`......g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4913.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 10 13:37:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	45516
Entropy (8bit):	2.1593747074882073
Encrypted:	false
SSDEEP:	192:XjFjcPPnbkO5H4Ts8FBpxhbozmmv75PaLoG9nx:zFAH35HurpXozmmv752Px
MD5:	EA1651D3AF5968CFEAEDB7953886A187
SHA1:	5951A477DD58FF275A25635265A01525AB51DD46
SHA-256:	39D45B95E5374EC2917DE8995502C674391D08F8C75C5C9B93BAF10764867E8C
SHA-512:	0B029AEB969CDDBF143502DD5A1DE13664DC674708CCE3D3A081D8164EFDC988FF3E0C65C903CC12F2759E88054BD16FA23AC0613A055E9994DF96BC1171C906
Malicious:	false
Preview:	MDMP..a..... ..........g....................................$................)..........`.......8...........T.......................................................................................................................eJ......\.......GenuineIntel............T.......0......g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4970.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 10 13:37:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	42914
Entropy (8bit):	1.9446121909171394
Encrypted:	false
SSDEEP:	192:6TAuB3fNO5H4YbVx5yqEoPLNell3IRO/N:gAaI5Hnxx9Nell6OF
MD5:	FCAB0CD7E07EC7FEDD01388F449A44C9
SHA1:	513F088566A253F5C7342102E4BFC3B2A137C98A
SHA-256:	85FB63EBFA833B4214177BA6E757572321FD9518C0E9558C65617EEE877ABD10
SHA-512:	CAB9D786F6E5EBACEF126A5A3461038463A0F637D73CC98B5B8AD340043C7996DFE4DC2D3563473E372E6B6346107EE9C1EBCB3148221651F805C4F6B5F4E431
Malicious:	false
Preview:	MDMP..a..... ..........g.........................................(..........T.......8...........T...........................<...........(...............................................................................eJ..............GenuineIntel............T.......`......g.............................0..1...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A6B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8252
Entropy (8bit):	3.690911298573603
Encrypted:	false
SSDEEP:	192:R6l7wVeJ0y6Im96Ym36tgmfTDKTvprL89bs8sfZAkm:R6lXJx6Im96YO6tgmfTDKasPfZy
MD5:	74A882F90545F83F2A9A32D873CBEFBF
SHA1:	4759620B202C6A8719449ECDFEE2BA3641918B7C
SHA-256:	C752123298E92513A078D584E8424C92344E880D4C1900FA977F51A73DA26525
SHA-512:	68EA80F2D35720F4BBBEF8739256DC119BBBB6908625E14CA81177A186B216F1C45362C8170C41C736D4643576DCDF7B941E4D672C2A56967A7E6CACF3FB0E0F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.8.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A9B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4644
Entropy (8bit):	4.455885326153716
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9HkXWpW8VYGJYm8M4JCdPZFr+iI+q8/cmOGScSud:uIjfvI7im7VhYJI+iILJ3ud
MD5:	2F183ACED25BC488A30286796D9A945A
SHA1:	E8A3E74FEFFBC0F9967FBD8BE09D32EB44299C4F
SHA-256:	F87D61C20229EB49225B4B58C13AC69855700DF72668817394C5402793A0ADB3
SHA-512:	1616D72554BDB0BE3A534DC5FCB8282BE335020EDDFF8783CFEC00798D997C6A42DCF5BD6D2337D15A8B8963A24091DBDCD18AC32F033C7E3C38D04CD6D1AF53
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="537400" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AAA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8252
Entropy (8bit):	3.6899617184956033
Encrypted:	false
SSDEEP:	192:R6l7wVeJLMo6IP+6Ym86tgmfTD8NTvprp89bs+sf0Ekm:R6lXJP6IP+6Yl6tgmfTDKws9fr
MD5:	0467BC76823A45AFA11E6037E2AB1A24
SHA1:	0D5B6B8024162E1867DC62D9B0C7A177D3C96CAD
SHA-256:	13AAC73EBF51930B15C721826F126785BD36F6B9F473C6938BEFC30099D28E96
SHA-512:	8AA1709B3477A52C729710B442133F1BFE2CAB4A6B140D66EBFD92537277C5FBC4C3A3F1AF2FA24B818996D39AD037B87DB9D98CC10DB4FF2A9ECFF7ECE07623
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AC9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8248
Entropy (8bit):	3.6891503419086398
Encrypted:	false
SSDEEP:	192:R6l7wVeJ5M6ILNL6Ymg6tgmfTD8NTvpr+89bsWsfAOkm:R6lXJS6IpL6Y56tgmfTDKhs1fAk
MD5:	C56FBF82D106DD799AF70D2A4EE519A1
SHA1:	725777676F431C79EEC61D40B73DAF7194CFB7D7
SHA-256:	C5ADD88D23F77ECB8DCD81079DDD79363FFE35C3671EE98B86D974C9E1B589AE
SHA-512:	13B864B3F52DC208E85B803BEAA0713782994529B101C8A7324C173CEA0EC5BC9E5D442853C788C31AF9987D1AEF37509B04E1140C4AAA8498551A9617E7A171
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.5.2.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B18.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4644
Entropy (8bit):	4.457308961053544
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg77aI9HkXWpW8VYGBoYm8M4JCdPnFY+q8/cXGScSvd:uIjfvI7im7VhBFJb5J3vd
MD5:	F6C77D448E14769D06CAB2667D839923
SHA1:	4C98093B66E2D285A3B9755026A276D896346092
SHA-256:	DD5B6EA9B14373AE70C820F0D60864605762E6D82430C1CA1EBAAF2ACB60C6A4
SHA-512:	0643C31E80A7ADBEAD2C12EA890F8460F4F43B2119C3DEB7ADDE7AFC1E4A8111A61184838A44377008539975B801D0397B663B99E600F7406999CB4DB42999D8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="537400" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372862563163917
Encrypted:	false
SSDEEP:	6144:JFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNEiL:fV1QyWWI/glMM6kF7Kq
MD5:	7ABEA600C2DE5E0117ECB978FDEEE30B
SHA1:	4A8849BFCF96FDA66086B8EBF9FE2F670AE2A740
SHA-256:	8A475FE9184813BA4B48C3CB49E866C8F7E9283E7B8F7818511CB3477F1B9B56
SHA-512:	D7E4B12E7B032318ED9E86999AECF8C4680499A8B7C8BC47F6E70A79F4C5504543121D0195B80E60A135E5D33DDC5470DEC3746F251064E7197FED53307320ED
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....................................................................................................................................................................................................................................................................................................................................................qB..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.828041315153659
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PSAbout.dll
File size:	286'720 bytes
MD5:	63bc611e8759bdf6d8d5f8be08942fe9
SHA1:	5ebc4ccd7c7014e4bcba59a45f73362d30c97f69
SHA256:	229a826e1a0f3cadcc0410465038d53f62499998f13db4c1f55d07cd563a8388
SHA512:	76ab897dbe0daa0a7a70cbeea7c224d301b1cc91c74e6f9f2f8795b0cecf5feeff5829b04bdb9d3cf98c61bf0437ba10534c0d36d73ede53f7a7ceed19ba9944
SSDEEP:	3072:L/QeuZn04JZNIo7ejvfB7bUjX6ri3umoye5JLDOoxwlaZ:7QFZ0MNIee7yj6ri3umorJLDPxwsZ
TLSH:	F954C4CCE9304929D3A8963E503677AF09E21C47CDAFA791D39DA83D1E71594A323683
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y...............r...............r.......r.......+.......................+.......................Rich....................PE..L..

File Icon


Icon Hash:	0c0f334d4d320e0c

Static PE Info

General

Entrypoint:	0x10004a65
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DLL
DLL Characteristics:
Time Stamp:	0x4A2FDFE0 [Wed Jun 10 16:31:28 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	27fa98ea6094fe31fb118345761ed249

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push ebx
mov ebx, dword ptr [ebp+08h]
push esi
mov esi, dword ptr [ebp+0Ch]
push edi
mov edi, dword ptr [ebp+10h]
test esi, esi
jne 00007F12B14DCC7Bh
cmp dword ptr [10009914h], 00000000h
jmp 00007F12B14DCC98h
cmp esi, 01h
je 00007F12B14DCC77h
cmp esi, 02h
jne 00007F12B14DCC94h
mov eax, dword ptr [10008714h]
test eax, eax
je 00007F12B14DCC7Bh
push edi
push esi
push ebx
call eax
test eax, eax
je 00007F12B14DCC7Eh
push edi
push esi
push ebx
call 00007F12B14DCB8Ah
test eax, eax
jne 00007F12B14DCC76h
xor eax, eax
jmp 00007F12B14DCCC0h
push edi
push esi
push ebx
call 00007F12B14DC999h
cmp esi, 01h
mov dword ptr [ebp+0Ch], eax
jne 00007F12B14DCC7Eh
test eax, eax
jne 00007F12B14DCCA9h
push edi
push eax
push ebx
call 00007F12B14DCB66h
test esi, esi
je 00007F12B14DCC77h
cmp esi, 03h
jne 00007F12B14DCC98h
push edi
push esi
push ebx
call 00007F12B14DCB55h
test eax, eax
jne 00007F12B14DCC75h
and dword ptr [ebp+0Ch], eax
cmp dword ptr [ebp+0Ch], 00000000h
je 00007F12B14DCC83h
mov eax, dword ptr [10008714h]
test eax, eax
je 00007F12B14DCC7Ah
push edi
push esi
push ebx
call eax
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
pop esi
pop ebx
pop ebp
retn 000Ch
int3
int3
push FFFFFFFFh
push eax
mov eax, dword ptr fs:[00000000h]
push eax
mov eax, dword ptr [esp+0Ch]
mov dword ptr fs:[00000000h], esp
mov dword ptr [esp+0Ch], ebp
lea ebp, dword ptr [esp+0Ch]
push eax
ret
int3
jmp dword ptr [1000631Ch]
jmp dword ptr [00000024h]

Rich Headers

Programming Language:

[C++] VS98 (6.0) SP6 build 8804
[EXP] VC++ 6.0 SP5 build 8804
[LNK] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x7e20	0x98	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7598	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x3b610	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0x8d0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6000	0x3c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4456	0x5000	8d7cc5acd47dc4f72aa1ef468f839e8f	False	0.432080078125	data	5.5845450672353	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x6000	0x1eb8	0x2000	215c51966c4e99342e53c25ce2d402e2	False	0.3514404296875	data	4.539670646787237	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8000	0x1924	0x1000	cd24417590847b685d91423a553837a4	False	0.25048828125	data	3.1422804480790765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xa000	0x3b610	0x3c000	ffbdff51b716aa218bbc13ca505c14a0	False	0.19811604817708334	data	4.681788491300255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46000	0xc78	0x1000	90b4e4f9d00a1c4ac9d824126a073fe6	False	0.4677734375	data	4.398536625722724	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0xcdb8	0x13028	Device independent bitmap graphic, 320 x 240 x 8, image size 76800	English	United States	0.11169474982019932
RT_BITMAP	0x1fde0	0x2582a	Device independent bitmap graphic, 480 x 80 x 32, image size 153602, resolution 2834 x 2834 px/m	English	United States	0.23585347756472838
RT_ICON	0xa270	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.24187725631768953
RT_ICON	0xab18	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	English	United States	0.25030864197530867
RT_ICON	0xb7c0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.4222972972972973
RT_ICON	0xb8e8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.22041577825159914
RT_DIALOG	0xcb20	0x208	data	English	United States	0.5365384615384615
RT_DIALOG	0xcd28	0x8e	data	English	United States	0.6971830985915493
RT_GROUP_ICON	0xc790	0x3e	data	English	United States	0.8548387096774194
RT_VERSION	0xc7d0	0x350	data	English	United States	0.45872641509433965

Imports

DLL	Import
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
MFC42.DLL
MSVCRT.dll	__CxxFrameHandler, __dllonexit, _onexit, ??1type_info@@UAE@XZ, free, _initterm, malloc, _adjust_fdiv, _mbsstr
KERNEL32.dll	LocalFree, GetModuleFileNameA, GetLastError, lstrcatA, lstrlenA, WinExec, lstrcpyA, GetWindowsDirectoryA, LoadLibraryA, FreeLibrary, MulDiv, GetModuleHandleA, LocalAlloc
USER32.dll	PtInRect, InvalidateRect, MessageBeep, SetWindowLongA, KillTimer, ScreenToClient, LoadCursorA, SetRect, OffsetRect, LoadBitmapA, SetTimer, EnableWindow, DrawTextA, SendMessageA, GetWindowRect, CopyIcon, GetParent, GetDC, ReleaseDC, InflateRect, IsWindow, GetSysColor, SetCursor, GetClientRect, GetMessagePos
GDI32.dll	CreateCompatibleDC, GetTextExtentPoint32A, StretchBlt, GetObjectA, GetStockObject, Rectangle, CreateSolidBrush, CreateFontIndirectA
ADVAPI32.dll	RegQueryValueA, RegCloseKey, RegOpenKeyExA
SHELL32.dll	ShellExecuteA

Exports

Name	Ordinal	Address
_GetAppVersion@8	1	0x10004090
_ShowAbout@4	2	0x10003970
_ShowAboutExt@8	3	0x10003c10
_ShowSplash@4	4	0x10003eb0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	09:37:15
Start date:	10/10/2024
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\PSAbout.dll"
Imagebase:	0xf0000
File size:	126'464 bytes
MD5 hash:	51E6071F9CBA48E79F10C84515AAE618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:37:15
Start date:	10/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:37:16
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:37:16
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",#1
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:37:16
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_GetAppVersion@8
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:37:17
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 628
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:37:17
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6536 -s 648
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:37:19
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_ShowAbout@4
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:37:19
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 632
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:37:22
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\PSAbout.dll,_ShowAboutExt@8
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:37:22
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 632
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:37:25
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_GetAppVersion@8
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:37:25
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowAbout@4
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:37:25
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowAboutExt@8
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:37:25
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\PSAbout.dll",_ShowSplash@4
Imagebase:	0x400000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:37:25
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 628
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:37:25
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 628
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:37:25
Start date:	10/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6704 -s 628
Imagebase:	0xc30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	374
Total number of Limit Nodes:	11

Executed Functions

Function 10004090 Relevance: 66.7, APIs: 35, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42 ref: 100040B4
#537.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040C9
#540.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040D5
#6467.MFC42(00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040E7
#860.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040F8
#268.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004100
#2915.MFC42(00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004111
GetModuleFileNameA.KERNEL32(?,00000000,00000100,00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004120
#2915.MFC42(00000000), ref: 1000412A
GetFileVersionInfoSizeA.VERSION(00000000,?,00000000), ref: 10004134
#823.MFC42(00000000,00000000,?,00000000), ref: 10004144
#2915.MFC42(00000000), ref: 10004152
GetFileVersionInfoA.VERSION(00000000,?,00000000,00000000,00000000), ref: 1000415E
GetLastError.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 10004169
#2915.MFC42(00000000,00000000,?,00000000,00000000,00000000), ref: 10004180
VerQueryValueA.VERSION(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000418F
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000419A
#2818.MFC42(?,10008058,?,00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 100041B9
#825.MFC42(00000000,00000000,00000000,00000000), ref: 100041C6
#6877.MFC42(100086C4,100086C8,00000000,?,00000000), ref: 100041E0
#5683.MFC42(0000002E,100086C4,100086C8,00000000,?,00000000), ref: 100041F3
#5710.MFC42(?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004213
#4129.MFC42(?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004226
#924.MFC42(?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004239
#922.MFC42(?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004248
#858.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004255
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004261
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 1000426D
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004279
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004285
#2915.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 1000428F
#1567.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042BB
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042D5
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042E1
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042F0

Strings

\StringFileInfo\040904B0\ProductVersion, xrefs: 100040BB
Build , xrefs: 1000422B
GetFileVersionInfo Error is %d, xrefs: 10004173, 100041A4

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#2915$File$#540ErrorInfoLastVersion$#1567#268#2818#4129#537#5683#5710#6467#6877#823#825#858#860#922#924ModuleNameQuerySizeValue
String ID: Build $GetFileVersionInfo Error is %d$\StringFileInfo\040904B0\ProductVersion
API String ID: 2403904333-2205515449
Opcode ID: 770987e50521ea26e03dca4098ca4b022801d2f4c37430e341b805416c27b2de
Instruction ID: fe3a53cdd048ef3aad4013630a4a48c8c662586e619284a4b3165d18e955ce92
Opcode Fuzzy Hash: 770987e50521ea26e03dca4098ca4b022801d2f4c37430e341b805416c27b2de
Instruction Fuzzy Hash: AD71A3B5801149AAEB04DBE4CD81EEFBB78EF15280F114158F90673286DF746B09C776

Function 100047D9 Relevance: 31.6, APIs: 21, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1116.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F0
#1176.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F5
#1575.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004809
#1168.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004812
#1577.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004830
#1182.MFC42(100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?), ref: 10004843
#823.MFC42(00000040,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?), ref: 1000484A
#342.MFC42(100098F8,00000000,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?), ref: 10004859
#1176.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004868
#1243.MFC42(?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?), ref: 10004870
#1243.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004887
#1176.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 1000488E
#1168.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004896
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048A9
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B0
#1577.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B5
#1253.MFC42(100098F8,00000001,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048C1
#6467.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048D6
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048DB
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048E2
#1255.MFC42(?,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048EA

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #1176$#1168#1197#1243#1570#1577$#1116#1182#1253#1255#1575#342#6467#823
String ID:
API String ID: 2007088025-0
Opcode ID: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction ID: edb89b75dec8b2219673670b66b7d6a2bc8d39bc8546632be8b72beb1c9dc777
Opcode Fuzzy Hash: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction Fuzzy Hash: 4C318FB8600244ABFB10EF61C845F5D77A4EF806E0F13C529F9255B2AADF34E941CB19

Function 10004900 Relevance: 9.0, APIs: 6, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,00002000), ref: 1000490E
LocalFree.KERNEL32(00000000), ref: 1000491A
#1176.MFC42 ref: 10004920
#1243.MFC42(10008868), ref: 1000492C
#1176.MFC42 ref: 1000493E
#1243.MFC42(?), ref: 10004946

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #1176#1243Local$AllocFree
String ID:
API String ID: 2308495640-0
Opcode ID: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction ID: 5589185b89f99a7ae39e63059246849f8e8e202c6ff74abfd7579a51ee7ecbbf
Opcode Fuzzy Hash: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction Fuzzy Hash: 86E092B0944311AAF620DB61CC4AF0B7AD9EF407E2F138439F104960A9CF70E440C618

Non-executed Functions

Function 10001420 Relevance: 89.6, APIs: 47, Strings: 4, Instructions: 301
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4710.MFC42 ref: 1000143D
#540.MFC42 ref: 10001446

Part of subcall function 10001830: #537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
Part of subcall function 10001830: #860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
Part of subcall function 10001830: #941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
Part of subcall function 10001830: #941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
Part of subcall function 10001830: #941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
Part of subcall function 10001830: #941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
Part of subcall function 10001830: #941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
Part of subcall function 10001830: #941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
Part of subcall function 10001830: #941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
Part of subcall function 10001830: #941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
Part of subcall function 10001830: #2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
Part of subcall function 10001830: #860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
Part of subcall function 10001830: #939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
Part of subcall function 10001830: #941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
Part of subcall function 10001830: #941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
Part of subcall function 10001830: #941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
Part of subcall function 10001830: #941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
Part of subcall function 10001830: #941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
Part of subcall function 10001830: #941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
Part of subcall function 10001830: #941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
Part of subcall function 10001830: #941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
Part of subcall function 10001830: #800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

SendMessageA.USER32(?,00000031,00000000,00000000), ref: 1000146D
#2860.MFC42(00000000), ref: 10001470
GetObjectA.GDI32(?,0000003C,?), ref: 10001480
MulDiv.KERNEL32(?,00000003,00000002), ref: 1000148F
CreateFontIndirectA.GDI32(?), ref: 100014A4
#1641.MFC42(00000000), ref: 100014AD
SendMessageA.USER32(?,00000030,?,00000001), ref: 100014C5
GetWindowRect.USER32(?,?), ref: 100014D6
GetWindowRect.USER32(?,?), ref: 100014E4
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000150B
#2818.MFC42(?,About %s,?,6D34A098,00000000,00000000,?,?,00000006), ref: 10001534
#6199.MFC42(?), ref: 10001543
#2818.MFC42(?,10008058,?,?), ref: 10001567
#2818.MFC42(?,10008058,?,?), ref: 1000158E
#6199.MFC42(?,?), ref: 100015A3
#6199.MFC42(?,?,?), ref: 100015B5
#860.MFC42(10008798,?,?,?), ref: 100015C3
#2818.MFC42(10008798,10008058,?,10008798,?,?,?), ref: 100015E0
#6199.MFC42(?,10008798,?,?,?), ref: 100015F3
#860.MFC42(10008798,?,10008798,?,?,?), ref: 10001601
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,?,?), ref: 1000161E
#941.MFC42( ** BETA ** ,10008798,?,10008798,?,?,?), ref: 10001639
#6199.MFC42(?,10008798,?,10008798,?,?,?), ref: 10001649
SendMessageA.USER32(?,00000170,?,00000000), ref: 1000166A
#860.MFC42(10008798,?,10008798,?,10008798,?,?,?), ref: 10001675
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,?,?), ref: 10001692
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016A5
#860.MFC42(10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016B3
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016D0
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016E3
#860.MFC42(PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016F1
GetModuleHandleA.KERNEL32(?,PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016FB
#2919.MFC42(00000100,00000000), ref: 1000170B
_GetAppVersion@8.PSABOUT(00000000,00000100,00000000), ref: 10001711
#926.MFC42(?,ProSoft About Version : ,?,00000000), ref: 10001729
#858.MFC42 ref: 1000173B
#800.MFC42 ref: 10001749
#6199.MFC42(?), ref: 10001759
#860.MFC42(10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001775
#2818.MFC42(?,10008058,00000000,10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001798
#6199.MFC42(?), ref: 100017AD
#2818.MFC42(?,10008058,?,?), ref: 100017C6
#535.MFC42(?,?,?), ref: 100017D9

Part of subcall function 100030F0: #858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
Part of subcall function 100030F0: IsWindow.USER32(?), ref: 10003129
Part of subcall function 100030F0: #6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
Part of subcall function 100030F0: #800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

#800.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000180E

Strings

** BETA ** , xrefs: 10001630
About %s, xrefs: 1000152E
ProSoft About Version : , xrefs: 10001723
PSAbout.dll, xrefs: 100016E8

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#2818$#6199$#860$#800$MessageSendWindow$#858Rect$#1641#2860#2919#4710#535#537#540#6197#6358#926#939CreateFontHandleIndirectModuleObjectVersion@8
String ID: ** BETA ** $About %s$PSAbout.dll$ProSoft About Version :
API String ID: 3958394562-2501452965
Opcode ID: 2d6d7caaa14ef82f1b47294d6a4234ad751df5fa537b5514abdbacb265572677
Instruction ID: f28686d8da41217129008f13a01225032e64cb8ff28e48d6fc26cba87298445a
Opcode Fuzzy Hash: 2d6d7caaa14ef82f1b47294d6a4234ad751df5fa537b5514abdbacb265572677
Instruction Fuzzy Hash: EFB170B4204B41ABE715CB20CC91FAB73E9FB94684F05891CF5969728ADF31FA08CB55

Function 100019F0 Relevance: 84.4, APIs: 47, Strings: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2379.MFC42 ref: 100019F6
GetWindowRect.USER32(?,?), ref: 10001A26
GetWindowRect.USER32(?,?), ref: 10001A34
#6880.MFC42(?), ref: 10001A3D
#6880.MFC42(?,?), ref: 10001A49
GetWindowRect.USER32(?,?), ref: 10001A92
#6880.MFC42(?), ref: 10001A9B
GetWindowRect.USER32(?,?), ref: 10001AB3
#6880.MFC42(?), ref: 10001ABC
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?), ref: 10001AD9
GetWindowRect.USER32(?,?), ref: 10001AF6
#6880.MFC42(?,?,00000000,00000000,00000005,?), ref: 10001AFF
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B1C
GetWindowRect.USER32(?,?), ref: 10001B33
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B3C
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001B5A
GetWindowRect.USER32(?,?), ref: 10001B7D
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B86
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BA4
GetWindowRect.USER32(?,?), ref: 10001BB5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BBE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BE3
GetWindowRect.USER32(?,?), ref: 10001BF4
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BFD
GetWindowRect.USER32(?,?), ref: 10001C20
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C29
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001C47
GetWindowRect.USER32(?,?), ref: 10001C7A
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C83
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001CA8
GetWindowRect.USER32(?,?), ref: 10001CB9
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CC2
GetWindowRect.USER32(?,?), ref: 10001CE5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CEE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D0C
#6215.MFC42(00000000,6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000), ref: 10001D1B
GetWindowRect.USER32(?,?), ref: 10001D3E
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D47
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D75
GetWindowRect.USER32(?,?), ref: 10001D92
#6880.MFC42(?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D9B
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005), ref: 10001DC5
GetWindowRect.USER32(?,?), ref: 10001DE8
#6880.MFC42(?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?), ref: 10001DF1
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,?,?,00000004,?,?,?,?,00000004), ref: 10001E17
GetWindowRect.USER32(?,?), ref: 10001E37
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006,?,00000000,00000000,00000005,?,?,?,?,00000004,?), ref: 10001E5C

Strings

VUUU, xrefs: 10001A58

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: RectWindow$#6880$#6197$#2379#6215
String ID: VUUU
API String ID: 1101919440-2040033107
Opcode ID: 5af9dcfaa13a64d9ed63ef2cdebf1122ea0b7d9a33ddebc90fbc6e32a41cad92
Instruction ID: 5a31ff0520036d38cb31330b8b9511fc0d41158ddc336ad14b2b1ef2a9cc197e
Opcode Fuzzy Hash: 5af9dcfaa13a64d9ed63ef2cdebf1122ea0b7d9a33ddebc90fbc6e32a41cad92
Instruction Fuzzy Hash: D9D120B52147019FE314CF24CC95FABB7E9EBD8B84F104A1CB58687296EA30F905CB95

Function 10001830 Relevance: 66.6, APIs: 22, Strings: 16, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
#860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
#941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
#941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
#941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
#941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
#941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
#941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
#941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
#941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
#2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
#860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
#939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
#941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
#941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
#941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
#941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
#941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
#941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
#941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
#941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
#800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

Strings

result in severe civil and criminal penalties,, xrefs: 10001955
copyright law and international treaties., xrefs: 10001931
5201 Truxtun Avenue, 3rd Floor, xrefs: 10001872
Phone: +1 661-716-5100, xrefs: 10001896
e-mail: prosoft@prosoft-technology.com , xrefs: 100018C6
Web: www.prosoft-technology.com , xrefs: 100018BA
and will be prosecuted to the maximum extent, xrefs: 10001961
Unauthorized reproduction or distribution, xrefs: 1000193D
permissible under the law., xrefs: 1000196D
This computer program is protected by, xrefs: 10001925
Bakersfield, CA 93309 USA., xrefs: 1000187E
2004-2009, xrefs: 1000184A
ProSoft Technology, Inc., xrefs: 1000185E
of this program, or any portion of it, may, xrefs: 10001949
ProSoft Technology Inc. , xrefs: 10001919
Fax: +1 661-716-5101, xrefs: 100018A2

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#860$#2818#537#800#939
String ID: This computer program is protected by$ 5201 Truxtun Avenue, 3rd Floor$ Bakersfield, CA 93309 USA.$ Fax: +1 661-716-5101$ Phone: +1 661-716-5100$ ProSoft Technology Inc. $ ProSoft Technology, Inc.$ Unauthorized reproduction or distribution$ Web: www.prosoft-technology.com $ and will be prosecuted to the maximum extent$ copyright law and international treaties.$ e-mail: prosoft@prosoft-technology.com $ of this program, or any portion of it, may$ permissible under the law.$ result in severe civil and criminal penalties,$2004-2009
API String ID: 560914698-2702941522
Opcode ID: c6e539067b2faed38301796577e253f3a80d9d8a21c050b687919fd72e86b88a
Instruction ID: 91c8ed7013d054164af58b362b1f26a6fbb61d5f425d44fa41214922a166be22
Opcode Fuzzy Hash: c6e539067b2faed38301796577e253f3a80d9d8a21c050b687919fd72e86b88a
Instruction Fuzzy Hash: 473161B4340D9067F909E7188C26AFD6355EF919D2F43451CB3A16728FCF246B1A838E

Function 10002620 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 313
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#470.MFC42 ref: 10002646
#323.MFC42 ref: 10002673
GetClientRect.USER32(?,?), ref: 1000268F
#5788.MFC42(?), ref: 10002699
#5794.MFC42(00000007,?), ref: 100026A6
Rectangle.GDI32(?,?,?,?,?), ref: 100026C9
#5788.MFC42(00000000), ref: 100026D4
#5788.MFC42(00000000,00000000), ref: 100026DE
CreateCompatibleDC.GDI32(?), ref: 100026FD
#1640.MFC42(00000000), ref: 10002708
SendMessageA.USER32(?,00000172,00000000,?), ref: 1000272E
GetClientRect.USER32(?,?), ref: 10002740
#5785.MFC42(?,?), ref: 10002752
MulDiv.KERNEL32(?,?,?), ref: 1000279E
MulDiv.KERNEL32(?,?,?), ref: 100027CB
StretchBlt.GDI32(?,?,00000000,00000000,?,?,100064FC,100064FC,?,?,00CC0020), ref: 10002831
#5785.MFC42(?,?), ref: 10002848
#2405.MFC42(?,?), ref: 10002851
GetClientRect.USER32(?,?), ref: 10002865
GetClientRect.USER32(?,?), ref: 10002870
MulDiv.KERNEL32(?,?,00000064), ref: 1000288C
MulDiv.KERNEL32(?,?,00000064), ref: 100028A6
#6172.MFC42(00FFFFFF), ref: 100028B5
#5875.MFC42(00000001,00FFFFFF), ref: 100028C0
DrawTextA.USER32(?,?,000000FF,?,00000020), ref: 100028DD
DrawTextA.USER32(?,?,000000FF,?,00000420), ref: 100028F4
GetWindowRect.USER32(?,?), ref: 10002902
#6880.MFC42(?), ref: 1000290F
#6172.MFC42(00FFFFFF,?), ref: 1000296D
#5875.MFC42(00000001,00FFFFFF,?), ref: 10002978
DrawTextA.USER32(?,?,000000FF,?,?), ref: 1000299A
#640.MFC42 ref: 100029A8
#2414.MFC42 ref: 100029C1
#755.MFC42 ref: 100029DD

Strings

gfff, xrefs: 1000291E

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#5788DrawText$#5785#5875#6172$#1640#2405#2414#323#470#5794#640#6880#755CompatibleCreateMessageRectangleSendStretchWindow
String ID: gfff
API String ID: 1747922241-1553575800
Opcode ID: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction ID: de8d7cd43940ff7d5f440d9c982899baa02ad0d10f146baf563ef8a33310dbb5
Opcode Fuzzy Hash: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction Fuzzy Hash: ADC125B52087459FE314DF69C884E6BBBE9FBC8740F114A1CF59583299DB70E809CB62

Function 100035B0 Relevance: 61.3, APIs: 20, Strings: 15, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035CB
#860.MFC42(The operating system is outof memory or resources.,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035FD
#860.MFC42(The specified path was not found.,The specified file was not found.), ref: 10003610
#860.MFC42(The specified file was not found.), ref: 10003623
#860.MFC42(The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003636
#860.MFC42(The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003649
#860.MFC42(The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000365C
#860.MFC42(The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000366F
#860.MFC42(The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000367F
#860.MFC42(The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000368F
#860.MFC42(The specified dynamic-link library was not found.,There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000369F
#860.MFC42(There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036AF
#860.MFC42(There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036BF
#860.MFC42(A sharing violation occurred. ,The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036CF
#2818.MFC42(?,Unknown Error (%d) occurred.,?,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100036DF
#926.MFC42(?,Unable to open hyperlink:,?), ref: 100036F6
#858.MFC42(?,?,?,?,?,?,00000005), ref: 10003705
#800.MFC42(?,?,?,?,?,?,00000005), ref: 10003713
#1200.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003721
#800.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003732

Strings

The specified file was not found., xrefs: 1000361A
There is no application associatedwith the given filename extension., xrefs: 100036A6
The DDE transaction could notbe completed because the request timed out., xrefs: 10003686
A sharing violation occurred. , xrefs: 100036C6
The operating system is outof memory or resources., xrefs: 100035F4
Unknown Error (%d) occurred., xrefs: 100036D9
The specified dynamic-link library was not found., xrefs: 10003696
The DDE transaction could notbe completed because other DDE transactionswere being processed., xrefs: 10003666
The .EXE file is invalid(non-Win32 .EXE or error in .EXE image)., xrefs: 1000362D
The DDE transaction failed., xrefs: 10003676
The operating system deniedaccess to the specified file., xrefs: 10003640
Unable to open hyperlink:, xrefs: 100036F0
The specified path was not found., xrefs: 10003607
There was not enough memory to complete the operation., xrefs: 100036B6
The filename association isincomplete or invalid., xrefs: 10003653

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #860$#800$#1200#2818#540#858#926
String ID: A sharing violation occurred. $The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).$The DDE transaction could notbe completed because other DDE transactionswere being processed.$The DDE transaction could notbe completed because the request timed out.$The DDE transaction failed.$The filename association isincomplete or invalid.$The operating system deniedaccess to the specified file.$The operating system is outof memory or resources.$The specified dynamic-link library was not found.$The specified file was not found.$The specified path was not found.$There is no application associatedwith the given filename extension.$There was not enough memory to complete the operation.$Unable to open hyperlink:$Unknown Error (%d) occurred.
API String ID: 346542042-3273680174
Opcode ID: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction ID: bf864e296dc8769b1736225a429bb83c06595c96c86935583d96534d00f8651e
Opcode Fuzzy Hash: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction Fuzzy Hash: F131A2B8018A41BBF215CB14CC62AAF7798FB902C1F01C91CB5D5521AADF33674DC79A

Function 10003C10 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6467.MFC42(00000000), ref: 10003C3D
#268.MFC42(00000000), ref: 10003C4C

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 10003C79
#800.MFC42(00000000,00000000), ref: 10003CAD
#795.MFC42(00000000,00000000), ref: 10003CD7
#795.MFC42(00000000,00000000), ref: 10003CE6
#795.MFC42(00000000,00000000), ref: 10003CF5
#795.MFC42(00000000,00000000), ref: 10003D04
#795.MFC42(00000000,00000000), ref: 10003D13
#795.MFC42(00000000,00000000), ref: 10003D22
#795.MFC42(00000000,00000000), ref: 10003D31
#795.MFC42(00000000,00000000), ref: 10003D40
#795.MFC42(00000000,00000000), ref: 10003D4F
#609.MFC42(00000000,00000000), ref: 10003D5E
#641.MFC42(00000000,00000000), ref: 10003D6C
#1567.MFC42(00000000,00000000), ref: 10003D75
#800.MFC42(00000000,00000000), ref: 10003CB9

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003DAE
#800.MFC42(00000000,00000000), ref: 10003DBA
#795.MFC42(00000000,00000000), ref: 10003DD8
#795.MFC42(00000000,00000000), ref: 10003DE7
#795.MFC42(00000000,00000000), ref: 10003DF6
#795.MFC42(00000000,00000000), ref: 10003E05
#795.MFC42(00000000,00000000), ref: 10003E14
#795.MFC42(00000000,00000000), ref: 10003E23
#795.MFC42(00000000,00000000), ref: 10003E32
#795.MFC42(00000000,00000000), ref: 10003E41
#795.MFC42(00000000,00000000), ref: 10003E50
#609.MFC42(00000000,00000000), ref: 10003E5F
#641.MFC42(00000000,00000000), ref: 10003E6D
#1567.MFC42(00000000,00000000), ref: 10003E76

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

d, xrefs: 10003D8F
, xrefs: 10003D9E

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: 3f530b5441f2d892a080c0bd5957926f97da61dabcd6b1e15bb7fa46be08c984
Instruction ID: ce90d30b60a23b1df5e22dc6523357bb231baf84ee5b8182cc3d66bcb1d629aa
Opcode Fuzzy Hash: 3f530b5441f2d892a080c0bd5957926f97da61dabcd6b1e15bb7fa46be08c984
Instruction Fuzzy Hash: C771477880628CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA32

Function 10003970 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6467.MFC42(00000000), ref: 1000399D
#268.MFC42(00000000), ref: 100039AC

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 100039D3
#800.MFC42(00000000,00000000), ref: 10003A07
#795.MFC42(00000000,00000000), ref: 10003A31
#795.MFC42(00000000,00000000), ref: 10003A40
#795.MFC42(00000000,00000000), ref: 10003A4F
#795.MFC42(00000000,00000000), ref: 10003A5E
#795.MFC42(00000000,00000000), ref: 10003A6D
#795.MFC42(00000000,00000000), ref: 10003A7C
#795.MFC42(00000000,00000000), ref: 10003A8B
#795.MFC42(00000000,00000000), ref: 10003A9A
#795.MFC42(00000000,00000000), ref: 10003AA9
#609.MFC42(00000000,00000000), ref: 10003AB8
#641.MFC42(00000000,00000000), ref: 10003AC6
#1567.MFC42(00000000,00000000), ref: 10003ACF
#800.MFC42(00000000,00000000), ref: 10003A13

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003B08
#800.MFC42(00000000,00000000), ref: 10003B14
#795.MFC42(00000000,00000000), ref: 10003B32
#795.MFC42(00000000,00000000), ref: 10003B41
#795.MFC42(00000000,00000000), ref: 10003B50
#795.MFC42(00000000,00000000), ref: 10003B5F
#795.MFC42(00000000,00000000), ref: 10003B6E
#795.MFC42(00000000,00000000), ref: 10003B7D
#795.MFC42(00000000,00000000), ref: 10003B8C
#795.MFC42(00000000,00000000), ref: 10003B9B
#795.MFC42(00000000,00000000), ref: 10003BAA
#609.MFC42(00000000,00000000), ref: 10003BB9
#641.MFC42(00000000,00000000), ref: 10003BC7
#1567.MFC42(00000000,00000000), ref: 10003BD0

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

d, xrefs: 10003AE9
, xrefs: 10003AF8

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: 341a04f26fdbd9c1622ee57cbe1c4a594b2ccbfd9e9c71afc0d509b46ef7cbd4
Instruction ID: ba9fdb3c8c69b1efcd9dc3c0e08e9eba6e85a8a60e063a58fc3de4da0faa40ac
Opcode Fuzzy Hash: 341a04f26fdbd9c1622ee57cbe1c4a594b2ccbfd9e9c71afc0d509b46ef7cbd4
Instruction Fuzzy Hash: 7871377880618CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA36

Function 10002250 Relevance: 52.6, APIs: 25, Strings: 5, Instructions: 148
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4710.MFC42(?,?,?,?,10004ED8,000000FF), ref: 1000226A
#540.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002273
#2860.MFC42(?,?,?,?,?,10004ED8,000000FF), ref: 1000228E
#823.MFC42(00000008,?,?,?,?,10004ED8,000000FF), ref: 1000229D
#1146.MFC42(00000899,00000002,00000899), ref: 100022C3
LoadBitmapA.USER32(00000000,00000899), ref: 100022C9
#1641.MFC42(00000000), ref: 100022D2
#6215.MFC42(00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022ED
#6215.MFC42(00000005,00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022FA
#6215.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002311
#6215.MFC42(00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000231E
#860.MFC42(10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002332
#860.MFC42(10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002341
#2818.MFC42(?,10008058,?,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000235B
#860.MFC42(10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000236C
#2818.MFC42(?,Version: %s,?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002386
#939.MFC42(?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002395
CreateSolidBrush.GDI32(?), ref: 100023A1
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023AB
CreateSolidBrush.GDI32(00000000), ref: 100023B4
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023BE
#860.MFC42(Error No Data,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023CA
SetTimer.USER32(?,00000001,00000BB8,00000000), ref: 100023D8
#4224.MFC42(could not Start Splash Timmer,ProSoft,00000000,?,?,?,?,10004ED8,000000FF), ref: 100023F4
#800.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002416

Strings

Error No Data, xrefs: 100023C3
This is a Beta version of this program. Not for production use and without warranty., xrefs: 10002302
ProSoft, xrefs: 100023E8
Version: %s, xrefs: 10002380
could not Start Splash Timmer, xrefs: 100023ED

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #6215#860$#1641$#2818BrushCreateSolid$#1146#2860#4224#4710#540#800#823#939BitmapLoadTimer
String ID: Error No Data$ProSoft$This is a Beta version of this program. Not for production use and without warranty.$Version: %s$could not Start Splash Timmer
API String ID: 514652099-906665912
Opcode ID: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction ID: 1913312f89696d600550852331e7f23b7439d3c132441fa52a7110e09bfaff39
Opcode Fuzzy Hash: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction Fuzzy Hash: 67519FB5200F00ABF215DB64CC51BAAB7E8FB58681F014918F6969729ADF34FA04CB95

Function 10002D40 Relevance: 31.6, APIs: 21, Instructions: 126
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3797.MFC42 ref: 10002D5E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 10002D75
#3874.MFC42(?), ref: 10002D8B
#540.MFC42(?), ref: 10002D94
#3874.MFC42(?), ref: 10002DA8
#6199.MFC42(?,?), ref: 10002DBD
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 10002DCC
#2860.MFC42(00000000), ref: 10002DD3
GetStockObject.GDI32(00000011), ref: 10002DE6
GetStockObject.GDI32(0000000C), ref: 10002DEE
#2860.MFC42(00000000), ref: 10002DF5
GetObjectA.GDI32(?,0000003C,?), ref: 10002E07
CreateFontIndirectA.GDI32(?), ref: 10002E18
#1641.MFC42(00000000), ref: 10002E1E
CreateFontIndirectA.GDI32(?), ref: 10002E2D
#1641.MFC42(00000000), ref: 10002E33
GetClientRect.USER32(?,?), ref: 10002E58
#2122.MFC42(?,00000000), ref: 10002E66
#1088.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E78
#5277.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E7F
#800.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E90

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Object$#1641#2860#3874CreateFontIndirectStock$#1088#2122#3797#5277#540#6199#800ClientLongMessageRectSendWindow
String ID:
API String ID: 2029918275-0
Opcode ID: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction ID: c9a03a5f96910dafa03aba3819474b77990a7e9c8b104b6fd7e7a11093b1c142
Opcode Fuzzy Hash: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction Fuzzy Hash: D141CFB4204B42ABE624DB24CC85F6FB3A9EF88B90F010A0CF142972C9DF64F905C765

Function 10003260 Relevance: 28.7, APIs: 19, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindow.USER32(?), ref: 10003287
GetWindowRect.USER32(?,?), ref: 100032AC
GetClientRect.USER32(?,?), ref: 100032BB
#6605.MFC42(?), ref: 100032C8
GetParent.USER32(?), ref: 100032D1
#2864.MFC42(00000000), ref: 100032D8
#6880.MFC42(?,00000000), ref: 100032EA
#6880.MFC42(?,?,00000000), ref: 100032F6
#540.MFC42(00000000), ref: 100032FF
#3874.MFC42 ref: 10003313
GetDC.USER32(?), ref: 1000331C
#2859.MFC42(00000000), ref: 10003323
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 1000334B
ReleaseDC.USER32(?,?), ref: 10003371
#3797.MFC42 ref: 100033A9
InflateRect.USER32(?,00000000,?), ref: 100033D8
InflateRect.USER32(?,?,00000000), ref: 1000340D
#6197.MFC42(00000000,?,?,?,?,00000004), ref: 1000344C
#800.MFC42(00000000,?,?,?,?,00000004), ref: 1000345D

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$#6880InflateWindow$#2859#2864#3797#3874#540#6197#6605#800ClientExtentParentPoint32ReleaseText
String ID:
API String ID: 1555407671-0
Opcode ID: 9ba8622cc01d6324a26a2870b3a9a5ffaf0ee11eddbc399a898b4dcfc491eda3
Instruction ID: fad4f85ae7451d699b48dc3c23a1c9188842fcfe73b98fa0dc477d473762e04e
Opcode Fuzzy Hash: 9ba8622cc01d6324a26a2870b3a9a5ffaf0ee11eddbc399a898b4dcfc491eda3
Instruction Fuzzy Hash: 2A6129B5204341AFD744CF68CD84A6FB7E9FBC8680F454A1CF98593298DB34E9058BA2

Function 10003EB0 Relevance: 25.6, APIs: 17, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6467.MFC42(00000000), ref: 10003EDD
#268.MFC42(00000000), ref: 10003EEA

Part of subcall function 10002070: #324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

#2514.MFC42(00000000,00000000), ref: 10003F12
#795.MFC42(00000000,00000000), ref: 10003F2D
#609.MFC42(00000000,00000000), ref: 10003F3C
#800.MFC42(00000000,00000000), ref: 10003F73
#800.MFC42(00000000,00000000), ref: 10003F82
#641.MFC42(00000000,00000000), ref: 10003F91
#1567.MFC42(00000000,00000000), ref: 10003F99
#609.MFC42(00000000,00000000), ref: 10003F4B

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

#795.MFC42(00000000,00000000), ref: 10003FC6
#609.MFC42(00000000,00000000), ref: 10003FD5
#609.MFC42(00000000,00000000), ref: 10003FE4
#800.MFC42(00000000,00000000), ref: 1000400C
#800.MFC42(00000000,00000000), ref: 1000401B
#641.MFC42(00000000,00000000), ref: 1000402A
#1567.MFC42(00000000,00000000), ref: 10004032

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#567$#1567#540#641#795$#2414#2514#268#324#6467
String ID:
API String ID: 39110236-0
Opcode ID: eeb635a5d736d1da897fff09442119196b4716e430f0748ec461c8690e061da6
Instruction ID: cfaefb5b01c91ea90e470d212f713a34359e3d9334dad7f1e11d803252a963b9
Opcode Fuzzy Hash: eeb635a5d736d1da897fff09442119196b4716e430f0748ec461c8690e061da6
Instruction Fuzzy Hash: 904181B8C05299DAEB10DBA4C9417EDFBB0EF15340F1080E9D54923786DF792B48DB66

Function 10001000 Relevance: 22.6, APIs: 15, Instructions: 97COMMON

Download Yara Rule

APIs

#324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111

Part of subcall function 10002B50: #567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
Part of subcall function 10002B50: #540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
Part of subcall function 10002B50: #556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
Part of subcall function 10002B50: #2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
CreateSolidBrush.GDI32(000000FF), ref: 1000117B
#1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#1641#2614#324#556BrushCreateSolid
String ID:
API String ID: 862247804-0
Opcode ID: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction ID: ef8ebbcba9a2f6dd6cb2c20b7593ac1494135993400dd6ceca74427708b28424
Opcode Fuzzy Hash: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction Fuzzy Hash: B74142B4104B829BE311CF24CC8076ABB96FF99381F650C1CE0951B796DBB87549CB92

Function 100011D0 Relevance: 22.6, APIs: 15, Instructions: 73COMMON

Download Yara Rule

APIs

#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 1000120F
#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001231
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001247
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001257

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001277
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001287
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001297
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012A7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012B7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012C7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012D7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012E7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012F7
#609.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001304
#641.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001313

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#2414$#800$#609#641#809
String ID:
API String ID: 2601255804-0
Opcode ID: 2c95ab70dd719a5e04e56510960948cbcd4c32bf6285c9bd93b8523ca19d1ec8
Instruction ID: c87b3d48cd3f525f1380d43a1c8d41ca1566e881e5744a2b82a627dc5851ada9
Opcode Fuzzy Hash: 2c95ab70dd719a5e04e56510960948cbcd4c32bf6285c9bd93b8523ca19d1ec8
Instruction Fuzzy Hash: 6C311B78108B818AE315DF64C48579ABFD4AFA5380F550C5DE4E603297CBB8624DCBA3

Function 100037B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 87stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,?), ref: 100037D7

Part of subcall function 10003540: RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
Part of subcall function 10003540: RegQueryValueA.ADVAPI32 ref: 1000357E
Part of subcall function 10003540: lstrcpyA.KERNEL32(?,00000000), ref: 10003591
Part of subcall function 10003540: RegCloseKey.ADVAPI32(?), ref: 1000359C

lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?), ref: 10003816
_mbsstr.MSVCRT ref: 10003842
_mbsstr.MSVCRT ref: 10003857
lstrlenA.KERNEL32(?), ref: 10003867
lstrcatA.KERNEL32(00000000,1000866C), ref: 1000387C
lstrcatA.KERNEL32(00000000,?), ref: 10003887
WinExec.KERNEL32(?,?), ref: 1000388F

Strings

.htm, xrefs: 100037ED
"%1", xrefs: 1000383C
\shell\open\command, xrefs: 10003810
open, xrefs: 100037CE

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$_mbsstr$CloseExecExecuteOpenQueryShellValuelstrcpylstrlen
String ID: "%1"$.htm$\shell\open\command$open
API String ID: 729890978-1533145997
Opcode ID: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction ID: bfa4e36c36e67bfdf65cedbb39ad291800a273508fa034cc737e01779e384aa2
Opcode Fuzzy Hash: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction Fuzzy Hash: 9A21C1325443556BF321EB60CC84FAFB39CFB84291F15891DFB9093144EB25E90987A6

Function 10003480 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 52librarywindowCOMMON

Download Yara Rule

APIs

#540.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034A9
#2915.MFC42(00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034C4
GetWindowsDirectoryA.KERNEL32(00000000,00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034CA
#5572.MFC42(000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034D6
#941.MFC42(\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034E4
LoadLibraryA.KERNEL32(?,\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034EE
LoadCursorA.USER32(00000000,0000006A), ref: 100034FD
CopyIcon.USER32(00000000), ref: 10003508
FreeLibrary.KERNEL32(00000000,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003512
#800.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003524

Strings

\winhlp32.exe, xrefs: 100034DB

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad$#2915#540#5572#800#941CopyCursorDirectoryFreeIconWindows
String ID: \winhlp32.exe
API String ID: 1176994157-695620452
Opcode ID: 7e9fda12273395a7804d75835f72b035391ce626c8fc8121164debbe80477b9d
Instruction ID: e496be142816392f4a802cf4bfc056d9d89f17a7e690c9ce2094f43ff9286023
Opcode Fuzzy Hash: 7e9fda12273395a7804d75835f72b035391ce626c8fc8121164debbe80477b9d
Instruction Fuzzy Hash: 8011A0B5104A12ABE305DF24CC45B9BB7E8FF457A1F108A1CF562932E4DF349648CA56

Function 10001330 Relevance: 16.6, APIs: 11, Instructions: 62COMMON

Download Yara Rule

APIs

#2302.MFC42(?,00000001,?), ref: 1000133F
#2302.MFC42(?,00000C81,?,?,00000001,?), ref: 10001351
#2302.MFC42(?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001363
#2302.MFC42(?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001375
#2302.MFC42(?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001387
#2302.MFC42(?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?), ref: 10001399
#2302.MFC42(?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?), ref: 100013AB
#2302.MFC42(?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?), ref: 100013BD
#2302.MFC42(?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?), ref: 100013CF
#2302.MFC42(?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?), ref: 100013E1
#2302.MFC42(?,00000BC0,?,?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?), ref: 100013F3

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #2302
String ID:
API String ID: 735948377-0
Opcode ID: 06b9eaba6d6f438498a407750c39f16a4acf5c7335e1966ab29edf0a08e8166e
Instruction ID: a7bc58141b3d57b7a2f9e387017e1c6d9f08b27cbc72826201795aafa6989a29
Opcode Fuzzy Hash: 06b9eaba6d6f438498a407750c39f16a4acf5c7335e1966ab29edf0a08e8166e
Instruction Fuzzy Hash: 521170B6140B407BF611DE20DC82FFBB36CEB85B8AF45441CBA8515086DFD47E059625

Function 10002440 Relevance: 13.6, APIs: 9, Instructions: 140windowCOMMON

Download Yara Rule

APIs

#2860.MFC42(?,?), ref: 10002453
SendMessageA.USER32(?,00000172,00000000,?), ref: 10002481
GetClientRect.USER32(?,?), ref: 10002499
GetClientRect.USER32(?,?), ref: 100024A4
GetWindowRect.USER32(?,?), ref: 100024AF
SetRect.USER32(00000000,00000000,00000000,00000000,00000000), ref: 100024C2
#6605.MFC42(?,?), ref: 1000252E
OffsetRect.USER32(?,?,?), ref: 10002581
#4299.MFC42(?,?,?,?,00000001), ref: 100025A3

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#2860#4299#6605MessageOffsetSendWindow
String ID:
API String ID: 1591621576-0
Opcode ID: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction ID: cea368ed319ff426ac7cae26e22c5591117dddf13591c75ce779038945222747
Opcode Fuzzy Hash: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction Fuzzy Hash: 71411A713047019FD708CF39CD95A6BB7EAFBC8680F198A2CB585C3259DA70F9058A55

Function 10002FD0 Relevance: 12.1, APIs: 8, Instructions: 60windowtimeCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 10002FD6
ScreenToClient.USER32(?,?), ref: 10002FF6
GetClientRect.USER32(?,?), ref: 10003005
PtInRect.USER32(?,?,?), ref: 1000301A
KillTimer.USER32(?,?), ref: 10003032
SendMessageA.USER32(?,00000030,?,00000001), ref: 10003051
InvalidateRect.USER32(?,?,00000001), ref: 1000306D
#2379.MFC42 ref: 10003075

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$ClientMessage$#2379InvalidateKillScreenSendTimer
String ID:
API String ID: 173336095-0
Opcode ID: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction ID: 76f8f83f127ebf74195a72dad42daeb95907ffedfed5679e39fce6817e511657
Opcode Fuzzy Hash: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction Fuzzy Hash: CB1103B4504711AFE314DF64CC98E6BB7E9FB88B81F04890DF98683254EB75E904CB91

Function 10002150 Relevance: 10.5, APIs: 7, Instructions: 41COMMON

Download Yara Rule

APIs

#795.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000217E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000218E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000219E
#2414.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021B7
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021CA
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021D7
#641.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021E6

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#2414#641#795
String ID:
API String ID: 1303925036-0
Opcode ID: 1af360fa2387a946782225b64d52381ae9c0b8d3ee2f052c1cd965634cd9a604
Instruction ID: f5c4544bc7a3faee989b476a257d09b4c225558fe38a2fb961692ad6650ff4c0
Opcode Fuzzy Hash: 1af360fa2387a946782225b64d52381ae9c0b8d3ee2f052c1cd965634cd9a604
Instruction Fuzzy Hash: 411130B5004B818EE315DF28C84174AFBE4FFA5790F55091DE4A643796CFB8614DCBA2

Function 10002070 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

#324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#324
String ID:
API String ID: 2217935779-0
Opcode ID: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction ID: 0e0f615a265ac9c9a9ef4592cef02d40833f3a3893898f0605a6b53120fdffae
Opcode Fuzzy Hash: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction Fuzzy Hash: 82114CB5104B818BE311CF148C8075AFBE5FB99781F510C1DE19647796DBB8A548CB92

Function 10002C30 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

#2414.MFC42 ref: 10002C64
#809.MFC42 ref: 10002C71
#2414.MFC42 ref: 10002C8A
#2414.MFC42 ref: 10002CA8
#800.MFC42 ref: 10002CBB
#795.MFC42 ref: 10002CCA

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #2414$#795#800#809
String ID:
API String ID: 1676757150-0
Opcode ID: 832c35599148cc5a7891caefc9e57a776fa086fa987590c43ef23dc25c5fdb16
Instruction ID: 61f50b5283f78187b9943e8254bafee2355d34d6e190acac775872f165fc4980
Opcode Fuzzy Hash: 832c35599148cc5a7891caefc9e57a776fa086fa987590c43ef23dc25c5fdb16
Instruction Fuzzy Hash: BF115EB51047C28FE700CF19C80070AFBE5EF95791F954A1DE0A153385CBB8A50ACF62

Function 10002A00 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 10002A06
GetClientRect.USER32(?,?), ref: 10002A30
GetWindowRect.USER32(?,?), ref: 10002A42
#4299.MFC42(?,?,?,?,00000001), ref: 10002A85
#4299.MFC42(?,?,?,?,00000001,?,?,?,?,00000001), ref: 10002AB3

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #4299Rect$#2379ClientWindow
String ID:
API String ID: 2463140695-0
Opcode ID: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction ID: 7fd873ad5859924dc3e9645bdb9b098ce72c68c189247eaef3a9cf332acd70ce
Opcode Fuzzy Hash: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction Fuzzy Hash: 9F212F75304705AFD708DE78CD94E6BB7EAFBC8244F058A2DB84583249DA70F909C6A2

Function 100049BA Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 100049E8
_initterm.MSVCRT ref: 10004A13
free.MSVCRT ref: 10004A50

Strings

kGu0EAu, xrefs: 100049D0

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID: kGu0EAu
API String ID: 1678931842-451212217
Opcode ID: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction ID: 6e6ce05fc65f6857befb30b960dddb25c0f056c42b7287eed7d5b62f4f9fe03b
Opcode Fuzzy Hash: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction Fuzzy Hash: 3D113CB27462229FF714DF68DD84B5637E5FB493D1B22402DE801C716CEB719A00CB59

Function 10002B50 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

#567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
#540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
#556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
#2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #2614#540#556#567
String ID:
API String ID: 4066608244-0
Opcode ID: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction ID: 5380fbfe1f13ce258253e983e879f2a7423347c2a2865734c5e17ac8d5c15826
Opcode Fuzzy Hash: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction Fuzzy Hash: 97112BB0500B91CFE320CF1AC844356FBE5FB45754F900E2EE19687B95DBB9A444CB91

Function 100030F0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

#858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
IsWindow.USER32(?), ref: 10003129
#6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
#800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #6358#800#858Window
String ID:
API String ID: 1255164923-0
Opcode ID: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction ID: a14bf695a60021346b265786ca639e55b1935be1e887f5c80a4f76400b1b17f4
Opcode Fuzzy Hash: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction Fuzzy Hash: 0E01A272104A519BD311CF14C841B9B73E8FB49BA0F008A1DF16683584DB74A808CB62

Function 10003540 Relevance: 6.0, APIs: 4, Instructions: 35registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
RegQueryValueA.ADVAPI32 ref: 1000357E
lstrcpyA.KERNEL32(?,00000000), ref: 10003591
RegCloseKey.ADVAPI32(?), ref: 1000359C

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValuelstrcpy
String ID:
API String ID: 534897748-0
Opcode ID: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction ID: 31d2930b61c82b42a2fde46d1cefe9ce52522f5b9b535180cdc1a6a6f7b1b038
Opcode Fuzzy Hash: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction Fuzzy Hash: F3F04F75144312BFE320CB10CC89FABBBA9EBC8790F10C90CF98982254D670D844CBA2

Function 10002F70 Relevance: 6.0, APIs: 4, Instructions: 35windowtimeCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 10002F9C
InvalidateRect.USER32(?,00000000,00000001), ref: 10002FAA
SetTimer.USER32(?,?,00000064,00000000), ref: 10002FBF
#2379.MFC42 ref: 10002FC7

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #2379InvalidateMessageRectSendTimer
String ID:
API String ID: 920896690-0
Opcode ID: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction ID: 2dcf2f78edcbb6a6aeec61f8ec110639963feb333860edce5202acada731f870
Opcode Fuzzy Hash: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction Fuzzy Hash: CBF0E775210711ABE730CB65CC85F56B3E9BB4C790F114A19F686D76C4D6B1F9408B50

Function 1000431C Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

#1567.MFC42 ref: 10004320
#800.MFC42 ref: 10004335
#800.MFC42 ref: 10004341
#800.MFC42 ref: 10004350

Memory Dump Source

Source File: 00000004.00000002.1582487067.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.1582454062.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582505935.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582527796.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.1582547650.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#1567
String ID:
API String ID: 3194870385-0
Opcode ID: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction ID: e8ea892de69bcb9610e0c8c3a5f6cf03a5fb7e67a11db6fafae1abe6c09cea7f
Opcode Fuzzy Hash: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction Fuzzy Hash: 14F08C79C05288DADB04CF98D1417EDFB70FB61310F1081AEC85123282CB762A0AC761

Analysis Process: rundll32.exePID: 2160, Parent PID: 7120COMMON

Execution Graph

Execution Coverage:	20%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.1%
Total number of Nodes:	374
Total number of Limit Nodes:	11

Executed Functions

Function 10001830 Relevance: 66.6, APIs: 22, Strings: 16, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
#860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
#941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
#941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
#941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
#941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
#941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
#941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
#941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
#941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
#2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
#860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
#939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
#941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
#941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
#941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
#941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
#941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
#941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
#941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
#941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
#800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

Strings

This computer program is protected by, xrefs: 10001925
Fax: +1 661-716-5101, xrefs: 100018A2
permissible under the law., xrefs: 1000196D
Bakersfield, CA 93309 USA., xrefs: 1000187E
copyright law and international treaties., xrefs: 10001931
5201 Truxtun Avenue, 3rd Floor, xrefs: 10001872
Unauthorized reproduction or distribution, xrefs: 1000193D
e-mail: prosoft@prosoft-technology.com , xrefs: 100018C6
2004-2009, xrefs: 1000184A
Phone: +1 661-716-5100, xrefs: 10001896
result in severe civil and criminal penalties,, xrefs: 10001955
ProSoft Technology, Inc., xrefs: 1000185E
and will be prosecuted to the maximum extent, xrefs: 10001961
ProSoft Technology Inc. , xrefs: 10001919
of this program, or any portion of it, may, xrefs: 10001949
Web: www.prosoft-technology.com , xrefs: 100018BA

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#860$#2818#537#800#939
String ID: This computer program is protected by$ 5201 Truxtun Avenue, 3rd Floor$ Bakersfield, CA 93309 USA.$ Fax: +1 661-716-5101$ Phone: +1 661-716-5100$ ProSoft Technology Inc. $ ProSoft Technology, Inc.$ Unauthorized reproduction or distribution$ Web: www.prosoft-technology.com $ and will be prosecuted to the maximum extent$ copyright law and international treaties.$ e-mail: prosoft@prosoft-technology.com $ of this program, or any portion of it, may$ permissible under the law.$ result in severe civil and criminal penalties,$2004-2009
API String ID: 560914698-2702941522
Opcode ID: 3e8686c33e3dff9c0c9880628ee8c3a3c2ef0ead8f0d71cde7fdfe506ad94cfd
Instruction ID: 91c8ed7013d054164af58b362b1f26a6fbb61d5f425d44fa41214922a166be22
Opcode Fuzzy Hash: 3e8686c33e3dff9c0c9880628ee8c3a3c2ef0ead8f0d71cde7fdfe506ad94cfd
Instruction Fuzzy Hash: 473161B4340D9067F909E7188C26AFD6355EF919D2F43451CB3A16728FCF246B1A838E

Function 10001420 Relevance: 89.6, APIs: 47, Strings: 4, Instructions: 301
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4710.MFC42 ref: 1000143D
#540.MFC42 ref: 10001446

Part of subcall function 10001830: #537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
Part of subcall function 10001830: #860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
Part of subcall function 10001830: #941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
Part of subcall function 10001830: #941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
Part of subcall function 10001830: #941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
Part of subcall function 10001830: #941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
Part of subcall function 10001830: #941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
Part of subcall function 10001830: #941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
Part of subcall function 10001830: #941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
Part of subcall function 10001830: #941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
Part of subcall function 10001830: #2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
Part of subcall function 10001830: #860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
Part of subcall function 10001830: #939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
Part of subcall function 10001830: #941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
Part of subcall function 10001830: #941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
Part of subcall function 10001830: #941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
Part of subcall function 10001830: #941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
Part of subcall function 10001830: #941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
Part of subcall function 10001830: #941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
Part of subcall function 10001830: #941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
Part of subcall function 10001830: #941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
Part of subcall function 10001830: #800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

SendMessageA.USER32(?,00000031,00000000,00000000), ref: 1000146D
#2860.MFC42(00000000), ref: 10001470
GetObjectA.GDI32(?,0000003C,?), ref: 10001480
MulDiv.KERNEL32(?,00000003,00000002), ref: 1000148F
CreateFontIndirectA.GDI32(?), ref: 100014A4
#1641.MFC42(00000000), ref: 100014AD
SendMessageA.USER32(?,00000030,?,00000001), ref: 100014C5
GetWindowRect.USER32(?,?), ref: 100014D6
GetWindowRect.USER32(?,?), ref: 100014E4
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000150B
#2818.MFC42(?,About %s,?,6D34A098,00000000,00000000,?,?,00000006), ref: 10001534
#6199.MFC42(?), ref: 10001543
#2818.MFC42(?,10008058,?,?), ref: 10001567
#2818.MFC42(?,10008058,?,?), ref: 1000158E
#6199.MFC42(?,?), ref: 100015A3
#6199.MFC42(?,?,?), ref: 100015B5
#860.MFC42(10008798,?,?,?), ref: 100015C3
#2818.MFC42(10008798,10008058,?,10008798,?,?,?), ref: 100015E0
#6199.MFC42(?,10008798,?,?,?), ref: 100015F3
#860.MFC42(10008798,?,10008798,?,?,?), ref: 10001601
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,?,?), ref: 1000161E
#941.MFC42( ** BETA ** ,10008798,?,10008798,?,?,?), ref: 10001639
#6199.MFC42(?,10008798,?,10008798,?,?,?), ref: 10001649
SendMessageA.USER32(?,00000170,?,00000000), ref: 1000166A
#860.MFC42(10008798,?,10008798,?,10008798,?,?,?), ref: 10001675
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,?,?), ref: 10001692
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016A5
#860.MFC42(10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016B3
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016D0
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016E3
#860.MFC42(PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016F1
GetModuleHandleA.KERNEL32(?,PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016FB
#2919.MFC42(00000100,00000000), ref: 1000170B
_GetAppVersion@8.PSABOUT(00000000,00000100,00000000), ref: 10001711
#926.MFC42(?,ProSoft About Version : ,?,00000000), ref: 10001729
#858.MFC42 ref: 1000173B
#800.MFC42 ref: 10001749
#6199.MFC42(?), ref: 10001759
#860.MFC42(10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001775
#2818.MFC42(?,10008058,00000000,10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001798
#6199.MFC42(?), ref: 100017AD
#2818.MFC42(?,10008058,?,?), ref: 100017C6
#535.MFC42(?,?,?), ref: 100017D9

Part of subcall function 100030F0: #858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
Part of subcall function 100030F0: IsWindow.USER32(?), ref: 10003129
Part of subcall function 100030F0: #6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
Part of subcall function 100030F0: #800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

#800.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000180E

Strings

ProSoft About Version : , xrefs: 10001723
** BETA ** , xrefs: 10001630
About %s, xrefs: 1000152E
PSAbout.dll, xrefs: 100016E8

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#2818$#6199$#860$#800$MessageSendWindow$#858Rect$#1641#2860#2919#4710#535#537#540#6197#6358#926#939CreateFontHandleIndirectModuleObjectVersion@8
String ID: ** BETA ** $About %s$PSAbout.dll$ProSoft About Version :
API String ID: 3958394562-2501452965
Opcode ID: 93a61c409d91f74adb62bd33cdf8a781a3db4ebdfbefdad8c7220e47ed2a5d1a
Instruction ID: f28686d8da41217129008f13a01225032e64cb8ff28e48d6fc26cba87298445a
Opcode Fuzzy Hash: 93a61c409d91f74adb62bd33cdf8a781a3db4ebdfbefdad8c7220e47ed2a5d1a
Instruction Fuzzy Hash: EFB170B4204B41ABE715CB20CC91FAB73E9FB94684F05891CF5969728ADF31FA08CB55

Function 10003970 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6467.MFC42(00000000), ref: 1000399D
#268.MFC42(00000000), ref: 100039AC

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 100039D3
#800.MFC42(00000000,00000000), ref: 10003A07
#795.MFC42(00000000,00000000), ref: 10003A31
#795.MFC42(00000000,00000000), ref: 10003A40
#795.MFC42(00000000,00000000), ref: 10003A4F
#795.MFC42(00000000,00000000), ref: 10003A5E
#795.MFC42(00000000,00000000), ref: 10003A6D
#795.MFC42(00000000,00000000), ref: 10003A7C
#795.MFC42(00000000,00000000), ref: 10003A8B
#795.MFC42(00000000,00000000), ref: 10003A9A
#795.MFC42(00000000,00000000), ref: 10003AA9
#609.MFC42(00000000,00000000), ref: 10003AB8
#641.MFC42(00000000,00000000), ref: 10003AC6
#1567.MFC42(00000000,00000000), ref: 10003ACF
#800.MFC42(00000000,00000000), ref: 10003A13

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003B08
#800.MFC42(00000000,00000000), ref: 10003B14
#795.MFC42(00000000,00000000), ref: 10003B32
#795.MFC42(00000000,00000000), ref: 10003B41
#795.MFC42(00000000,00000000), ref: 10003B50
#795.MFC42(00000000,00000000), ref: 10003B5F
#795.MFC42(00000000,00000000), ref: 10003B6E
#795.MFC42(00000000,00000000), ref: 10003B7D
#795.MFC42(00000000,00000000), ref: 10003B8C
#795.MFC42(00000000,00000000), ref: 10003B9B
#795.MFC42(00000000,00000000), ref: 10003BAA
#609.MFC42(00000000,00000000), ref: 10003BB9
#641.MFC42(00000000,00000000), ref: 10003BC7
#1567.MFC42(00000000,00000000), ref: 10003BD0

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

, xrefs: 10003AF8
d, xrefs: 10003AE9

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: f96246d92a9d399ea99a5f6e59495f02cc615287c8b5f0f27101b9d0d2c91858
Instruction ID: ba9fdb3c8c69b1efcd9dc3c0e08e9eba6e85a8a60e063a58fc3de4da0faa40ac
Opcode Fuzzy Hash: f96246d92a9d399ea99a5f6e59495f02cc615287c8b5f0f27101b9d0d2c91858
Instruction Fuzzy Hash: 7871377880618CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA36

Function 10002D40 Relevance: 31.6, APIs: 21, Instructions: 126
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3797.MFC42 ref: 10002D5E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 10002D75
#3874.MFC42(?), ref: 10002D8B
#540.MFC42(?), ref: 10002D94
#3874.MFC42(?), ref: 10002DA8
#6199.MFC42(?,?), ref: 10002DBD
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 10002DCC
#2860.MFC42(00000000), ref: 10002DD3
GetStockObject.GDI32(00000011), ref: 10002DE6
GetStockObject.GDI32(0000000C), ref: 10002DEE
#2860.MFC42(00000000), ref: 10002DF5
GetObjectA.GDI32(?,0000003C,?), ref: 10002E07
CreateFontIndirectA.GDI32(?), ref: 10002E18
#1641.MFC42(00000000), ref: 10002E1E
CreateFontIndirectA.GDI32(?), ref: 10002E2D
#1641.MFC42(00000000), ref: 10002E33
GetClientRect.USER32(?,?), ref: 10002E58
#2122.MFC42(?,00000000), ref: 10002E66
#1088.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E78
#5277.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E7F
#800.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E90

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Object$#1641#2860#3874CreateFontIndirectStock$#1088#2122#3797#5277#540#6199#800ClientLongMessageRectSendWindow
String ID:
API String ID: 2029918275-0
Opcode ID: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction ID: c9a03a5f96910dafa03aba3819474b77990a7e9c8b104b6fd7e7a11093b1c142
Opcode Fuzzy Hash: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction Fuzzy Hash: D141CFB4204B42ABE624DB24CC85F6FB3A9EF88B90F010A0CF142972C9DF64F905C765

Function 100047D9 Relevance: 31.6, APIs: 21, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1116.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F0
#1176.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F5
#1575.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004809
#1168.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004812
#1577.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004830
#1182.MFC42(100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?), ref: 10004843
#823.MFC42(00000040,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?), ref: 1000484A
#342.MFC42(100098F8,00000000,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?), ref: 10004859
#1176.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004868
#1243.MFC42(?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?), ref: 10004870
#1243.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004887
#1176.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 1000488E
#1168.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004896
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048A9
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B0
#1577.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B5
#1253.MFC42(100098F8,00000001,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048C1
#6467.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048D6
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048DB
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048E2
#1255.MFC42(?,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048EA

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #1176$#1168#1197#1243#1570#1577$#1116#1182#1253#1255#1575#342#6467#823
String ID:
API String ID: 2007088025-0
Opcode ID: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction ID: edb89b75dec8b2219673670b66b7d6a2bc8d39bc8546632be8b72beb1c9dc777
Opcode Fuzzy Hash: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction Fuzzy Hash: 4C318FB8600244ABFB10EF61C845F5D77A4EF806E0F13C529F9255B2AADF34E941CB19

Function 10003260 Relevance: 28.7, APIs: 19, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindow.USER32(?), ref: 10003287
GetWindowRect.USER32(?,?), ref: 100032AC
GetClientRect.USER32(?,?), ref: 100032BB
#6605.MFC42(?), ref: 100032C8
GetParent.USER32(?), ref: 100032D1
#2864.MFC42(00000000), ref: 100032D8
#6880.MFC42(?,00000000), ref: 100032EA
#6880.MFC42(?,?,00000000), ref: 100032F6
#540.MFC42(00000000), ref: 100032FF
#3874.MFC42 ref: 10003313
GetDC.USER32(?), ref: 1000331C
#2859.MFC42(00000000), ref: 10003323
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 1000334B
ReleaseDC.USER32(?,?), ref: 10003371
#3797.MFC42 ref: 100033A9
InflateRect.USER32(?,00000000,?), ref: 100033D8
InflateRect.USER32(?,?,00000000), ref: 1000340D
#6197.MFC42(00000000,?,?,?,?,00000004), ref: 1000344C
#800.MFC42(00000000,?,?,?,?,00000004), ref: 1000345D

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$#6880InflateWindow$#2859#2864#3797#3874#540#6197#6605#800ClientExtentParentPoint32ReleaseText
String ID:
API String ID: 1555407671-0
Opcode ID: d2e59de0ad313e814094079131a3e4435a3ca1c7cc293d6768b7e4fa58d8ab18
Instruction ID: fad4f85ae7451d699b48dc3c23a1c9188842fcfe73b98fa0dc477d473762e04e
Opcode Fuzzy Hash: d2e59de0ad313e814094079131a3e4435a3ca1c7cc293d6768b7e4fa58d8ab18
Instruction Fuzzy Hash: 2A6129B5204341AFD744CF68CD84A6FB7E9FBC8680F454A1CF98593298DB34E9058BA2

Function 100011D0 Relevance: 22.6, APIs: 15, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 1000120F
#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001231
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001247
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001257

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001277
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001287
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001297
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012A7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012B7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012C7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012D7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012E7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012F7
#609.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001304
#641.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001313

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#2414$#800$#609#641#809
String ID:
API String ID: 2601255804-0
Opcode ID: dad1e5acd96207fcb516968db52c721e2fe89a94faa14b1906d0b7f2ef00c40b
Instruction ID: c87b3d48cd3f525f1380d43a1c8d41ca1566e881e5744a2b82a627dc5851ada9
Opcode Fuzzy Hash: dad1e5acd96207fcb516968db52c721e2fe89a94faa14b1906d0b7f2ef00c40b
Instruction Fuzzy Hash: 6C311B78108B818AE315DF64C48579ABFD4AFA5380F550C5DE4E603297CBB8624DCBA3

Function 10003480 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034A9
#2915.MFC42(00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034C4
GetWindowsDirectoryA.KERNEL32(00000000,00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034CA
#5572.MFC42(000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034D6
#941.MFC42(\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034E4
LoadLibraryA.KERNELBASE(?,\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034EE
LoadCursorA.USER32(00000000,0000006A), ref: 100034FD
CopyIcon.USER32(00000000), ref: 10003508
FreeLibrary.KERNELBASE(00000000,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003512
#800.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003524

Strings

\winhlp32.exe, xrefs: 100034DB

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad$#2915#540#5572#800#941CopyCursorDirectoryFreeIconWindows
String ID: \winhlp32.exe
API String ID: 1176994157-695620452
Opcode ID: 9bc18a9dcaf9d496de05e81099aa452c11a15a7f8f37902f5a36aa6263560667
Instruction ID: e496be142816392f4a802cf4bfc056d9d89f17a7e690c9ce2094f43ff9286023
Opcode Fuzzy Hash: 9bc18a9dcaf9d496de05e81099aa452c11a15a7f8f37902f5a36aa6263560667
Instruction Fuzzy Hash: 8011A0B5104A12ABE305DF24CC45B9BB7E8FF457A1F108A1CF562932E4DF349648CA56

Function 10001330 Relevance: 16.6, APIs: 11, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2302.MFC42(?,00000001,?), ref: 1000133F
#2302.MFC42(?,00000C81,?,?,00000001,?), ref: 10001351
#2302.MFC42(?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001363
#2302.MFC42(?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001375
#2302.MFC42(?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001387
#2302.MFC42(?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?), ref: 10001399
#2302.MFC42(?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?), ref: 100013AB
#2302.MFC42(?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?), ref: 100013BD
#2302.MFC42(?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?), ref: 100013CF
#2302.MFC42(?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?), ref: 100013E1
#2302.MFC42(?,00000BC0,?,?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?), ref: 100013F3

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #2302
String ID:
API String ID: 735948377-0
Opcode ID: 7164a37812371677f22d9e14ba1a6941cd8c28cbc93c80df03fbb858e5833c04
Instruction ID: a7bc58141b3d57b7a2f9e387017e1c6d9f08b27cbc72826201795aafa6989a29
Opcode Fuzzy Hash: 7164a37812371677f22d9e14ba1a6941cd8c28cbc93c80df03fbb858e5833c04
Instruction Fuzzy Hash: 521170B6140B407BF611DE20DC82FFBB36CEB85B8AF45441CBA8515086DFD47E059625

Function 10002C30 Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2414.MFC42 ref: 10002C64
#809.MFC42 ref: 10002C71
#2414.MFC42 ref: 10002C8A
#2414.MFC42 ref: 10002CA8
#800.MFC42 ref: 10002CBB
#795.MFC42 ref: 10002CCA

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #2414$#795#800#809
String ID:
API String ID: 1676757150-0
Opcode ID: cc5e3a9273f2020014c9eae9fbf216b3f049fc57e9afae3d7d4acf3af9f9cb91
Instruction ID: 61f50b5283f78187b9943e8254bafee2355d34d6e190acac775872f165fc4980
Opcode Fuzzy Hash: cc5e3a9273f2020014c9eae9fbf216b3f049fc57e9afae3d7d4acf3af9f9cb91
Instruction Fuzzy Hash: BF115EB51047C28FE700CF19C80070AFBE5EF95791F954A1DE0A153385CBB8A50ACF62

Function 10004900 Relevance: 9.0, APIs: 6, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,00002000), ref: 1000490E
LocalFree.KERNEL32(00000000), ref: 1000491A
#1176.MFC42 ref: 10004920
#1243.MFC42(10008868), ref: 1000492C
#1176.MFC42 ref: 1000493E
#1243.MFC42(?), ref: 10004946

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #1176#1243Local$AllocFree
String ID:
API String ID: 2308495640-0
Opcode ID: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction ID: 5589185b89f99a7ae39e63059246849f8e8e202c6ff74abfd7579a51ee7ecbbf
Opcode Fuzzy Hash: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction Fuzzy Hash: 86E092B0944311AAF620DB61CC4AF0B7AD9EF407E2F138439F104960A9CF70E440C618

Function 1000478E Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 10004793
#6467.MFC42(10008868), ref: 100047A2
#1578.MFC42(?,?,?,?,10008868), ref: 100047B7

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #1578#6467H_prolog
String ID:
API String ID: 3701988776-0
Opcode ID: 225be51d1682979de9a5a8f11b93485f42be95f4e01545b56e450a7edae2f307
Instruction ID: 8d8a2343cbf58df175da5ae398bcc65f357205776284d92b25b36d497a5dc97f
Opcode Fuzzy Hash: 225be51d1682979de9a5a8f11b93485f42be95f4e01545b56e450a7edae2f307
Instruction Fuzzy Hash: 08E0E5B9900149AFEF06DF80C942BAEBB71FF44345F108418B85526255DB76AA21DB25

Non-executed Functions

Function 100019F0 Relevance: 84.4, APIs: 47, Strings: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2379.MFC42 ref: 100019F6
GetWindowRect.USER32(?,?), ref: 10001A26
GetWindowRect.USER32(?,?), ref: 10001A34
#6880.MFC42(?), ref: 10001A3D
#6880.MFC42(?,?), ref: 10001A49
GetWindowRect.USER32(?,?), ref: 10001A92
#6880.MFC42(?), ref: 10001A9B
GetWindowRect.USER32(?,?), ref: 10001AB3
#6880.MFC42(?), ref: 10001ABC
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?), ref: 10001AD9
GetWindowRect.USER32(?,?), ref: 10001AF6
#6880.MFC42(?,?,00000000,00000000,00000005,?), ref: 10001AFF
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B1C
GetWindowRect.USER32(?,?), ref: 10001B33
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B3C
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001B5A
GetWindowRect.USER32(?,?), ref: 10001B7D
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B86
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BA4
GetWindowRect.USER32(?,?), ref: 10001BB5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BBE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BE3
GetWindowRect.USER32(?,?), ref: 10001BF4
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BFD
GetWindowRect.USER32(?,?), ref: 10001C20
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C29
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001C47
GetWindowRect.USER32(?,?), ref: 10001C7A
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C83
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001CA8
GetWindowRect.USER32(?,?), ref: 10001CB9
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CC2
GetWindowRect.USER32(?,?), ref: 10001CE5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CEE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D0C
#6215.MFC42(00000000,6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000), ref: 10001D1B
GetWindowRect.USER32(?,?), ref: 10001D3E
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D47
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D75
GetWindowRect.USER32(?,?), ref: 10001D92
#6880.MFC42(?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D9B
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005), ref: 10001DC5
GetWindowRect.USER32(?,?), ref: 10001DE8
#6880.MFC42(?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?), ref: 10001DF1
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,?,?,00000004,?,?,?,?,00000004), ref: 10001E17
GetWindowRect.USER32(?,?), ref: 10001E37
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006,?,00000000,00000000,00000005,?,?,?,?,00000004,?), ref: 10001E5C

Strings

VUUU, xrefs: 10001A58

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: RectWindow$#6880$#6197$#2379#6215
String ID: VUUU
API String ID: 1101919440-2040033107
Opcode ID: 13b8e8da2f769331353385238693a4145235e3055610f624813af9cb8230173c
Instruction ID: 5a31ff0520036d38cb31330b8b9511fc0d41158ddc336ad14b2b1ef2a9cc197e
Opcode Fuzzy Hash: 13b8e8da2f769331353385238693a4145235e3055610f624813af9cb8230173c
Instruction Fuzzy Hash: D9D120B52147019FE314CF24CC95FABB7E9EBD8B84F104A1CB58687296EA30F905CB95

Function 10004090 Relevance: 66.7, APIs: 35, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42 ref: 100040B4
#537.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040C9
#540.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040D5
#6467.MFC42(00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040E7
#860.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040F8
#268.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004100
#2915.MFC42(00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004111
GetModuleFileNameA.KERNEL32(?,00000000,00000100,00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004120
#2915.MFC42(00000000), ref: 1000412A
GetFileVersionInfoSizeA.VERSION(00000000,?,00000000), ref: 10004134
#823.MFC42(00000000,00000000,?,00000000), ref: 10004144
#2915.MFC42(00000000), ref: 10004152
GetFileVersionInfoA.VERSION(00000000,?,00000000,00000000,00000000), ref: 1000415E
GetLastError.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 10004169
#2915.MFC42(00000000,00000000,?,00000000,00000000,00000000), ref: 10004180
VerQueryValueA.VERSION(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000418F
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000419A
#2818.MFC42(?,10008058,?,00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 100041B9
#825.MFC42(00000000,00000000,00000000,00000000), ref: 100041C6
#6877.MFC42(100086C4,100086C8,00000000,?,00000000), ref: 100041E0
#5683.MFC42(0000002E,100086C4,100086C8,00000000,?,00000000), ref: 100041F3
#5710.MFC42(?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004213
#4129.MFC42(?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004226
#924.MFC42(?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004239
#922.MFC42(?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004248
#858.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004255
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004261
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 1000426D
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004279
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004285
#2915.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 1000428F
#1567.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042BB
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042D5
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042E1
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042F0

Strings

\StringFileInfo\040904B0\ProductVersion, xrefs: 100040BB
Build , xrefs: 1000422B
GetFileVersionInfo Error is %d, xrefs: 10004173, 100041A4

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#2915$File$#540ErrorInfoLastVersion$#1567#268#2818#4129#537#5683#5710#6467#6877#823#825#858#860#922#924ModuleNameQuerySizeValue
String ID: Build $GetFileVersionInfo Error is %d$\StringFileInfo\040904B0\ProductVersion
API String ID: 2403904333-2205515449
Opcode ID: 32ee173fd4bfab7e9fd2f4364ef36033f116338a373bc0aea6c9cddcc8ed7950
Instruction ID: fe3a53cdd048ef3aad4013630a4a48c8c662586e619284a4b3165d18e955ce92
Opcode Fuzzy Hash: 32ee173fd4bfab7e9fd2f4364ef36033f116338a373bc0aea6c9cddcc8ed7950
Instruction Fuzzy Hash: AD71A3B5801149AAEB04DBE4CD81EEFBB78EF15280F114158F90673286DF746B09C776

Function 10002620 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 313windowCOMMON

Download Yara Rule

APIs

#470.MFC42 ref: 10002646
#323.MFC42 ref: 10002673
GetClientRect.USER32(?,?), ref: 1000268F
#5788.MFC42(?), ref: 10002699
#5794.MFC42(00000007,?), ref: 100026A6
Rectangle.GDI32(?,?,?,?,?), ref: 100026C9
#5788.MFC42(00000000), ref: 100026D4
#5788.MFC42(00000000,00000000), ref: 100026DE
CreateCompatibleDC.GDI32(?), ref: 100026FD
#1640.MFC42(00000000), ref: 10002708
SendMessageA.USER32(?,00000172,00000000,?), ref: 1000272E
GetClientRect.USER32(?,?), ref: 10002740
#5785.MFC42(?,?), ref: 10002752
MulDiv.KERNEL32(?,?,?), ref: 1000279E
MulDiv.KERNEL32(?,?,?), ref: 100027CB
StretchBlt.GDI32(?,?,00000000,00000000,?,?,100064FC,100064FC,?,?,00CC0020), ref: 10002831
#5785.MFC42(?,?), ref: 10002848
#2405.MFC42(?,?), ref: 10002851
GetClientRect.USER32(?,?), ref: 10002865
GetClientRect.USER32(?,?), ref: 10002870
MulDiv.KERNEL32(?,?,00000064), ref: 1000288C
MulDiv.KERNEL32(?,?,00000064), ref: 100028A6
#6172.MFC42(00FFFFFF), ref: 100028B5
#5875.MFC42(00000001,00FFFFFF), ref: 100028C0
DrawTextA.USER32(?,?,000000FF,?,00000020), ref: 100028DD
DrawTextA.USER32(?,?,000000FF,?,00000420), ref: 100028F4
GetWindowRect.USER32(?,?), ref: 10002902
#6880.MFC42(?), ref: 1000290F
#6172.MFC42(00FFFFFF,?), ref: 1000296D
#5875.MFC42(00000001,00FFFFFF,?), ref: 10002978
DrawTextA.USER32(?,?,000000FF,?,?), ref: 1000299A
#640.MFC42 ref: 100029A8
#2414.MFC42 ref: 100029C1
#755.MFC42 ref: 100029DD

Strings

gfff, xrefs: 1000291E

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#5788DrawText$#5785#5875#6172$#1640#2405#2414#323#470#5794#640#6880#755CompatibleCreateMessageRectangleSendStretchWindow
String ID: gfff
API String ID: 1747922241-1553575800
Opcode ID: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction ID: de8d7cd43940ff7d5f440d9c982899baa02ad0d10f146baf563ef8a33310dbb5
Opcode Fuzzy Hash: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction Fuzzy Hash: ADC125B52087459FE314DF69C884E6BBBE9FBC8740F114A1CF59583299DB70E809CB62

Function 100035B0 Relevance: 61.3, APIs: 20, Strings: 15, Instructions: 99COMMON

Download Yara Rule

APIs

#540.MFC42(?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035CB
#860.MFC42(The operating system is outof memory or resources.,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035FD
#860.MFC42(The specified path was not found.,The specified file was not found.), ref: 10003610
#860.MFC42(The specified file was not found.), ref: 10003623
#860.MFC42(The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003636
#860.MFC42(The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003649
#860.MFC42(The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000365C
#860.MFC42(The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000366F
#860.MFC42(The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000367F
#860.MFC42(The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000368F
#860.MFC42(The specified dynamic-link library was not found.,There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000369F
#860.MFC42(There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036AF
#860.MFC42(There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036BF
#860.MFC42(A sharing violation occurred. ,The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036CF
#2818.MFC42(?,Unknown Error (%d) occurred.,?,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100036DF
#926.MFC42(?,Unable to open hyperlink:,?), ref: 100036F6
#858.MFC42(?,?,?,?,?,?,00000005), ref: 10003705
#800.MFC42(?,?,?,?,?,?,00000005), ref: 10003713
#1200.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003721
#800.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003732

Strings

The specified path was not found., xrefs: 10003607
The operating system is outof memory or resources., xrefs: 100035F4
The DDE transaction could notbe completed because the request timed out., xrefs: 10003686
A sharing violation occurred. , xrefs: 100036C6
The .EXE file is invalid(non-Win32 .EXE or error in .EXE image)., xrefs: 1000362D
There is no application associatedwith the given filename extension., xrefs: 100036A6
The specified dynamic-link library was not found., xrefs: 10003696
The filename association isincomplete or invalid., xrefs: 10003653
The specified file was not found., xrefs: 1000361A
There was not enough memory to complete the operation., xrefs: 100036B6
Unable to open hyperlink:, xrefs: 100036F0
The DDE transaction failed., xrefs: 10003676
The operating system deniedaccess to the specified file., xrefs: 10003640
The DDE transaction could notbe completed because other DDE transactionswere being processed., xrefs: 10003666
Unknown Error (%d) occurred., xrefs: 100036D9

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #860$#800$#1200#2818#540#858#926
String ID: A sharing violation occurred. $The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).$The DDE transaction could notbe completed because other DDE transactionswere being processed.$The DDE transaction could notbe completed because the request timed out.$The DDE transaction failed.$The filename association isincomplete or invalid.$The operating system deniedaccess to the specified file.$The operating system is outof memory or resources.$The specified dynamic-link library was not found.$The specified file was not found.$The specified path was not found.$There is no application associatedwith the given filename extension.$There was not enough memory to complete the operation.$Unable to open hyperlink:$Unknown Error (%d) occurred.
API String ID: 346542042-3273680174
Opcode ID: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction ID: bf864e296dc8769b1736225a429bb83c06595c96c86935583d96534d00f8651e
Opcode Fuzzy Hash: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction Fuzzy Hash: F131A2B8018A41BBF215CB14CC62AAF7798FB902C1F01C91CB5D5521AADF33674DC79A

Function 10003C10 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

#6467.MFC42(00000000), ref: 10003C3D
#268.MFC42(00000000), ref: 10003C4C

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 10003C79
#800.MFC42(00000000,00000000), ref: 10003CAD
#795.MFC42(00000000,00000000), ref: 10003CD7
#795.MFC42(00000000,00000000), ref: 10003CE6
#795.MFC42(00000000,00000000), ref: 10003CF5
#795.MFC42(00000000,00000000), ref: 10003D04
#795.MFC42(00000000,00000000), ref: 10003D13
#795.MFC42(00000000,00000000), ref: 10003D22
#795.MFC42(00000000,00000000), ref: 10003D31
#795.MFC42(00000000,00000000), ref: 10003D40
#795.MFC42(00000000,00000000), ref: 10003D4F
#609.MFC42(00000000,00000000), ref: 10003D5E
#641.MFC42(00000000,00000000), ref: 10003D6C
#1567.MFC42(00000000,00000000), ref: 10003D75
#800.MFC42(00000000,00000000), ref: 10003CB9

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003DAE
#800.MFC42(00000000,00000000), ref: 10003DBA
#795.MFC42(00000000,00000000), ref: 10003DD8
#795.MFC42(00000000,00000000), ref: 10003DE7
#795.MFC42(00000000,00000000), ref: 10003DF6
#795.MFC42(00000000,00000000), ref: 10003E05
#795.MFC42(00000000,00000000), ref: 10003E14
#795.MFC42(00000000,00000000), ref: 10003E23
#795.MFC42(00000000,00000000), ref: 10003E32
#795.MFC42(00000000,00000000), ref: 10003E41
#795.MFC42(00000000,00000000), ref: 10003E50
#609.MFC42(00000000,00000000), ref: 10003E5F
#641.MFC42(00000000,00000000), ref: 10003E6D
#1567.MFC42(00000000,00000000), ref: 10003E76

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

d, xrefs: 10003D8F
, xrefs: 10003D9E

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: abdf16cb99a6040cd5e7d5cf6443c83e17ee6977e6b5c334444fcb95e889432d
Instruction ID: ce90d30b60a23b1df5e22dc6523357bb231baf84ee5b8182cc3d66bcb1d629aa
Opcode Fuzzy Hash: abdf16cb99a6040cd5e7d5cf6443c83e17ee6977e6b5c334444fcb95e889432d
Instruction Fuzzy Hash: C771477880628CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA32

Function 10002250 Relevance: 52.6, APIs: 25, Strings: 5, Instructions: 148windowtimeCOMMON

Download Yara Rule

APIs

#4710.MFC42(?,?,?,?,10004ED8,000000FF), ref: 1000226A
#540.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002273
#2860.MFC42(?,?,?,?,?,10004ED8,000000FF), ref: 1000228E
#823.MFC42(00000008,?,?,?,?,10004ED8,000000FF), ref: 1000229D
#1146.MFC42(00000899,00000002,00000899), ref: 100022C3
LoadBitmapA.USER32(00000000,00000899), ref: 100022C9
#1641.MFC42(00000000), ref: 100022D2
#6215.MFC42(00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022ED
#6215.MFC42(00000005,00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022FA
#6215.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002311
#6215.MFC42(00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000231E
#860.MFC42(10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002332
#860.MFC42(10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002341
#2818.MFC42(?,10008058,?,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000235B
#860.MFC42(10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000236C
#2818.MFC42(?,Version: %s,?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002386
#939.MFC42(?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002395
CreateSolidBrush.GDI32(?), ref: 100023A1
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023AB
CreateSolidBrush.GDI32(00000000), ref: 100023B4
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023BE
#860.MFC42(Error No Data,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023CA
SetTimer.USER32(?,00000001,00000BB8,00000000), ref: 100023D8
#4224.MFC42(could not Start Splash Timmer,ProSoft,00000000,?,?,?,?,10004ED8,000000FF), ref: 100023F4
#800.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002416

Strings

This is a Beta version of this program. Not for production use and without warranty., xrefs: 10002302
ProSoft, xrefs: 100023E8
Error No Data, xrefs: 100023C3
could not Start Splash Timmer, xrefs: 100023ED
Version: %s, xrefs: 10002380

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #6215#860$#1641$#2818BrushCreateSolid$#1146#2860#4224#4710#540#800#823#939BitmapLoadTimer
String ID: Error No Data$ProSoft$This is a Beta version of this program. Not for production use and without warranty.$Version: %s$could not Start Splash Timmer
API String ID: 514652099-906665912
Opcode ID: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction ID: 1913312f89696d600550852331e7f23b7439d3c132441fa52a7110e09bfaff39
Opcode Fuzzy Hash: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction Fuzzy Hash: 67519FB5200F00ABF215DB64CC51BAAB7E8FB58681F014918F6969729ADF34FA04CB95

Function 10003EB0 Relevance: 25.6, APIs: 17, Instructions: 104COMMON

Download Yara Rule

APIs

#6467.MFC42(00000000), ref: 10003EDD
#268.MFC42(00000000), ref: 10003EEA

Part of subcall function 10002070: #324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

#2514.MFC42(00000000,00000000), ref: 10003F12
#795.MFC42(00000000,00000000), ref: 10003F2D
#609.MFC42(00000000,00000000), ref: 10003F3C
#800.MFC42(00000000,00000000), ref: 10003F73
#800.MFC42(00000000,00000000), ref: 10003F82
#641.MFC42(00000000,00000000), ref: 10003F91
#1567.MFC42(00000000,00000000), ref: 10003F99
#609.MFC42(00000000,00000000), ref: 10003F4B

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

#795.MFC42(00000000,00000000), ref: 10003FC6
#609.MFC42(00000000,00000000), ref: 10003FD5
#609.MFC42(00000000,00000000), ref: 10003FE4
#800.MFC42(00000000,00000000), ref: 1000400C
#800.MFC42(00000000,00000000), ref: 1000401B
#641.MFC42(00000000,00000000), ref: 1000402A
#1567.MFC42(00000000,00000000), ref: 10004032

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#567$#1567#540#641#795$#2414#2514#268#324#6467
String ID:
API String ID: 39110236-0
Opcode ID: 9fb2ef23c2165d1a6595971bfa74651ef76342c7eaa86ae2efce9ac8e8beffec
Instruction ID: cfaefb5b01c91ea90e470d212f713a34359e3d9334dad7f1e11d803252a963b9
Opcode Fuzzy Hash: 9fb2ef23c2165d1a6595971bfa74651ef76342c7eaa86ae2efce9ac8e8beffec
Instruction Fuzzy Hash: 904181B8C05299DAEB10DBA4C9417EDFBB0EF15340F1080E9D54923786DF792B48DB66

Function 10001000 Relevance: 22.6, APIs: 15, Instructions: 97COMMON

Download Yara Rule

APIs

#324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111

Part of subcall function 10002B50: #567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
Part of subcall function 10002B50: #540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
Part of subcall function 10002B50: #556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
Part of subcall function 10002B50: #2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
CreateSolidBrush.GDI32(000000FF), ref: 1000117B
#1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#1641#2614#324#556BrushCreateSolid
String ID:
API String ID: 862247804-0
Opcode ID: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction ID: ef8ebbcba9a2f6dd6cb2c20b7593ac1494135993400dd6ceca74427708b28424
Opcode Fuzzy Hash: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction Fuzzy Hash: B74142B4104B829BE311CF24CC8076ABB96FF99381F650C1CE0951B796DBB87549CB92

Function 100037B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 87stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,?), ref: 100037D7

Part of subcall function 10003540: RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
Part of subcall function 10003540: RegQueryValueA.ADVAPI32 ref: 1000357E
Part of subcall function 10003540: lstrcpyA.KERNEL32(?,00000000), ref: 10003591
Part of subcall function 10003540: RegCloseKey.ADVAPI32(?), ref: 1000359C

lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?), ref: 10003816
_mbsstr.MSVCRT ref: 10003842
_mbsstr.MSVCRT ref: 10003857
lstrlenA.KERNEL32(?), ref: 10003867
lstrcatA.KERNEL32(00000000,1000866C), ref: 1000387C
lstrcatA.KERNEL32(00000000,?), ref: 10003887
WinExec.KERNEL32(?,?), ref: 1000388F

Strings

open, xrefs: 100037CE
"%1", xrefs: 1000383C
.htm, xrefs: 100037ED
\shell\open\command, xrefs: 10003810

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$_mbsstr$CloseExecExecuteOpenQueryShellValuelstrcpylstrlen
String ID: "%1"$.htm$\shell\open\command$open
API String ID: 729890978-1533145997
Opcode ID: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction ID: bfa4e36c36e67bfdf65cedbb39ad291800a273508fa034cc737e01779e384aa2
Opcode Fuzzy Hash: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction Fuzzy Hash: 9A21C1325443556BF321EB60CC84FAFB39CFB84291F15891DFB9093144EB25E90987A6

Function 10002440 Relevance: 13.6, APIs: 9, Instructions: 140windowCOMMON

Download Yara Rule

APIs

#2860.MFC42(?,?), ref: 10002453
SendMessageA.USER32(?,00000172,00000000,?), ref: 10002481
GetClientRect.USER32(?,?), ref: 10002499
GetClientRect.USER32(?,?), ref: 100024A4
GetWindowRect.USER32(?,?), ref: 100024AF
SetRect.USER32(00000000,00000000,00000000,00000000,00000000), ref: 100024C2
#6605.MFC42(?,?), ref: 1000252E
OffsetRect.USER32(?,?,?), ref: 10002581
#4299.MFC42(?,?,?,?,00000001), ref: 100025A3

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#2860#4299#6605MessageOffsetSendWindow
String ID:
API String ID: 1591621576-0
Opcode ID: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction ID: cea368ed319ff426ac7cae26e22c5591117dddf13591c75ce779038945222747
Opcode Fuzzy Hash: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction Fuzzy Hash: 71411A713047019FD708CF39CD95A6BB7EAFBC8680F198A2CB585C3259DA70F9058A55

Function 10002FD0 Relevance: 12.1, APIs: 8, Instructions: 60windowtimeCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 10002FD6
ScreenToClient.USER32(?,?), ref: 10002FF6
GetClientRect.USER32(?,?), ref: 10003005
PtInRect.USER32(?,?,?), ref: 1000301A
KillTimer.USER32(?,?), ref: 10003032
SendMessageA.USER32(?,00000030,?,00000001), ref: 10003051
InvalidateRect.USER32(?,?,00000001), ref: 1000306D
#2379.MFC42 ref: 10003075

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$ClientMessage$#2379InvalidateKillScreenSendTimer
String ID:
API String ID: 173336095-0
Opcode ID: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction ID: 76f8f83f127ebf74195a72dad42daeb95907ffedfed5679e39fce6817e511657
Opcode Fuzzy Hash: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction Fuzzy Hash: CB1103B4504711AFE314DF64CC98E6BB7E9FB88B81F04890DF98683254EB75E904CB91

Function 10002150 Relevance: 10.5, APIs: 7, Instructions: 41COMMON

Download Yara Rule

APIs

#795.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000217E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000218E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000219E
#2414.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021B7
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021CA
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021D7
#641.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021E6

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#2414#641#795
String ID:
API String ID: 1303925036-0
Opcode ID: 9c0007cf5b19ab8dec9855f64950081603fe9d25d0220f3b38a78263db54cccf
Instruction ID: f5c4544bc7a3faee989b476a257d09b4c225558fe38a2fb961692ad6650ff4c0
Opcode Fuzzy Hash: 9c0007cf5b19ab8dec9855f64950081603fe9d25d0220f3b38a78263db54cccf
Instruction Fuzzy Hash: 411130B5004B818EE315DF28C84174AFBE4FFA5790F55091DE4A643796CFB8614DCBA2

Function 10002070 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

#324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#324
String ID:
API String ID: 2217935779-0
Opcode ID: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction ID: 0e0f615a265ac9c9a9ef4592cef02d40833f3a3893898f0605a6b53120fdffae
Opcode Fuzzy Hash: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction Fuzzy Hash: 82114CB5104B818BE311CF148C8075AFBE5FB99781F510C1DE19647796DBB8A548CB92

Function 10002A00 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 10002A06
GetClientRect.USER32(?,?), ref: 10002A30
GetWindowRect.USER32(?,?), ref: 10002A42
#4299.MFC42(?,?,?,?,00000001), ref: 10002A85
#4299.MFC42(?,?,?,?,00000001,?,?,?,?,00000001), ref: 10002AB3

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #4299Rect$#2379ClientWindow
String ID:
API String ID: 2463140695-0
Opcode ID: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction ID: 7fd873ad5859924dc3e9645bdb9b098ce72c68c189247eaef3a9cf332acd70ce
Opcode Fuzzy Hash: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction Fuzzy Hash: 9F212F75304705AFD708DE78CD94E6BB7EAFBC8244F058A2DB84583249DA70F909C6A2

Function 100049BA Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 100049E8
_initterm.MSVCRT ref: 10004A13
free.MSVCRT ref: 10004A50

Strings

kGu0EAu, xrefs: 100049D0

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID: kGu0EAu
API String ID: 1678931842-451212217
Opcode ID: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction ID: 6e6ce05fc65f6857befb30b960dddb25c0f056c42b7287eed7d5b62f4f9fe03b
Opcode Fuzzy Hash: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction Fuzzy Hash: 3D113CB27462229FF714DF68DD84B5637E5FB493D1B22402DE801C716CEB719A00CB59

Function 10002B50 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

#567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
#540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
#556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
#2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #2614#540#556#567
String ID:
API String ID: 4066608244-0
Opcode ID: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction ID: 5380fbfe1f13ce258253e983e879f2a7423347c2a2865734c5e17ac8d5c15826
Opcode Fuzzy Hash: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction Fuzzy Hash: 97112BB0500B91CFE320CF1AC844356FBE5FB45754F900E2EE19687B95DBB9A444CB91

Function 100030F0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

#858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
IsWindow.USER32(?), ref: 10003129
#6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
#800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #6358#800#858Window
String ID:
API String ID: 1255164923-0
Opcode ID: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction ID: a14bf695a60021346b265786ca639e55b1935be1e887f5c80a4f76400b1b17f4
Opcode Fuzzy Hash: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction Fuzzy Hash: 0E01A272104A519BD311CF14C841B9B73E8FB49BA0F008A1DF16683584DB74A808CB62

Function 10003540 Relevance: 6.0, APIs: 4, Instructions: 35registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
RegQueryValueA.ADVAPI32 ref: 1000357E
lstrcpyA.KERNEL32(?,00000000), ref: 10003591
RegCloseKey.ADVAPI32(?), ref: 1000359C

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValuelstrcpy
String ID:
API String ID: 534897748-0
Opcode ID: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction ID: 31d2930b61c82b42a2fde46d1cefe9ce52522f5b9b535180cdc1a6a6f7b1b038
Opcode Fuzzy Hash: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction Fuzzy Hash: F3F04F75144312BFE320CB10CC89FABBBA9EBC8790F10C90CF98982254D670D844CBA2

Function 10002F70 Relevance: 6.0, APIs: 4, Instructions: 35windowtimeCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 10002F9C
InvalidateRect.USER32(?,00000000,00000001), ref: 10002FAA
SetTimer.USER32(?,?,00000064,00000000), ref: 10002FBF
#2379.MFC42 ref: 10002FC7

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #2379InvalidateMessageRectSendTimer
String ID:
API String ID: 920896690-0
Opcode ID: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction ID: 2dcf2f78edcbb6a6aeec61f8ec110639963feb333860edce5202acada731f870
Opcode Fuzzy Hash: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction Fuzzy Hash: CBF0E775210711ABE730CB65CC85F56B3E9BB4C790F114A19F686D76C4D6B1F9408B50

Function 1000431C Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

#1567.MFC42 ref: 10004320
#800.MFC42 ref: 10004335
#800.MFC42 ref: 10004341
#800.MFC42 ref: 10004350

Memory Dump Source

Source File: 0000000C.00000002.1593383185.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000C.00000002.1593360952.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593408823.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593441053.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000C.00000002.1593475546.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#1567
String ID:
API String ID: 3194870385-0
Opcode ID: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction ID: e8ea892de69bcb9610e0c8c3a5f6cf03a5fb7e67a11db6fafae1abe6c09cea7f
Opcode Fuzzy Hash: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction Fuzzy Hash: 14F08C79C05288DADB04CF98D1417EDFB70FB61310F1081AEC85123282CB762A0AC761

Analysis Process: rundll32.exePID: 6744, Parent PID: 7120COMMON

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	374
Total number of Limit Nodes:	11

Executed Functions

Function 10001420 Relevance: 89.6, APIs: 47, Strings: 4, Instructions: 301
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4710.MFC42 ref: 1000143D
#540.MFC42 ref: 10001446

Part of subcall function 10001830: #537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
Part of subcall function 10001830: #860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
Part of subcall function 10001830: #941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
Part of subcall function 10001830: #941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
Part of subcall function 10001830: #941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
Part of subcall function 10001830: #941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
Part of subcall function 10001830: #941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
Part of subcall function 10001830: #941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
Part of subcall function 10001830: #941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
Part of subcall function 10001830: #941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
Part of subcall function 10001830: #2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
Part of subcall function 10001830: #860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
Part of subcall function 10001830: #939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
Part of subcall function 10001830: #941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
Part of subcall function 10001830: #941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
Part of subcall function 10001830: #941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
Part of subcall function 10001830: #941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
Part of subcall function 10001830: #941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
Part of subcall function 10001830: #941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
Part of subcall function 10001830: #941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
Part of subcall function 10001830: #941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
Part of subcall function 10001830: #800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

SendMessageA.USER32(?,00000031,00000000,00000000), ref: 1000146D
#2860.MFC42(00000000), ref: 10001470
GetObjectA.GDI32(?,0000003C,?), ref: 10001480
MulDiv.KERNEL32(?,00000003,00000002), ref: 1000148F
CreateFontIndirectA.GDI32(?), ref: 100014A4
#1641.MFC42(00000000), ref: 100014AD
SendMessageA.USER32(?,00000030,?,00000001), ref: 100014C5
GetWindowRect.USER32(?,?), ref: 100014D6
GetWindowRect.USER32(?,?), ref: 100014E4
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000150B
#2818.MFC42(?,About %s,?,6D34A098,00000000,00000000,?,?,00000006), ref: 10001534
#6199.MFC42(?), ref: 10001543
#2818.MFC42(?,10008058,?,?), ref: 10001567
#2818.MFC42(?,10008058,?,?), ref: 1000158E
#6199.MFC42(?,?), ref: 100015A3
#6199.MFC42(?,?,?), ref: 100015B5
#860.MFC42(10008798,?,?,?), ref: 100015C3
#2818.MFC42(10008798,10008058,?,10008798,?,?,?), ref: 100015E0
#6199.MFC42(?,10008798,?,?,?), ref: 100015F3
#860.MFC42(10008798,?,10008798,?,?,?), ref: 10001601
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,?,?), ref: 1000161E
#941.MFC42( ** BETA ** ,10008798,?,10008798,?,?,?), ref: 10001639
#6199.MFC42(?,10008798,?,10008798,?,?,?), ref: 10001649
SendMessageA.USER32(?,00000170,?,00000000), ref: 1000166A
#860.MFC42(10008798,?,10008798,?,10008798,?,?,?), ref: 10001675
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,?,?), ref: 10001692
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016A5
#860.MFC42(10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016B3
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016D0
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016E3
#860.MFC42(PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016F1
GetModuleHandleA.KERNEL32(?,PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016FB
#2919.MFC42(00000100,00000000), ref: 1000170B
_GetAppVersion@8.PSABOUT(00000000,00000100,00000000), ref: 10001711
#926.MFC42(?,ProSoft About Version : ,?,00000000), ref: 10001729
#858.MFC42 ref: 1000173B
#800.MFC42 ref: 10001749
#6199.MFC42(?), ref: 10001759
#860.MFC42(10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001775
#2818.MFC42(?,10008058,00000000,10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001798
#6199.MFC42(?), ref: 100017AD
#2818.MFC42(?,10008058,?,?), ref: 100017C6
#535.MFC42(?,?,?), ref: 100017D9

Part of subcall function 100030F0: #858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
Part of subcall function 100030F0: IsWindow.USER32(?), ref: 10003129
Part of subcall function 100030F0: #6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
Part of subcall function 100030F0: #800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

#800.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000180E

Strings

PSAbout.dll, xrefs: 100016E8
** BETA ** , xrefs: 10001630
About %s, xrefs: 1000152E
ProSoft About Version : , xrefs: 10001723

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#2818$#6199$#860$#800$MessageSendWindow$#858Rect$#1641#2860#2919#4710#535#537#540#6197#6358#926#939CreateFontHandleIndirectModuleObjectVersion@8
String ID: ** BETA ** $About %s$PSAbout.dll$ProSoft About Version :
API String ID: 3958394562-2501452965
Opcode ID: 93a61c409d91f74adb62bd33cdf8a781a3db4ebdfbefdad8c7220e47ed2a5d1a
Instruction ID: f28686d8da41217129008f13a01225032e64cb8ff28e48d6fc26cba87298445a
Opcode Fuzzy Hash: 93a61c409d91f74adb62bd33cdf8a781a3db4ebdfbefdad8c7220e47ed2a5d1a
Instruction Fuzzy Hash: EFB170B4204B41ABE715CB20CC91FAB73E9FB94684F05891CF5969728ADF31FA08CB55

Function 10001830 Relevance: 66.6, APIs: 22, Strings: 16, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
#860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
#941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
#941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
#941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
#941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
#941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
#941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
#941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
#941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
#2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
#860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
#939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
#941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
#941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
#941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
#941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
#941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
#941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
#941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
#941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
#800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

Strings

Phone: +1 661-716-5100, xrefs: 10001896
This computer program is protected by, xrefs: 10001925
ProSoft Technology Inc. , xrefs: 10001919
Bakersfield, CA 93309 USA., xrefs: 1000187E
Unauthorized reproduction or distribution, xrefs: 1000193D
e-mail: prosoft@prosoft-technology.com , xrefs: 100018C6
and will be prosecuted to the maximum extent, xrefs: 10001961
permissible under the law., xrefs: 1000196D
result in severe civil and criminal penalties,, xrefs: 10001955
of this program, or any portion of it, may, xrefs: 10001949
Fax: +1 661-716-5101, xrefs: 100018A2
2004-2009, xrefs: 1000184A
Web: www.prosoft-technology.com , xrefs: 100018BA
copyright law and international treaties., xrefs: 10001931
5201 Truxtun Avenue, 3rd Floor, xrefs: 10001872
ProSoft Technology, Inc., xrefs: 1000185E

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#860$#2818#537#800#939
String ID: This computer program is protected by$ 5201 Truxtun Avenue, 3rd Floor$ Bakersfield, CA 93309 USA.$ Fax: +1 661-716-5101$ Phone: +1 661-716-5100$ ProSoft Technology Inc. $ ProSoft Technology, Inc.$ Unauthorized reproduction or distribution$ Web: www.prosoft-technology.com $ and will be prosecuted to the maximum extent$ copyright law and international treaties.$ e-mail: prosoft@prosoft-technology.com $ of this program, or any portion of it, may$ permissible under the law.$ result in severe civil and criminal penalties,$2004-2009
API String ID: 560914698-2702941522
Opcode ID: 3e8686c33e3dff9c0c9880628ee8c3a3c2ef0ead8f0d71cde7fdfe506ad94cfd
Instruction ID: 91c8ed7013d054164af58b362b1f26a6fbb61d5f425d44fa41214922a166be22
Opcode Fuzzy Hash: 3e8686c33e3dff9c0c9880628ee8c3a3c2ef0ead8f0d71cde7fdfe506ad94cfd
Instruction Fuzzy Hash: 473161B4340D9067F909E7188C26AFD6355EF919D2F43451CB3A16728FCF246B1A838E

Function 10003C10 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6467.MFC42(00000000), ref: 10003C3D
#268.MFC42(00000000), ref: 10003C4C

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 10003C79
#800.MFC42(00000000,00000000), ref: 10003CAD
#795.MFC42(00000000,00000000), ref: 10003CD7
#795.MFC42(00000000,00000000), ref: 10003CE6
#795.MFC42(00000000,00000000), ref: 10003CF5
#795.MFC42(00000000,00000000), ref: 10003D04
#795.MFC42(00000000,00000000), ref: 10003D13
#795.MFC42(00000000,00000000), ref: 10003D22
#795.MFC42(00000000,00000000), ref: 10003D31
#795.MFC42(00000000,00000000), ref: 10003D40
#795.MFC42(00000000,00000000), ref: 10003D4F
#609.MFC42(00000000,00000000), ref: 10003D5E
#641.MFC42(00000000,00000000), ref: 10003D6C
#1567.MFC42(00000000,00000000), ref: 10003D75
#800.MFC42(00000000,00000000), ref: 10003CB9

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003DAE
#800.MFC42(00000000,00000000), ref: 10003DBA
#795.MFC42(00000000,00000000), ref: 10003DD8
#795.MFC42(00000000,00000000), ref: 10003DE7
#795.MFC42(00000000,00000000), ref: 10003DF6
#795.MFC42(00000000,00000000), ref: 10003E05
#795.MFC42(00000000,00000000), ref: 10003E14
#795.MFC42(00000000,00000000), ref: 10003E23
#795.MFC42(00000000,00000000), ref: 10003E32
#795.MFC42(00000000,00000000), ref: 10003E41
#795.MFC42(00000000,00000000), ref: 10003E50
#609.MFC42(00000000,00000000), ref: 10003E5F
#641.MFC42(00000000,00000000), ref: 10003E6D
#1567.MFC42(00000000,00000000), ref: 10003E76

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

, xrefs: 10003D9E
d, xrefs: 10003D8F

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: 864dba5f2589cee9f34ace38c7c25b972837081295b7a0c565ecea36310cfde6
Instruction ID: ce90d30b60a23b1df5e22dc6523357bb231baf84ee5b8182cc3d66bcb1d629aa
Opcode Fuzzy Hash: 864dba5f2589cee9f34ace38c7c25b972837081295b7a0c565ecea36310cfde6
Instruction Fuzzy Hash: C771477880628CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA32

Function 10002D40 Relevance: 31.6, APIs: 21, Instructions: 126
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3797.MFC42 ref: 10002D5E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 10002D75
#3874.MFC42(?), ref: 10002D8B
#540.MFC42(?), ref: 10002D94
#3874.MFC42(?), ref: 10002DA8
#6199.MFC42(?,?), ref: 10002DBD
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 10002DCC
#2860.MFC42(00000000), ref: 10002DD3
GetStockObject.GDI32(00000011), ref: 10002DE6
GetStockObject.GDI32(0000000C), ref: 10002DEE
#2860.MFC42(00000000), ref: 10002DF5
GetObjectA.GDI32(?,0000003C,?), ref: 10002E07
CreateFontIndirectA.GDI32(?), ref: 10002E18
#1641.MFC42(00000000), ref: 10002E1E
CreateFontIndirectA.GDI32(?), ref: 10002E2D
#1641.MFC42(00000000), ref: 10002E33
GetClientRect.USER32(?,?), ref: 10002E58
#2122.MFC42(?,00000000), ref: 10002E66
#1088.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E78
#5277.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E7F
#800.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E90

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: Object$#1641#2860#3874CreateFontIndirectStock$#1088#2122#3797#5277#540#6199#800ClientLongMessageRectSendWindow
String ID:
API String ID: 2029918275-0
Opcode ID: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction ID: c9a03a5f96910dafa03aba3819474b77990a7e9c8b104b6fd7e7a11093b1c142
Opcode Fuzzy Hash: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction Fuzzy Hash: D141CFB4204B42ABE624DB24CC85F6FB3A9EF88B90F010A0CF142972C9DF64F905C765

Function 100047D9 Relevance: 31.6, APIs: 21, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1116.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F0
#1176.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F5
#1575.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004809
#1168.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004812
#1577.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004830
#1182.MFC42(100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?), ref: 10004843
#823.MFC42(00000040,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?), ref: 1000484A
#342.MFC42(100098F8,00000000,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?), ref: 10004859
#1176.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004868
#1243.MFC42(?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?), ref: 10004870
#1243.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004887
#1176.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 1000488E
#1168.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004896
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048A9
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B0
#1577.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B5
#1253.MFC42(100098F8,00000001,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048C1
#6467.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048D6
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048DB
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048E2
#1255.MFC42(?,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048EA

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #1176$#1168#1197#1243#1570#1577$#1116#1182#1253#1255#1575#342#6467#823
String ID:
API String ID: 2007088025-0
Opcode ID: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction ID: edb89b75dec8b2219673670b66b7d6a2bc8d39bc8546632be8b72beb1c9dc777
Opcode Fuzzy Hash: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction Fuzzy Hash: 4C318FB8600244ABFB10EF61C845F5D77A4EF806E0F13C529F9255B2AADF34E941CB19

Function 10003260 Relevance: 28.7, APIs: 19, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindow.USER32(?), ref: 10003287
GetWindowRect.USER32(?,?), ref: 100032AC
GetClientRect.USER32(?,?), ref: 100032BB
#6605.MFC42(?), ref: 100032C8
GetParent.USER32(?), ref: 100032D1
#2864.MFC42(00000000), ref: 100032D8
#6880.MFC42(?,00000000), ref: 100032EA
#6880.MFC42(?,?,00000000), ref: 100032F6
#540.MFC42(00000000), ref: 100032FF
#3874.MFC42 ref: 10003313
GetDC.USER32(?), ref: 1000331C
#2859.MFC42(00000000), ref: 10003323
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 1000334B
ReleaseDC.USER32(?,?), ref: 10003371
#3797.MFC42 ref: 100033A9
InflateRect.USER32(?,00000000,?), ref: 100033D8
InflateRect.USER32(?,?,00000000), ref: 1000340D
#6197.MFC42(00000000,?,?,?,?,00000004), ref: 1000344C
#800.MFC42(00000000,?,?,?,?,00000004), ref: 1000345D

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$#6880InflateWindow$#2859#2864#3797#3874#540#6197#6605#800ClientExtentParentPoint32ReleaseText
String ID:
API String ID: 1555407671-0
Opcode ID: d2e59de0ad313e814094079131a3e4435a3ca1c7cc293d6768b7e4fa58d8ab18
Instruction ID: fad4f85ae7451d699b48dc3c23a1c9188842fcfe73b98fa0dc477d473762e04e
Opcode Fuzzy Hash: d2e59de0ad313e814094079131a3e4435a3ca1c7cc293d6768b7e4fa58d8ab18
Instruction Fuzzy Hash: 2A6129B5204341AFD744CF68CD84A6FB7E9FBC8680F454A1CF98593298DB34E9058BA2

Function 100011D0 Relevance: 22.6, APIs: 15, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 1000120F
#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001231
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001247
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001257

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001277
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001287
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001297
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012A7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012B7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012C7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012D7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012E7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012F7
#609.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001304
#641.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001313

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#2414$#800$#609#641#809
String ID:
API String ID: 2601255804-0
Opcode ID: dad1e5acd96207fcb516968db52c721e2fe89a94faa14b1906d0b7f2ef00c40b
Instruction ID: c87b3d48cd3f525f1380d43a1c8d41ca1566e881e5744a2b82a627dc5851ada9
Opcode Fuzzy Hash: dad1e5acd96207fcb516968db52c721e2fe89a94faa14b1906d0b7f2ef00c40b
Instruction Fuzzy Hash: 6C311B78108B818AE315DF64C48579ABFD4AFA5380F550C5DE4E603297CBB8624DCBA3

Function 10003480 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034A9
#2915.MFC42(00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034C4
GetWindowsDirectoryA.KERNEL32(00000000,00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034CA
#5572.MFC42(000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034D6
#941.MFC42(\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034E4
LoadLibraryA.KERNELBASE(?,\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034EE
LoadCursorA.USER32(00000000,0000006A), ref: 100034FD
CopyIcon.USER32(00000000), ref: 10003508
FreeLibrary.KERNELBASE(00000000,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003512
#800.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003524

Strings

\winhlp32.exe, xrefs: 100034DB

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad$#2915#540#5572#800#941CopyCursorDirectoryFreeIconWindows
String ID: \winhlp32.exe
API String ID: 1176994157-695620452
Opcode ID: 9bc18a9dcaf9d496de05e81099aa452c11a15a7f8f37902f5a36aa6263560667
Instruction ID: e496be142816392f4a802cf4bfc056d9d89f17a7e690c9ce2094f43ff9286023
Opcode Fuzzy Hash: 9bc18a9dcaf9d496de05e81099aa452c11a15a7f8f37902f5a36aa6263560667
Instruction Fuzzy Hash: 8011A0B5104A12ABE305DF24CC45B9BB7E8FF457A1F108A1CF562932E4DF349648CA56

Function 10001330 Relevance: 16.6, APIs: 11, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2302.MFC42(?,00000001,?), ref: 1000133F
#2302.MFC42(?,00000C81,?,?,00000001,?), ref: 10001351
#2302.MFC42(?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001363
#2302.MFC42(?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001375
#2302.MFC42(?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001387
#2302.MFC42(?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?), ref: 10001399
#2302.MFC42(?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?), ref: 100013AB
#2302.MFC42(?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?), ref: 100013BD
#2302.MFC42(?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?), ref: 100013CF
#2302.MFC42(?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?), ref: 100013E1
#2302.MFC42(?,00000BC0,?,?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?), ref: 100013F3

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #2302
String ID:
API String ID: 735948377-0
Opcode ID: 7164a37812371677f22d9e14ba1a6941cd8c28cbc93c80df03fbb858e5833c04
Instruction ID: a7bc58141b3d57b7a2f9e387017e1c6d9f08b27cbc72826201795aafa6989a29
Opcode Fuzzy Hash: 7164a37812371677f22d9e14ba1a6941cd8c28cbc93c80df03fbb858e5833c04
Instruction Fuzzy Hash: 521170B6140B407BF611DE20DC82FFBB36CEB85B8AF45441CBA8515086DFD47E059625

Function 10002C30 Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2414.MFC42 ref: 10002C64
#809.MFC42 ref: 10002C71
#2414.MFC42 ref: 10002C8A
#2414.MFC42 ref: 10002CA8
#800.MFC42 ref: 10002CBB
#795.MFC42 ref: 10002CCA

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #2414$#795#800#809
String ID:
API String ID: 1676757150-0
Opcode ID: cc5e3a9273f2020014c9eae9fbf216b3f049fc57e9afae3d7d4acf3af9f9cb91
Instruction ID: 61f50b5283f78187b9943e8254bafee2355d34d6e190acac775872f165fc4980
Opcode Fuzzy Hash: cc5e3a9273f2020014c9eae9fbf216b3f049fc57e9afae3d7d4acf3af9f9cb91
Instruction Fuzzy Hash: BF115EB51047C28FE700CF19C80070AFBE5EF95791F954A1DE0A153385CBB8A50ACF62

Function 10004900 Relevance: 9.0, APIs: 6, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,00002000), ref: 1000490E
LocalFree.KERNEL32(00000000), ref: 1000491A
#1176.MFC42 ref: 10004920
#1243.MFC42(10008868), ref: 1000492C
#1176.MFC42 ref: 1000493E
#1243.MFC42(?), ref: 10004946

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #1176#1243Local$AllocFree
String ID:
API String ID: 2308495640-0
Opcode ID: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction ID: 5589185b89f99a7ae39e63059246849f8e8e202c6ff74abfd7579a51ee7ecbbf
Opcode Fuzzy Hash: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction Fuzzy Hash: 86E092B0944311AAF620DB61CC4AF0B7AD9EF407E2F138439F104960A9CF70E440C618

Function 1000478E Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 10004793
#6467.MFC42(10008868), ref: 100047A2
#1578.MFC42(?,?,?,?,10008868), ref: 100047B7

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #1578#6467H_prolog
String ID:
API String ID: 3701988776-0
Opcode ID: 225be51d1682979de9a5a8f11b93485f42be95f4e01545b56e450a7edae2f307
Instruction ID: 8d8a2343cbf58df175da5ae398bcc65f357205776284d92b25b36d497a5dc97f
Opcode Fuzzy Hash: 225be51d1682979de9a5a8f11b93485f42be95f4e01545b56e450a7edae2f307
Instruction Fuzzy Hash: 08E0E5B9900149AFEF06DF80C942BAEBB71FF44345F108418B85526255DB76AA21DB25

Non-executed Functions

Function 100019F0 Relevance: 84.4, APIs: 47, Strings: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2379.MFC42 ref: 100019F6
GetWindowRect.USER32(?,?), ref: 10001A26
GetWindowRect.USER32(?,?), ref: 10001A34
#6880.MFC42(?), ref: 10001A3D
#6880.MFC42(?,?), ref: 10001A49
GetWindowRect.USER32(?,?), ref: 10001A92
#6880.MFC42(?), ref: 10001A9B
GetWindowRect.USER32(?,?), ref: 10001AB3
#6880.MFC42(?), ref: 10001ABC
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?), ref: 10001AD9
GetWindowRect.USER32(?,?), ref: 10001AF6
#6880.MFC42(?,?,00000000,00000000,00000005,?), ref: 10001AFF
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B1C
GetWindowRect.USER32(?,?), ref: 10001B33
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B3C
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001B5A
GetWindowRect.USER32(?,?), ref: 10001B7D
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B86
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BA4
GetWindowRect.USER32(?,?), ref: 10001BB5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BBE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BE3
GetWindowRect.USER32(?,?), ref: 10001BF4
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BFD
GetWindowRect.USER32(?,?), ref: 10001C20
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C29
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001C47
GetWindowRect.USER32(?,?), ref: 10001C7A
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C83
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001CA8
GetWindowRect.USER32(?,?), ref: 10001CB9
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CC2
GetWindowRect.USER32(?,?), ref: 10001CE5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CEE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D0C
#6215.MFC42(00000000,6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000), ref: 10001D1B
GetWindowRect.USER32(?,?), ref: 10001D3E
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D47
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D75
GetWindowRect.USER32(?,?), ref: 10001D92
#6880.MFC42(?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D9B
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005), ref: 10001DC5
GetWindowRect.USER32(?,?), ref: 10001DE8
#6880.MFC42(?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?), ref: 10001DF1
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,?,?,00000004,?,?,?,?,00000004), ref: 10001E17
GetWindowRect.USER32(?,?), ref: 10001E37
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006,?,00000000,00000000,00000005,?,?,?,?,00000004,?), ref: 10001E5C

Strings

VUUU, xrefs: 10001A58

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: RectWindow$#6880$#6197$#2379#6215
String ID: VUUU
API String ID: 1101919440-2040033107
Opcode ID: 13b8e8da2f769331353385238693a4145235e3055610f624813af9cb8230173c
Instruction ID: 5a31ff0520036d38cb31330b8b9511fc0d41158ddc336ad14b2b1ef2a9cc197e
Opcode Fuzzy Hash: 13b8e8da2f769331353385238693a4145235e3055610f624813af9cb8230173c
Instruction Fuzzy Hash: D9D120B52147019FE314CF24CC95FABB7E9EBD8B84F104A1CB58687296EA30F905CB95

Function 10004090 Relevance: 66.7, APIs: 35, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42 ref: 100040B4
#537.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040C9
#540.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040D5
#6467.MFC42(00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040E7
#860.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040F8
#268.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004100
#2915.MFC42(00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004111
GetModuleFileNameA.KERNEL32(?,00000000,00000100,00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004120
#2915.MFC42(00000000), ref: 1000412A
GetFileVersionInfoSizeA.VERSION(00000000,?,00000000), ref: 10004134
#823.MFC42(00000000,00000000,?,00000000), ref: 10004144
#2915.MFC42(00000000), ref: 10004152
GetFileVersionInfoA.VERSION(00000000,?,00000000,00000000,00000000), ref: 1000415E
GetLastError.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 10004169
#2915.MFC42(00000000,00000000,?,00000000,00000000,00000000), ref: 10004180
VerQueryValueA.VERSION(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000418F
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000419A
#2818.MFC42(?,10008058,?,00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 100041B9
#825.MFC42(00000000,00000000,00000000,00000000), ref: 100041C6
#6877.MFC42(100086C4,100086C8,00000000,?,00000000), ref: 100041E0
#5683.MFC42(0000002E,100086C4,100086C8,00000000,?,00000000), ref: 100041F3
#5710.MFC42(?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004213
#4129.MFC42(?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004226
#924.MFC42(?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004239
#922.MFC42(?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004248
#858.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004255
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004261
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 1000426D
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004279
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004285
#2915.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 1000428F
#1567.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042BB
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042D5
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042E1
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042F0

Strings

\StringFileInfo\040904B0\ProductVersion, xrefs: 100040BB
Build , xrefs: 1000422B
GetFileVersionInfo Error is %d, xrefs: 10004173, 100041A4

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#2915$File$#540ErrorInfoLastVersion$#1567#268#2818#4129#537#5683#5710#6467#6877#823#825#858#860#922#924ModuleNameQuerySizeValue
String ID: Build $GetFileVersionInfo Error is %d$\StringFileInfo\040904B0\ProductVersion
API String ID: 2403904333-2205515449
Opcode ID: 32ee173fd4bfab7e9fd2f4364ef36033f116338a373bc0aea6c9cddcc8ed7950
Instruction ID: fe3a53cdd048ef3aad4013630a4a48c8c662586e619284a4b3165d18e955ce92
Opcode Fuzzy Hash: 32ee173fd4bfab7e9fd2f4364ef36033f116338a373bc0aea6c9cddcc8ed7950
Instruction Fuzzy Hash: AD71A3B5801149AAEB04DBE4CD81EEFBB78EF15280F114158F90673286DF746B09C776

Function 10002620 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 313windowCOMMON

Download Yara Rule

APIs

#470.MFC42 ref: 10002646
#323.MFC42 ref: 10002673
GetClientRect.USER32(?,?), ref: 1000268F
#5788.MFC42(?), ref: 10002699
#5794.MFC42(00000007,?), ref: 100026A6
Rectangle.GDI32(?,?,?,?,?), ref: 100026C9
#5788.MFC42(00000000), ref: 100026D4
#5788.MFC42(00000000,00000000), ref: 100026DE
CreateCompatibleDC.GDI32(?), ref: 100026FD
#1640.MFC42(00000000), ref: 10002708
SendMessageA.USER32(?,00000172,00000000,?), ref: 1000272E
GetClientRect.USER32(?,?), ref: 10002740
#5785.MFC42(?,?), ref: 10002752
MulDiv.KERNEL32(?,?,?), ref: 1000279E
MulDiv.KERNEL32(?,?,?), ref: 100027CB
StretchBlt.GDI32(?,?,00000000,00000000,?,?,100064FC,100064FC,?,?,00CC0020), ref: 10002831
#5785.MFC42(?,?), ref: 10002848
#2405.MFC42(?,?), ref: 10002851
GetClientRect.USER32(?,?), ref: 10002865
GetClientRect.USER32(?,?), ref: 10002870
MulDiv.KERNEL32(?,?,00000064), ref: 1000288C
MulDiv.KERNEL32(?,?,00000064), ref: 100028A6
#6172.MFC42(00FFFFFF), ref: 100028B5
#5875.MFC42(00000001,00FFFFFF), ref: 100028C0
DrawTextA.USER32(?,?,000000FF,?,00000020), ref: 100028DD
DrawTextA.USER32(?,?,000000FF,?,00000420), ref: 100028F4
GetWindowRect.USER32(?,?), ref: 10002902
#6880.MFC42(?), ref: 1000290F
#6172.MFC42(00FFFFFF,?), ref: 1000296D
#5875.MFC42(00000001,00FFFFFF,?), ref: 10002978
DrawTextA.USER32(?,?,000000FF,?,?), ref: 1000299A
#640.MFC42 ref: 100029A8
#2414.MFC42 ref: 100029C1
#755.MFC42 ref: 100029DD

Strings

gfff, xrefs: 1000291E

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#5788DrawText$#5785#5875#6172$#1640#2405#2414#323#470#5794#640#6880#755CompatibleCreateMessageRectangleSendStretchWindow
String ID: gfff
API String ID: 1747922241-1553575800
Opcode ID: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction ID: de8d7cd43940ff7d5f440d9c982899baa02ad0d10f146baf563ef8a33310dbb5
Opcode Fuzzy Hash: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction Fuzzy Hash: ADC125B52087459FE314DF69C884E6BBBE9FBC8740F114A1CF59583299DB70E809CB62

Function 100035B0 Relevance: 61.3, APIs: 20, Strings: 15, Instructions: 99COMMON

Download Yara Rule

APIs

#540.MFC42(?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035CB
#860.MFC42(The operating system is outof memory or resources.,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035FD
#860.MFC42(The specified path was not found.,The specified file was not found.), ref: 10003610
#860.MFC42(The specified file was not found.), ref: 10003623
#860.MFC42(The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003636
#860.MFC42(The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003649
#860.MFC42(The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000365C
#860.MFC42(The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000366F
#860.MFC42(The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000367F
#860.MFC42(The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000368F
#860.MFC42(The specified dynamic-link library was not found.,There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000369F
#860.MFC42(There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036AF
#860.MFC42(There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036BF
#860.MFC42(A sharing violation occurred. ,The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036CF
#2818.MFC42(?,Unknown Error (%d) occurred.,?,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100036DF
#926.MFC42(?,Unable to open hyperlink:,?), ref: 100036F6
#858.MFC42(?,?,?,?,?,?,00000005), ref: 10003705
#800.MFC42(?,?,?,?,?,?,00000005), ref: 10003713
#1200.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003721
#800.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003732

Strings

The operating system deniedaccess to the specified file., xrefs: 10003640
There is no application associatedwith the given filename extension., xrefs: 100036A6
The operating system is outof memory or resources., xrefs: 100035F4
Unknown Error (%d) occurred., xrefs: 100036D9
The filename association isincomplete or invalid., xrefs: 10003653
The DDE transaction could notbe completed because the request timed out., xrefs: 10003686
The DDE transaction could notbe completed because other DDE transactionswere being processed., xrefs: 10003666
The .EXE file is invalid(non-Win32 .EXE or error in .EXE image)., xrefs: 1000362D
The specified dynamic-link library was not found., xrefs: 10003696
The DDE transaction failed., xrefs: 10003676
The specified path was not found., xrefs: 10003607
The specified file was not found., xrefs: 1000361A
A sharing violation occurred. , xrefs: 100036C6
Unable to open hyperlink:, xrefs: 100036F0
There was not enough memory to complete the operation., xrefs: 100036B6

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #860$#800$#1200#2818#540#858#926
String ID: A sharing violation occurred. $The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).$The DDE transaction could notbe completed because other DDE transactionswere being processed.$The DDE transaction could notbe completed because the request timed out.$The DDE transaction failed.$The filename association isincomplete or invalid.$The operating system deniedaccess to the specified file.$The operating system is outof memory or resources.$The specified dynamic-link library was not found.$The specified file was not found.$The specified path was not found.$There is no application associatedwith the given filename extension.$There was not enough memory to complete the operation.$Unable to open hyperlink:$Unknown Error (%d) occurred.
API String ID: 346542042-3273680174
Opcode ID: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction ID: bf864e296dc8769b1736225a429bb83c06595c96c86935583d96534d00f8651e
Opcode Fuzzy Hash: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction Fuzzy Hash: F131A2B8018A41BBF215CB14CC62AAF7798FB902C1F01C91CB5D5521AADF33674DC79A

Function 10003970 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

#6467.MFC42(00000000), ref: 1000399D
#268.MFC42(00000000), ref: 100039AC

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 100039D3
#800.MFC42(00000000,00000000), ref: 10003A07
#795.MFC42(00000000,00000000), ref: 10003A31
#795.MFC42(00000000,00000000), ref: 10003A40
#795.MFC42(00000000,00000000), ref: 10003A4F
#795.MFC42(00000000,00000000), ref: 10003A5E
#795.MFC42(00000000,00000000), ref: 10003A6D
#795.MFC42(00000000,00000000), ref: 10003A7C
#795.MFC42(00000000,00000000), ref: 10003A8B
#795.MFC42(00000000,00000000), ref: 10003A9A
#795.MFC42(00000000,00000000), ref: 10003AA9
#609.MFC42(00000000,00000000), ref: 10003AB8
#641.MFC42(00000000,00000000), ref: 10003AC6
#1567.MFC42(00000000,00000000), ref: 10003ACF
#800.MFC42(00000000,00000000), ref: 10003A13

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003B08
#800.MFC42(00000000,00000000), ref: 10003B14
#795.MFC42(00000000,00000000), ref: 10003B32
#795.MFC42(00000000,00000000), ref: 10003B41
#795.MFC42(00000000,00000000), ref: 10003B50
#795.MFC42(00000000,00000000), ref: 10003B5F
#795.MFC42(00000000,00000000), ref: 10003B6E
#795.MFC42(00000000,00000000), ref: 10003B7D
#795.MFC42(00000000,00000000), ref: 10003B8C
#795.MFC42(00000000,00000000), ref: 10003B9B
#795.MFC42(00000000,00000000), ref: 10003BAA
#609.MFC42(00000000,00000000), ref: 10003BB9
#641.MFC42(00000000,00000000), ref: 10003BC7
#1567.MFC42(00000000,00000000), ref: 10003BD0

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

d, xrefs: 10003AE9
, xrefs: 10003AF8

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: e584cfe3d76a06efcd44d6a9b43c4ccd9e9a91c91e2c9506ed0a414b07c3501e
Instruction ID: ba9fdb3c8c69b1efcd9dc3c0e08e9eba6e85a8a60e063a58fc3de4da0faa40ac
Opcode Fuzzy Hash: e584cfe3d76a06efcd44d6a9b43c4ccd9e9a91c91e2c9506ed0a414b07c3501e
Instruction Fuzzy Hash: 7871377880618CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA36

Function 10002250 Relevance: 52.6, APIs: 25, Strings: 5, Instructions: 148windowtimeCOMMON

Download Yara Rule

APIs

#4710.MFC42(?,?,?,?,10004ED8,000000FF), ref: 1000226A
#540.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002273
#2860.MFC42(?,?,?,?,?,10004ED8,000000FF), ref: 1000228E
#823.MFC42(00000008,?,?,?,?,10004ED8,000000FF), ref: 1000229D
#1146.MFC42(00000899,00000002,00000899), ref: 100022C3
LoadBitmapA.USER32(00000000,00000899), ref: 100022C9
#1641.MFC42(00000000), ref: 100022D2
#6215.MFC42(00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022ED
#6215.MFC42(00000005,00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022FA
#6215.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002311
#6215.MFC42(00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000231E
#860.MFC42(10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002332
#860.MFC42(10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002341
#2818.MFC42(?,10008058,?,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000235B
#860.MFC42(10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000236C
#2818.MFC42(?,Version: %s,?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002386
#939.MFC42(?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002395
CreateSolidBrush.GDI32(?), ref: 100023A1
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023AB
CreateSolidBrush.GDI32(00000000), ref: 100023B4
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023BE
#860.MFC42(Error No Data,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023CA
SetTimer.USER32(?,00000001,00000BB8,00000000), ref: 100023D8
#4224.MFC42(could not Start Splash Timmer,ProSoft,00000000,?,?,?,?,10004ED8,000000FF), ref: 100023F4
#800.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002416

Strings

This is a Beta version of this program. Not for production use and without warranty., xrefs: 10002302
ProSoft, xrefs: 100023E8
could not Start Splash Timmer, xrefs: 100023ED
Version: %s, xrefs: 10002380
Error No Data, xrefs: 100023C3

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #6215#860$#1641$#2818BrushCreateSolid$#1146#2860#4224#4710#540#800#823#939BitmapLoadTimer
String ID: Error No Data$ProSoft$This is a Beta version of this program. Not for production use and without warranty.$Version: %s$could not Start Splash Timmer
API String ID: 514652099-906665912
Opcode ID: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction ID: 1913312f89696d600550852331e7f23b7439d3c132441fa52a7110e09bfaff39
Opcode Fuzzy Hash: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction Fuzzy Hash: 67519FB5200F00ABF215DB64CC51BAAB7E8FB58681F014918F6969729ADF34FA04CB95

Function 10003EB0 Relevance: 25.6, APIs: 17, Instructions: 104COMMON

Download Yara Rule

APIs

#6467.MFC42(00000000), ref: 10003EDD
#268.MFC42(00000000), ref: 10003EEA

Part of subcall function 10002070: #324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

#2514.MFC42(00000000,00000000), ref: 10003F12
#795.MFC42(00000000,00000000), ref: 10003F2D
#609.MFC42(00000000,00000000), ref: 10003F3C
#800.MFC42(00000000,00000000), ref: 10003F73
#800.MFC42(00000000,00000000), ref: 10003F82
#641.MFC42(00000000,00000000), ref: 10003F91
#1567.MFC42(00000000,00000000), ref: 10003F99
#609.MFC42(00000000,00000000), ref: 10003F4B

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

#795.MFC42(00000000,00000000), ref: 10003FC6
#609.MFC42(00000000,00000000), ref: 10003FD5
#609.MFC42(00000000,00000000), ref: 10003FE4
#800.MFC42(00000000,00000000), ref: 1000400C
#800.MFC42(00000000,00000000), ref: 1000401B
#641.MFC42(00000000,00000000), ref: 1000402A
#1567.MFC42(00000000,00000000), ref: 10004032

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#567$#1567#540#641#795$#2414#2514#268#324#6467
String ID:
API String ID: 39110236-0
Opcode ID: 926edbcbb62db7dd29bd71bff26a577ce8fbb8754f73f2f2a57127e8871633d0
Instruction ID: cfaefb5b01c91ea90e470d212f713a34359e3d9334dad7f1e11d803252a963b9
Opcode Fuzzy Hash: 926edbcbb62db7dd29bd71bff26a577ce8fbb8754f73f2f2a57127e8871633d0
Instruction Fuzzy Hash: 904181B8C05299DAEB10DBA4C9417EDFBB0EF15340F1080E9D54923786DF792B48DB66

Function 10001000 Relevance: 22.6, APIs: 15, Instructions: 97COMMON

Download Yara Rule

APIs

#324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111

Part of subcall function 10002B50: #567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
Part of subcall function 10002B50: #540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
Part of subcall function 10002B50: #556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
Part of subcall function 10002B50: #2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
CreateSolidBrush.GDI32(000000FF), ref: 1000117B
#1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#1641#2614#324#556BrushCreateSolid
String ID:
API String ID: 862247804-0
Opcode ID: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction ID: ef8ebbcba9a2f6dd6cb2c20b7593ac1494135993400dd6ceca74427708b28424
Opcode Fuzzy Hash: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction Fuzzy Hash: B74142B4104B829BE311CF24CC8076ABB96FF99381F650C1CE0951B796DBB87549CB92

Function 100037B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 87stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,?), ref: 100037D7

Part of subcall function 10003540: RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
Part of subcall function 10003540: RegQueryValueA.ADVAPI32 ref: 1000357E
Part of subcall function 10003540: lstrcpyA.KERNEL32(?,00000000), ref: 10003591
Part of subcall function 10003540: RegCloseKey.ADVAPI32(?), ref: 1000359C

lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?), ref: 10003816
_mbsstr.MSVCRT ref: 10003842
_mbsstr.MSVCRT ref: 10003857
lstrlenA.KERNEL32(?), ref: 10003867
lstrcatA.KERNEL32(00000000,1000866C), ref: 1000387C
lstrcatA.KERNEL32(00000000,?), ref: 10003887
WinExec.KERNEL32(?,?), ref: 1000388F

Strings

open, xrefs: 100037CE
.htm, xrefs: 100037ED
\shell\open\command, xrefs: 10003810
"%1", xrefs: 1000383C

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$_mbsstr$CloseExecExecuteOpenQueryShellValuelstrcpylstrlen
String ID: "%1"$.htm$\shell\open\command$open
API String ID: 729890978-1533145997
Opcode ID: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction ID: bfa4e36c36e67bfdf65cedbb39ad291800a273508fa034cc737e01779e384aa2
Opcode Fuzzy Hash: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction Fuzzy Hash: 9A21C1325443556BF321EB60CC84FAFB39CFB84291F15891DFB9093144EB25E90987A6

Function 10002440 Relevance: 13.6, APIs: 9, Instructions: 140windowCOMMON

Download Yara Rule

APIs

#2860.MFC42(?,?), ref: 10002453
SendMessageA.USER32(?,00000172,00000000,?), ref: 10002481
GetClientRect.USER32(?,?), ref: 10002499
GetClientRect.USER32(?,?), ref: 100024A4
GetWindowRect.USER32(?,?), ref: 100024AF
SetRect.USER32(00000000,00000000,00000000,00000000,00000000), ref: 100024C2
#6605.MFC42(?,?), ref: 1000252E
OffsetRect.USER32(?,?,?), ref: 10002581
#4299.MFC42(?,?,?,?,00000001), ref: 100025A3

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#2860#4299#6605MessageOffsetSendWindow
String ID:
API String ID: 1591621576-0
Opcode ID: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction ID: cea368ed319ff426ac7cae26e22c5591117dddf13591c75ce779038945222747
Opcode Fuzzy Hash: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction Fuzzy Hash: 71411A713047019FD708CF39CD95A6BB7EAFBC8680F198A2CB585C3259DA70F9058A55

Function 10002FD0 Relevance: 12.1, APIs: 8, Instructions: 60windowtimeCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 10002FD6
ScreenToClient.USER32(?,?), ref: 10002FF6
GetClientRect.USER32(?,?), ref: 10003005
PtInRect.USER32(?,?,?), ref: 1000301A
KillTimer.USER32(?,?), ref: 10003032
SendMessageA.USER32(?,00000030,?,00000001), ref: 10003051
InvalidateRect.USER32(?,?,00000001), ref: 1000306D
#2379.MFC42 ref: 10003075

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$ClientMessage$#2379InvalidateKillScreenSendTimer
String ID:
API String ID: 173336095-0
Opcode ID: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction ID: 76f8f83f127ebf74195a72dad42daeb95907ffedfed5679e39fce6817e511657
Opcode Fuzzy Hash: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction Fuzzy Hash: CB1103B4504711AFE314DF64CC98E6BB7E9FB88B81F04890DF98683254EB75E904CB91

Function 10002150 Relevance: 10.5, APIs: 7, Instructions: 41COMMON

Download Yara Rule

APIs

#795.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000217E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000218E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000219E
#2414.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021B7
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021CA
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021D7
#641.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021E6

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#2414#641#795
String ID:
API String ID: 1303925036-0
Opcode ID: 9c0007cf5b19ab8dec9855f64950081603fe9d25d0220f3b38a78263db54cccf
Instruction ID: f5c4544bc7a3faee989b476a257d09b4c225558fe38a2fb961692ad6650ff4c0
Opcode Fuzzy Hash: 9c0007cf5b19ab8dec9855f64950081603fe9d25d0220f3b38a78263db54cccf
Instruction Fuzzy Hash: 411130B5004B818EE315DF28C84174AFBE4FFA5790F55091DE4A643796CFB8614DCBA2

Function 10002070 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

#324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#324
String ID:
API String ID: 2217935779-0
Opcode ID: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction ID: 0e0f615a265ac9c9a9ef4592cef02d40833f3a3893898f0605a6b53120fdffae
Opcode Fuzzy Hash: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction Fuzzy Hash: 82114CB5104B818BE311CF148C8075AFBE5FB99781F510C1DE19647796DBB8A548CB92

Function 10002A00 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 10002A06
GetClientRect.USER32(?,?), ref: 10002A30
GetWindowRect.USER32(?,?), ref: 10002A42
#4299.MFC42(?,?,?,?,00000001), ref: 10002A85
#4299.MFC42(?,?,?,?,00000001,?,?,?,?,00000001), ref: 10002AB3

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #4299Rect$#2379ClientWindow
String ID:
API String ID: 2463140695-0
Opcode ID: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction ID: 7fd873ad5859924dc3e9645bdb9b098ce72c68c189247eaef3a9cf332acd70ce
Opcode Fuzzy Hash: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction Fuzzy Hash: 9F212F75304705AFD708DE78CD94E6BB7EAFBC8244F058A2DB84583249DA70F909C6A2

Function 100049BA Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 100049E8
_initterm.MSVCRT ref: 10004A13
free.MSVCRT ref: 10004A50

Strings

kGu0EAu, xrefs: 100049D0

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID: kGu0EAu
API String ID: 1678931842-451212217
Opcode ID: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction ID: 6e6ce05fc65f6857befb30b960dddb25c0f056c42b7287eed7d5b62f4f9fe03b
Opcode Fuzzy Hash: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction Fuzzy Hash: 3D113CB27462229FF714DF68DD84B5637E5FB493D1B22402DE801C716CEB719A00CB59

Function 10002B50 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

#567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
#540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
#556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
#2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #2614#540#556#567
String ID:
API String ID: 4066608244-0
Opcode ID: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction ID: 5380fbfe1f13ce258253e983e879f2a7423347c2a2865734c5e17ac8d5c15826
Opcode Fuzzy Hash: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction Fuzzy Hash: 97112BB0500B91CFE320CF1AC844356FBE5FB45754F900E2EE19687B95DBB9A444CB91

Function 100030F0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

#858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
IsWindow.USER32(?), ref: 10003129
#6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
#800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #6358#800#858Window
String ID:
API String ID: 1255164923-0
Opcode ID: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction ID: a14bf695a60021346b265786ca639e55b1935be1e887f5c80a4f76400b1b17f4
Opcode Fuzzy Hash: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction Fuzzy Hash: 0E01A272104A519BD311CF14C841B9B73E8FB49BA0F008A1DF16683584DB74A808CB62

Function 10003540 Relevance: 6.0, APIs: 4, Instructions: 35registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
RegQueryValueA.ADVAPI32 ref: 1000357E
lstrcpyA.KERNEL32(?,00000000), ref: 10003591
RegCloseKey.ADVAPI32(?), ref: 1000359C

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValuelstrcpy
String ID:
API String ID: 534897748-0
Opcode ID: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction ID: 31d2930b61c82b42a2fde46d1cefe9ce52522f5b9b535180cdc1a6a6f7b1b038
Opcode Fuzzy Hash: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction Fuzzy Hash: F3F04F75144312BFE320CB10CC89FABBBA9EBC8790F10C90CF98982254D670D844CBA2

Function 10002F70 Relevance: 6.0, APIs: 4, Instructions: 35windowtimeCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 10002F9C
InvalidateRect.USER32(?,00000000,00000001), ref: 10002FAA
SetTimer.USER32(?,?,00000064,00000000), ref: 10002FBF
#2379.MFC42 ref: 10002FC7

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #2379InvalidateMessageRectSendTimer
String ID:
API String ID: 920896690-0
Opcode ID: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction ID: 2dcf2f78edcbb6a6aeec61f8ec110639963feb333860edce5202acada731f870
Opcode Fuzzy Hash: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction Fuzzy Hash: CBF0E775210711ABE730CB65CC85F56B3E9BB4C790F114A19F686D76C4D6B1F9408B50

Function 1000431C Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

#1567.MFC42 ref: 10004320
#800.MFC42 ref: 10004335
#800.MFC42 ref: 10004341
#800.MFC42 ref: 10004350

Memory Dump Source

Source File: 0000000F.00000002.1621182729.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1621132799.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621215024.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621256959.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000F.00000002.1621282510.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#1567
String ID:
API String ID: 3194870385-0
Opcode ID: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction ID: e8ea892de69bcb9610e0c8c3a5f6cf03a5fb7e67a11db6fafae1abe6c09cea7f
Opcode Fuzzy Hash: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction Fuzzy Hash: 14F08C79C05288DADB04CF98D1417EDFB70FB61310F1081AEC85123282CB762A0AC761

Analysis Process: rundll32.exePID: 352, Parent PID: 7120COMMON

Execution Graph

Execution Coverage:	20%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	374
Total number of Limit Nodes:	11

Executed Functions

Function 10001420 Relevance: 89.6, APIs: 47, Strings: 4, Instructions: 301
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4710.MFC42 ref: 1000143D
#540.MFC42 ref: 10001446

Part of subcall function 10001830: #537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
Part of subcall function 10001830: #860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
Part of subcall function 10001830: #941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
Part of subcall function 10001830: #941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
Part of subcall function 10001830: #941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
Part of subcall function 10001830: #941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
Part of subcall function 10001830: #941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
Part of subcall function 10001830: #941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
Part of subcall function 10001830: #941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
Part of subcall function 10001830: #941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
Part of subcall function 10001830: #2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
Part of subcall function 10001830: #860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
Part of subcall function 10001830: #939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
Part of subcall function 10001830: #941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
Part of subcall function 10001830: #941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
Part of subcall function 10001830: #941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
Part of subcall function 10001830: #941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
Part of subcall function 10001830: #941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
Part of subcall function 10001830: #941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
Part of subcall function 10001830: #941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
Part of subcall function 10001830: #941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
Part of subcall function 10001830: #800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

SendMessageA.USER32(?,00000031,00000000,00000000), ref: 1000146D
#2860.MFC42(00000000), ref: 10001470
GetObjectA.GDI32(?,0000003C,?), ref: 10001480
MulDiv.KERNEL32(?,00000003,00000002), ref: 1000148F
CreateFontIndirectA.GDI32(?), ref: 100014A4
#1641.MFC42(00000000), ref: 100014AD
SendMessageA.USER32(?,00000030,?,00000001), ref: 100014C5
GetWindowRect.USER32(?,?), ref: 100014D6
GetWindowRect.USER32(?,?), ref: 100014E4
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000150B
#2818.MFC42(?,About %s,?,6D34A098,00000000,00000000,?,?,00000006), ref: 10001534
#6199.MFC42(?), ref: 10001543
#2818.MFC42(?,10008058,?,?), ref: 10001567
#2818.MFC42(?,10008058,?,?), ref: 1000158E
#6199.MFC42(?,?), ref: 100015A3
#6199.MFC42(?,?,?), ref: 100015B5
#860.MFC42(10008798,?,?,?), ref: 100015C3
#2818.MFC42(10008798,10008058,?,10008798,?,?,?), ref: 100015E0
#6199.MFC42(?,10008798,?,?,?), ref: 100015F3
#860.MFC42(10008798,?,10008798,?,?,?), ref: 10001601
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,?,?), ref: 1000161E
#941.MFC42( ** BETA ** ,10008798,?,10008798,?,?,?), ref: 10001639
#6199.MFC42(?,10008798,?,10008798,?,?,?), ref: 10001649
SendMessageA.USER32(?,00000170,?,00000000), ref: 1000166A
#860.MFC42(10008798,?,10008798,?,10008798,?,?,?), ref: 10001675
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,?,?), ref: 10001692
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016A5
#860.MFC42(10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016B3
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016D0
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016E3
#860.MFC42(PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016F1
GetModuleHandleA.KERNEL32(?,PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016FB
#2919.MFC42(00000100,00000000), ref: 1000170B
_GetAppVersion@8.PSABOUT(00000000,00000100,00000000), ref: 10001711
#926.MFC42(?,ProSoft About Version : ,?,00000000), ref: 10001729
#858.MFC42 ref: 1000173B
#800.MFC42 ref: 10001749
#6199.MFC42(?), ref: 10001759
#860.MFC42(10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001775
#2818.MFC42(?,10008058,00000000,10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001798
#6199.MFC42(?), ref: 100017AD
#2818.MFC42(?,10008058,?,?), ref: 100017C6
#535.MFC42(?,?,?), ref: 100017D9

Part of subcall function 100030F0: #858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
Part of subcall function 100030F0: IsWindow.USER32(?), ref: 10003129
Part of subcall function 100030F0: #6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
Part of subcall function 100030F0: #800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

#800.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000180E

Strings

PSAbout.dll, xrefs: 100016E8
About %s, xrefs: 1000152E
ProSoft About Version : , xrefs: 10001723
** BETA ** , xrefs: 10001630

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#2818$#6199$#860$#800$MessageSendWindow$#858Rect$#1641#2860#2919#4710#535#537#540#6197#6358#926#939CreateFontHandleIndirectModuleObjectVersion@8
String ID: ** BETA ** $About %s$PSAbout.dll$ProSoft About Version :
API String ID: 3958394562-2501452965
Opcode ID: 93a61c409d91f74adb62bd33cdf8a781a3db4ebdfbefdad8c7220e47ed2a5d1a
Instruction ID: f28686d8da41217129008f13a01225032e64cb8ff28e48d6fc26cba87298445a
Opcode Fuzzy Hash: 93a61c409d91f74adb62bd33cdf8a781a3db4ebdfbefdad8c7220e47ed2a5d1a
Instruction Fuzzy Hash: EFB170B4204B41ABE715CB20CC91FAB73E9FB94684F05891CF5969728ADF31FA08CB55

Function 10001830 Relevance: 66.6, APIs: 22, Strings: 16, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
#860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
#941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
#941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
#941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
#941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
#941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
#941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
#941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
#941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
#2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
#860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
#939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
#941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
#941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
#941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
#941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
#941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
#941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
#941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
#941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
#800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

Strings

Unauthorized reproduction or distribution, xrefs: 1000193D
Bakersfield, CA 93309 USA., xrefs: 1000187E
5201 Truxtun Avenue, 3rd Floor, xrefs: 10001872
permissible under the law., xrefs: 1000196D
2004-2009, xrefs: 1000184A
of this program, or any portion of it, may, xrefs: 10001949
Phone: +1 661-716-5100, xrefs: 10001896
Fax: +1 661-716-5101, xrefs: 100018A2
Web: www.prosoft-technology.com , xrefs: 100018BA
ProSoft Technology, Inc., xrefs: 1000185E
e-mail: prosoft@prosoft-technology.com , xrefs: 100018C6
and will be prosecuted to the maximum extent, xrefs: 10001961
result in severe civil and criminal penalties,, xrefs: 10001955
ProSoft Technology Inc. , xrefs: 10001919
copyright law and international treaties., xrefs: 10001931
This computer program is protected by, xrefs: 10001925

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#860$#2818#537#800#939
String ID: This computer program is protected by$ 5201 Truxtun Avenue, 3rd Floor$ Bakersfield, CA 93309 USA.$ Fax: +1 661-716-5101$ Phone: +1 661-716-5100$ ProSoft Technology Inc. $ ProSoft Technology, Inc.$ Unauthorized reproduction or distribution$ Web: www.prosoft-technology.com $ and will be prosecuted to the maximum extent$ copyright law and international treaties.$ e-mail: prosoft@prosoft-technology.com $ of this program, or any portion of it, may$ permissible under the law.$ result in severe civil and criminal penalties,$2004-2009
API String ID: 560914698-2702941522
Opcode ID: 3e8686c33e3dff9c0c9880628ee8c3a3c2ef0ead8f0d71cde7fdfe506ad94cfd
Instruction ID: 91c8ed7013d054164af58b362b1f26a6fbb61d5f425d44fa41214922a166be22
Opcode Fuzzy Hash: 3e8686c33e3dff9c0c9880628ee8c3a3c2ef0ead8f0d71cde7fdfe506ad94cfd
Instruction Fuzzy Hash: 473161B4340D9067F909E7188C26AFD6355EF919D2F43451CB3A16728FCF246B1A838E

Function 10003970 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6467.MFC42(00000000), ref: 1000399D
#268.MFC42(00000000), ref: 100039AC

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 100039D3
#800.MFC42(00000000,00000000), ref: 10003A07
#795.MFC42(00000000,00000000), ref: 10003A31
#795.MFC42(00000000,00000000), ref: 10003A40
#795.MFC42(00000000,00000000), ref: 10003A4F
#795.MFC42(00000000,00000000), ref: 10003A5E
#795.MFC42(00000000,00000000), ref: 10003A6D
#795.MFC42(00000000,00000000), ref: 10003A7C
#795.MFC42(00000000,00000000), ref: 10003A8B
#795.MFC42(00000000,00000000), ref: 10003A9A
#795.MFC42(00000000,00000000), ref: 10003AA9
#609.MFC42(00000000,00000000), ref: 10003AB8
#641.MFC42(00000000,00000000), ref: 10003AC6
#1567.MFC42(00000000,00000000), ref: 10003ACF
#800.MFC42(00000000,00000000), ref: 10003A13

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003B08
#800.MFC42(00000000,00000000), ref: 10003B14
#795.MFC42(00000000,00000000), ref: 10003B32
#795.MFC42(00000000,00000000), ref: 10003B41
#795.MFC42(00000000,00000000), ref: 10003B50
#795.MFC42(00000000,00000000), ref: 10003B5F
#795.MFC42(00000000,00000000), ref: 10003B6E
#795.MFC42(00000000,00000000), ref: 10003B7D
#795.MFC42(00000000,00000000), ref: 10003B8C
#795.MFC42(00000000,00000000), ref: 10003B9B
#795.MFC42(00000000,00000000), ref: 10003BAA
#609.MFC42(00000000,00000000), ref: 10003BB9
#641.MFC42(00000000,00000000), ref: 10003BC7
#1567.MFC42(00000000,00000000), ref: 10003BD0

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

d, xrefs: 10003AE9
, xrefs: 10003AF8

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: f96246d92a9d399ea99a5f6e59495f02cc615287c8b5f0f27101b9d0d2c91858
Instruction ID: ba9fdb3c8c69b1efcd9dc3c0e08e9eba6e85a8a60e063a58fc3de4da0faa40ac
Opcode Fuzzy Hash: f96246d92a9d399ea99a5f6e59495f02cc615287c8b5f0f27101b9d0d2c91858
Instruction Fuzzy Hash: 7871377880618CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA36

Function 10002D40 Relevance: 31.6, APIs: 21, Instructions: 126
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3797.MFC42 ref: 10002D5E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 10002D75
#3874.MFC42(?), ref: 10002D8B
#540.MFC42(?), ref: 10002D94
#3874.MFC42(?), ref: 10002DA8
#6199.MFC42(?,?), ref: 10002DBD
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 10002DCC
#2860.MFC42(00000000), ref: 10002DD3
GetStockObject.GDI32(00000011), ref: 10002DE6
GetStockObject.GDI32(0000000C), ref: 10002DEE
#2860.MFC42(00000000), ref: 10002DF5
GetObjectA.GDI32(?,0000003C,?), ref: 10002E07
CreateFontIndirectA.GDI32(?), ref: 10002E18
#1641.MFC42(00000000), ref: 10002E1E
CreateFontIndirectA.GDI32(?), ref: 10002E2D
#1641.MFC42(00000000), ref: 10002E33
GetClientRect.USER32(?,?), ref: 10002E58
#2122.MFC42(?,00000000), ref: 10002E66
#1088.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E78
#5277.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E7F
#800.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E90

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Object$#1641#2860#3874CreateFontIndirectStock$#1088#2122#3797#5277#540#6199#800ClientLongMessageRectSendWindow
String ID:
API String ID: 2029918275-0
Opcode ID: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction ID: c9a03a5f96910dafa03aba3819474b77990a7e9c8b104b6fd7e7a11093b1c142
Opcode Fuzzy Hash: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction Fuzzy Hash: D141CFB4204B42ABE624DB24CC85F6FB3A9EF88B90F010A0CF142972C9DF64F905C765

Function 100047D9 Relevance: 31.6, APIs: 21, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1116.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F0
#1176.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F5
#1575.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004809
#1168.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004812
#1577.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004830
#1182.MFC42(100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?), ref: 10004843
#823.MFC42(00000040,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?), ref: 1000484A
#342.MFC42(100098F8,00000000,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?), ref: 10004859
#1176.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004868
#1243.MFC42(?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?), ref: 10004870
#1243.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004887
#1176.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 1000488E
#1168.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004896
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048A9
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B0
#1577.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B5
#1253.MFC42(100098F8,00000001,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048C1
#6467.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048D6
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048DB
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048E2
#1255.MFC42(?,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048EA

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #1176$#1168#1197#1243#1570#1577$#1116#1182#1253#1255#1575#342#6467#823
String ID:
API String ID: 2007088025-0
Opcode ID: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction ID: edb89b75dec8b2219673670b66b7d6a2bc8d39bc8546632be8b72beb1c9dc777
Opcode Fuzzy Hash: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction Fuzzy Hash: 4C318FB8600244ABFB10EF61C845F5D77A4EF806E0F13C529F9255B2AADF34E941CB19

Function 10003260 Relevance: 28.7, APIs: 19, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindow.USER32(?), ref: 10003287
GetWindowRect.USER32(?,?), ref: 100032AC
GetClientRect.USER32(?,?), ref: 100032BB
#6605.MFC42(?), ref: 100032C8
GetParent.USER32(?), ref: 100032D1
#2864.MFC42(00000000), ref: 100032D8
#6880.MFC42(?,00000000), ref: 100032EA
#6880.MFC42(?,?,00000000), ref: 100032F6
#540.MFC42(00000000), ref: 100032FF
#3874.MFC42 ref: 10003313
GetDC.USER32(?), ref: 1000331C
#2859.MFC42(00000000), ref: 10003323
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 1000334B
ReleaseDC.USER32(?,?), ref: 10003371
#3797.MFC42 ref: 100033A9
InflateRect.USER32(?,00000000,?), ref: 100033D8
InflateRect.USER32(?,?,00000000), ref: 1000340D
#6197.MFC42(00000000,?,?,?,?,00000004), ref: 1000344C
#800.MFC42(00000000,?,?,?,?,00000004), ref: 1000345D

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$#6880InflateWindow$#2859#2864#3797#3874#540#6197#6605#800ClientExtentParentPoint32ReleaseText
String ID:
API String ID: 1555407671-0
Opcode ID: d2e59de0ad313e814094079131a3e4435a3ca1c7cc293d6768b7e4fa58d8ab18
Instruction ID: fad4f85ae7451d699b48dc3c23a1c9188842fcfe73b98fa0dc477d473762e04e
Opcode Fuzzy Hash: d2e59de0ad313e814094079131a3e4435a3ca1c7cc293d6768b7e4fa58d8ab18
Instruction Fuzzy Hash: 2A6129B5204341AFD744CF68CD84A6FB7E9FBC8680F454A1CF98593298DB34E9058BA2

Function 100011D0 Relevance: 22.6, APIs: 15, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 1000120F
#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001231
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001247
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001257

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001277
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001287
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001297
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012A7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012B7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012C7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012D7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012E7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012F7
#609.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001304
#641.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001313

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#2414$#800$#609#641#809
String ID:
API String ID: 2601255804-0
Opcode ID: dad1e5acd96207fcb516968db52c721e2fe89a94faa14b1906d0b7f2ef00c40b
Instruction ID: c87b3d48cd3f525f1380d43a1c8d41ca1566e881e5744a2b82a627dc5851ada9
Opcode Fuzzy Hash: dad1e5acd96207fcb516968db52c721e2fe89a94faa14b1906d0b7f2ef00c40b
Instruction Fuzzy Hash: 6C311B78108B818AE315DF64C48579ABFD4AFA5380F550C5DE4E603297CBB8624DCBA3

Function 10003480 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034A9
#2915.MFC42(00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034C4
GetWindowsDirectoryA.KERNEL32(00000000,00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034CA
#5572.MFC42(000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034D6
#941.MFC42(\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034E4
LoadLibraryA.KERNELBASE(?,\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034EE
LoadCursorA.USER32(00000000,0000006A), ref: 100034FD
CopyIcon.USER32(00000000), ref: 10003508
FreeLibrary.KERNELBASE(00000000,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003512
#800.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003524

Strings

\winhlp32.exe, xrefs: 100034DB

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad$#2915#540#5572#800#941CopyCursorDirectoryFreeIconWindows
String ID: \winhlp32.exe
API String ID: 1176994157-695620452
Opcode ID: 9bc18a9dcaf9d496de05e81099aa452c11a15a7f8f37902f5a36aa6263560667
Instruction ID: e496be142816392f4a802cf4bfc056d9d89f17a7e690c9ce2094f43ff9286023
Opcode Fuzzy Hash: 9bc18a9dcaf9d496de05e81099aa452c11a15a7f8f37902f5a36aa6263560667
Instruction Fuzzy Hash: 8011A0B5104A12ABE305DF24CC45B9BB7E8FF457A1F108A1CF562932E4DF349648CA56

Function 10001330 Relevance: 16.6, APIs: 11, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2302.MFC42(?,00000001,?), ref: 1000133F
#2302.MFC42(?,00000C81,?,?,00000001,?), ref: 10001351
#2302.MFC42(?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001363
#2302.MFC42(?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001375
#2302.MFC42(?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001387
#2302.MFC42(?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?), ref: 10001399
#2302.MFC42(?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?), ref: 100013AB
#2302.MFC42(?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?), ref: 100013BD
#2302.MFC42(?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?), ref: 100013CF
#2302.MFC42(?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?), ref: 100013E1
#2302.MFC42(?,00000BC0,?,?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?), ref: 100013F3

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #2302
String ID:
API String ID: 735948377-0
Opcode ID: 7164a37812371677f22d9e14ba1a6941cd8c28cbc93c80df03fbb858e5833c04
Instruction ID: a7bc58141b3d57b7a2f9e387017e1c6d9f08b27cbc72826201795aafa6989a29
Opcode Fuzzy Hash: 7164a37812371677f22d9e14ba1a6941cd8c28cbc93c80df03fbb858e5833c04
Instruction Fuzzy Hash: 521170B6140B407BF611DE20DC82FFBB36CEB85B8AF45441CBA8515086DFD47E059625

Function 10002C30 Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2414.MFC42 ref: 10002C64
#809.MFC42 ref: 10002C71
#2414.MFC42 ref: 10002C8A
#2414.MFC42 ref: 10002CA8
#800.MFC42 ref: 10002CBB
#795.MFC42 ref: 10002CCA

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #2414$#795#800#809
String ID:
API String ID: 1676757150-0
Opcode ID: cc5e3a9273f2020014c9eae9fbf216b3f049fc57e9afae3d7d4acf3af9f9cb91
Instruction ID: 61f50b5283f78187b9943e8254bafee2355d34d6e190acac775872f165fc4980
Opcode Fuzzy Hash: cc5e3a9273f2020014c9eae9fbf216b3f049fc57e9afae3d7d4acf3af9f9cb91
Instruction Fuzzy Hash: BF115EB51047C28FE700CF19C80070AFBE5EF95791F954A1DE0A153385CBB8A50ACF62

Function 10004900 Relevance: 9.0, APIs: 6, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,00002000), ref: 1000490E
LocalFree.KERNEL32(00000000), ref: 1000491A
#1176.MFC42 ref: 10004920
#1243.MFC42(10008868), ref: 1000492C
#1176.MFC42 ref: 1000493E
#1243.MFC42(?), ref: 10004946

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #1176#1243Local$AllocFree
String ID:
API String ID: 2308495640-0
Opcode ID: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction ID: 5589185b89f99a7ae39e63059246849f8e8e202c6ff74abfd7579a51ee7ecbbf
Opcode Fuzzy Hash: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction Fuzzy Hash: 86E092B0944311AAF620DB61CC4AF0B7AD9EF407E2F138439F104960A9CF70E440C618

Function 1000478E Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 10004793
#6467.MFC42(10008868), ref: 100047A2
#1578.MFC42(?,?,?,?,10008868), ref: 100047B7

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #1578#6467H_prolog
String ID:
API String ID: 3701988776-0
Opcode ID: 225be51d1682979de9a5a8f11b93485f42be95f4e01545b56e450a7edae2f307
Instruction ID: 8d8a2343cbf58df175da5ae398bcc65f357205776284d92b25b36d497a5dc97f
Opcode Fuzzy Hash: 225be51d1682979de9a5a8f11b93485f42be95f4e01545b56e450a7edae2f307
Instruction Fuzzy Hash: 08E0E5B9900149AFEF06DF80C942BAEBB71FF44345F108418B85526255DB76AA21DB25

Non-executed Functions

Function 100019F0 Relevance: 84.4, APIs: 47, Strings: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2379.MFC42 ref: 100019F6
GetWindowRect.USER32(?,?), ref: 10001A26
GetWindowRect.USER32(?,?), ref: 10001A34
#6880.MFC42(?), ref: 10001A3D
#6880.MFC42(?,?), ref: 10001A49
GetWindowRect.USER32(?,?), ref: 10001A92
#6880.MFC42(?), ref: 10001A9B
GetWindowRect.USER32(?,?), ref: 10001AB3
#6880.MFC42(?), ref: 10001ABC
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?), ref: 10001AD9
GetWindowRect.USER32(?,?), ref: 10001AF6
#6880.MFC42(?,?,00000000,00000000,00000005,?), ref: 10001AFF
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B1C
GetWindowRect.USER32(?,?), ref: 10001B33
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B3C
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001B5A
GetWindowRect.USER32(?,?), ref: 10001B7D
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B86
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BA4
GetWindowRect.USER32(?,?), ref: 10001BB5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BBE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BE3
GetWindowRect.USER32(?,?), ref: 10001BF4
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BFD
GetWindowRect.USER32(?,?), ref: 10001C20
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C29
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001C47
GetWindowRect.USER32(?,?), ref: 10001C7A
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C83
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001CA8
GetWindowRect.USER32(?,?), ref: 10001CB9
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CC2
GetWindowRect.USER32(?,?), ref: 10001CE5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CEE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D0C
#6215.MFC42(00000000,6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000), ref: 10001D1B
GetWindowRect.USER32(?,?), ref: 10001D3E
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D47
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D75
GetWindowRect.USER32(?,?), ref: 10001D92
#6880.MFC42(?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D9B
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005), ref: 10001DC5
GetWindowRect.USER32(?,?), ref: 10001DE8
#6880.MFC42(?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?), ref: 10001DF1
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,?,?,00000004,?,?,?,?,00000004), ref: 10001E17
GetWindowRect.USER32(?,?), ref: 10001E37
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006,?,00000000,00000000,00000005,?,?,?,?,00000004,?), ref: 10001E5C

Strings

VUUU, xrefs: 10001A58

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: RectWindow$#6880$#6197$#2379#6215
String ID: VUUU
API String ID: 1101919440-2040033107
Opcode ID: 13b8e8da2f769331353385238693a4145235e3055610f624813af9cb8230173c
Instruction ID: 5a31ff0520036d38cb31330b8b9511fc0d41158ddc336ad14b2b1ef2a9cc197e
Opcode Fuzzy Hash: 13b8e8da2f769331353385238693a4145235e3055610f624813af9cb8230173c
Instruction Fuzzy Hash: D9D120B52147019FE314CF24CC95FABB7E9EBD8B84F104A1CB58687296EA30F905CB95

Function 10004090 Relevance: 66.7, APIs: 35, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42 ref: 100040B4
#537.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040C9
#540.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040D5
#6467.MFC42(00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040E7
#860.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040F8
#268.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004100
#2915.MFC42(00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004111
GetModuleFileNameA.KERNEL32(?,00000000,00000100,00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004120
#2915.MFC42(00000000), ref: 1000412A
GetFileVersionInfoSizeA.VERSION(00000000,?,00000000), ref: 10004134
#823.MFC42(00000000,00000000,?,00000000), ref: 10004144
#2915.MFC42(00000000), ref: 10004152
GetFileVersionInfoA.VERSION(00000000,?,00000000,00000000,00000000), ref: 1000415E
GetLastError.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 10004169
#2915.MFC42(00000000,00000000,?,00000000,00000000,00000000), ref: 10004180
VerQueryValueA.VERSION(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000418F
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000419A
#2818.MFC42(?,10008058,?,00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 100041B9
#825.MFC42(00000000,00000000,00000000,00000000), ref: 100041C6
#6877.MFC42(100086C4,100086C8,00000000,?,00000000), ref: 100041E0
#5683.MFC42(0000002E,100086C4,100086C8,00000000,?,00000000), ref: 100041F3
#5710.MFC42(?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004213
#4129.MFC42(?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004226
#924.MFC42(?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004239
#922.MFC42(?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004248
#858.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004255
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004261
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 1000426D
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004279
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004285
#2915.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 1000428F
#1567.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042BB
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042D5
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042E1
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042F0

Strings

GetFileVersionInfo Error is %d, xrefs: 10004173, 100041A4
\StringFileInfo\040904B0\ProductVersion, xrefs: 100040BB
Build , xrefs: 1000422B

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#2915$File$#540ErrorInfoLastVersion$#1567#268#2818#4129#537#5683#5710#6467#6877#823#825#858#860#922#924ModuleNameQuerySizeValue
String ID: Build $GetFileVersionInfo Error is %d$\StringFileInfo\040904B0\ProductVersion
API String ID: 2403904333-2205515449
Opcode ID: 32ee173fd4bfab7e9fd2f4364ef36033f116338a373bc0aea6c9cddcc8ed7950
Instruction ID: fe3a53cdd048ef3aad4013630a4a48c8c662586e619284a4b3165d18e955ce92
Opcode Fuzzy Hash: 32ee173fd4bfab7e9fd2f4364ef36033f116338a373bc0aea6c9cddcc8ed7950
Instruction Fuzzy Hash: AD71A3B5801149AAEB04DBE4CD81EEFBB78EF15280F114158F90673286DF746B09C776

Function 10002620 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 313windowCOMMON

Download Yara Rule

APIs

#470.MFC42 ref: 10002646
#323.MFC42 ref: 10002673
GetClientRect.USER32(?,?), ref: 1000268F
#5788.MFC42(?), ref: 10002699
#5794.MFC42(00000007,?), ref: 100026A6
Rectangle.GDI32(?,?,?,?,?), ref: 100026C9
#5788.MFC42(00000000), ref: 100026D4
#5788.MFC42(00000000,00000000), ref: 100026DE
CreateCompatibleDC.GDI32(?), ref: 100026FD
#1640.MFC42(00000000), ref: 10002708
SendMessageA.USER32(?,00000172,00000000,?), ref: 1000272E
GetClientRect.USER32(?,?), ref: 10002740
#5785.MFC42(?,?), ref: 10002752
MulDiv.KERNEL32(?,?,?), ref: 1000279E
MulDiv.KERNEL32(?,?,?), ref: 100027CB
StretchBlt.GDI32(?,?,00000000,00000000,?,?,100064FC,100064FC,?,?,00CC0020), ref: 10002831
#5785.MFC42(?,?), ref: 10002848
#2405.MFC42(?,?), ref: 10002851
GetClientRect.USER32(?,?), ref: 10002865
GetClientRect.USER32(?,?), ref: 10002870
MulDiv.KERNEL32(?,?,00000064), ref: 1000288C
MulDiv.KERNEL32(?,?,00000064), ref: 100028A6
#6172.MFC42(00FFFFFF), ref: 100028B5
#5875.MFC42(00000001,00FFFFFF), ref: 100028C0
DrawTextA.USER32(?,?,000000FF,?,00000020), ref: 100028DD
DrawTextA.USER32(?,?,000000FF,?,00000420), ref: 100028F4
GetWindowRect.USER32(?,?), ref: 10002902
#6880.MFC42(?), ref: 1000290F
#6172.MFC42(00FFFFFF,?), ref: 1000296D
#5875.MFC42(00000001,00FFFFFF,?), ref: 10002978
DrawTextA.USER32(?,?,000000FF,?,?), ref: 1000299A
#640.MFC42 ref: 100029A8
#2414.MFC42 ref: 100029C1
#755.MFC42 ref: 100029DD

Strings

gfff, xrefs: 1000291E

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#5788DrawText$#5785#5875#6172$#1640#2405#2414#323#470#5794#640#6880#755CompatibleCreateMessageRectangleSendStretchWindow
String ID: gfff
API String ID: 1747922241-1553575800
Opcode ID: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction ID: de8d7cd43940ff7d5f440d9c982899baa02ad0d10f146baf563ef8a33310dbb5
Opcode Fuzzy Hash: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction Fuzzy Hash: ADC125B52087459FE314DF69C884E6BBBE9FBC8740F114A1CF59583299DB70E809CB62

Function 100035B0 Relevance: 61.3, APIs: 20, Strings: 15, Instructions: 99COMMON

Download Yara Rule

APIs

#540.MFC42(?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035CB
#860.MFC42(The operating system is outof memory or resources.,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035FD
#860.MFC42(The specified path was not found.,The specified file was not found.), ref: 10003610
#860.MFC42(The specified file was not found.), ref: 10003623
#860.MFC42(The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003636
#860.MFC42(The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003649
#860.MFC42(The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000365C
#860.MFC42(The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000366F
#860.MFC42(The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000367F
#860.MFC42(The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000368F
#860.MFC42(The specified dynamic-link library was not found.,There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000369F
#860.MFC42(There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036AF
#860.MFC42(There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036BF
#860.MFC42(A sharing violation occurred. ,The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036CF
#2818.MFC42(?,Unknown Error (%d) occurred.,?,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100036DF
#926.MFC42(?,Unable to open hyperlink:,?), ref: 100036F6
#858.MFC42(?,?,?,?,?,?,00000005), ref: 10003705
#800.MFC42(?,?,?,?,?,?,00000005), ref: 10003713
#1200.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003721
#800.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003732

Strings

The operating system deniedaccess to the specified file., xrefs: 10003640
There is no application associatedwith the given filename extension., xrefs: 100036A6
The filename association isincomplete or invalid., xrefs: 10003653
The operating system is outof memory or resources., xrefs: 100035F4
There was not enough memory to complete the operation., xrefs: 100036B6
Unable to open hyperlink:, xrefs: 100036F0
The specified file was not found., xrefs: 1000361A
The specified path was not found., xrefs: 10003607
A sharing violation occurred. , xrefs: 100036C6
The specified dynamic-link library was not found., xrefs: 10003696
The DDE transaction failed., xrefs: 10003676
The DDE transaction could notbe completed because other DDE transactionswere being processed., xrefs: 10003666
Unknown Error (%d) occurred., xrefs: 100036D9
The .EXE file is invalid(non-Win32 .EXE or error in .EXE image)., xrefs: 1000362D
The DDE transaction could notbe completed because the request timed out., xrefs: 10003686

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #860$#800$#1200#2818#540#858#926
String ID: A sharing violation occurred. $The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).$The DDE transaction could notbe completed because other DDE transactionswere being processed.$The DDE transaction could notbe completed because the request timed out.$The DDE transaction failed.$The filename association isincomplete or invalid.$The operating system deniedaccess to the specified file.$The operating system is outof memory or resources.$The specified dynamic-link library was not found.$The specified file was not found.$The specified path was not found.$There is no application associatedwith the given filename extension.$There was not enough memory to complete the operation.$Unable to open hyperlink:$Unknown Error (%d) occurred.
API String ID: 346542042-3273680174
Opcode ID: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction ID: bf864e296dc8769b1736225a429bb83c06595c96c86935583d96534d00f8651e
Opcode Fuzzy Hash: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction Fuzzy Hash: F131A2B8018A41BBF215CB14CC62AAF7798FB902C1F01C91CB5D5521AADF33674DC79A

Function 10003C10 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

#6467.MFC42(00000000), ref: 10003C3D
#268.MFC42(00000000), ref: 10003C4C

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 10003C79
#800.MFC42(00000000,00000000), ref: 10003CAD
#795.MFC42(00000000,00000000), ref: 10003CD7
#795.MFC42(00000000,00000000), ref: 10003CE6
#795.MFC42(00000000,00000000), ref: 10003CF5
#795.MFC42(00000000,00000000), ref: 10003D04
#795.MFC42(00000000,00000000), ref: 10003D13
#795.MFC42(00000000,00000000), ref: 10003D22
#795.MFC42(00000000,00000000), ref: 10003D31
#795.MFC42(00000000,00000000), ref: 10003D40
#795.MFC42(00000000,00000000), ref: 10003D4F
#609.MFC42(00000000,00000000), ref: 10003D5E
#641.MFC42(00000000,00000000), ref: 10003D6C
#1567.MFC42(00000000,00000000), ref: 10003D75
#800.MFC42(00000000,00000000), ref: 10003CB9

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003DAE
#800.MFC42(00000000,00000000), ref: 10003DBA
#795.MFC42(00000000,00000000), ref: 10003DD8
#795.MFC42(00000000,00000000), ref: 10003DE7
#795.MFC42(00000000,00000000), ref: 10003DF6
#795.MFC42(00000000,00000000), ref: 10003E05
#795.MFC42(00000000,00000000), ref: 10003E14
#795.MFC42(00000000,00000000), ref: 10003E23
#795.MFC42(00000000,00000000), ref: 10003E32
#795.MFC42(00000000,00000000), ref: 10003E41
#795.MFC42(00000000,00000000), ref: 10003E50
#609.MFC42(00000000,00000000), ref: 10003E5F
#641.MFC42(00000000,00000000), ref: 10003E6D
#1567.MFC42(00000000,00000000), ref: 10003E76

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

d, xrefs: 10003D8F
, xrefs: 10003D9E

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: abdf16cb99a6040cd5e7d5cf6443c83e17ee6977e6b5c334444fcb95e889432d
Instruction ID: ce90d30b60a23b1df5e22dc6523357bb231baf84ee5b8182cc3d66bcb1d629aa
Opcode Fuzzy Hash: abdf16cb99a6040cd5e7d5cf6443c83e17ee6977e6b5c334444fcb95e889432d
Instruction Fuzzy Hash: C771477880628CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA32

Function 10002250 Relevance: 52.6, APIs: 25, Strings: 5, Instructions: 148windowtimeCOMMON

Download Yara Rule

APIs

#4710.MFC42(?,?,?,?,10004ED8,000000FF), ref: 1000226A
#540.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002273
#2860.MFC42(?,?,?,?,?,10004ED8,000000FF), ref: 1000228E
#823.MFC42(00000008,?,?,?,?,10004ED8,000000FF), ref: 1000229D
#1146.MFC42(00000899,00000002,00000899), ref: 100022C3
LoadBitmapA.USER32(00000000,00000899), ref: 100022C9
#1641.MFC42(00000000), ref: 100022D2
#6215.MFC42(00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022ED
#6215.MFC42(00000005,00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022FA
#6215.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002311
#6215.MFC42(00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000231E
#860.MFC42(10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002332
#860.MFC42(10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002341
#2818.MFC42(?,10008058,?,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000235B
#860.MFC42(10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000236C
#2818.MFC42(?,Version: %s,?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002386
#939.MFC42(?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002395
CreateSolidBrush.GDI32(?), ref: 100023A1
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023AB
CreateSolidBrush.GDI32(00000000), ref: 100023B4
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023BE
#860.MFC42(Error No Data,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023CA
SetTimer.USER32(?,00000001,00000BB8,00000000), ref: 100023D8
#4224.MFC42(could not Start Splash Timmer,ProSoft,00000000,?,?,?,?,10004ED8,000000FF), ref: 100023F4
#800.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002416

Strings

could not Start Splash Timmer, xrefs: 100023ED
This is a Beta version of this program. Not for production use and without warranty., xrefs: 10002302
ProSoft, xrefs: 100023E8
Error No Data, xrefs: 100023C3
Version: %s, xrefs: 10002380

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #6215#860$#1641$#2818BrushCreateSolid$#1146#2860#4224#4710#540#800#823#939BitmapLoadTimer
String ID: Error No Data$ProSoft$This is a Beta version of this program. Not for production use and without warranty.$Version: %s$could not Start Splash Timmer
API String ID: 514652099-906665912
Opcode ID: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction ID: 1913312f89696d600550852331e7f23b7439d3c132441fa52a7110e09bfaff39
Opcode Fuzzy Hash: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction Fuzzy Hash: 67519FB5200F00ABF215DB64CC51BAAB7E8FB58681F014918F6969729ADF34FA04CB95

Function 10003EB0 Relevance: 25.6, APIs: 17, Instructions: 104COMMON

Download Yara Rule

APIs

#6467.MFC42(00000000), ref: 10003EDD
#268.MFC42(00000000), ref: 10003EEA

Part of subcall function 10002070: #324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

#2514.MFC42(00000000,00000000), ref: 10003F12
#795.MFC42(00000000,00000000), ref: 10003F2D
#609.MFC42(00000000,00000000), ref: 10003F3C
#800.MFC42(00000000,00000000), ref: 10003F73
#800.MFC42(00000000,00000000), ref: 10003F82
#641.MFC42(00000000,00000000), ref: 10003F91
#1567.MFC42(00000000,00000000), ref: 10003F99
#609.MFC42(00000000,00000000), ref: 10003F4B

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

#795.MFC42(00000000,00000000), ref: 10003FC6
#609.MFC42(00000000,00000000), ref: 10003FD5
#609.MFC42(00000000,00000000), ref: 10003FE4
#800.MFC42(00000000,00000000), ref: 1000400C
#800.MFC42(00000000,00000000), ref: 1000401B
#641.MFC42(00000000,00000000), ref: 1000402A
#1567.MFC42(00000000,00000000), ref: 10004032

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#567$#1567#540#641#795$#2414#2514#268#324#6467
String ID:
API String ID: 39110236-0
Opcode ID: 9fb2ef23c2165d1a6595971bfa74651ef76342c7eaa86ae2efce9ac8e8beffec
Instruction ID: cfaefb5b01c91ea90e470d212f713a34359e3d9334dad7f1e11d803252a963b9
Opcode Fuzzy Hash: 9fb2ef23c2165d1a6595971bfa74651ef76342c7eaa86ae2efce9ac8e8beffec
Instruction Fuzzy Hash: 904181B8C05299DAEB10DBA4C9417EDFBB0EF15340F1080E9D54923786DF792B48DB66

Function 10001000 Relevance: 22.6, APIs: 15, Instructions: 97COMMON

Download Yara Rule

APIs

#324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111

Part of subcall function 10002B50: #567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
Part of subcall function 10002B50: #540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
Part of subcall function 10002B50: #556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
Part of subcall function 10002B50: #2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
CreateSolidBrush.GDI32(000000FF), ref: 1000117B
#1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#1641#2614#324#556BrushCreateSolid
String ID:
API String ID: 862247804-0
Opcode ID: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction ID: ef8ebbcba9a2f6dd6cb2c20b7593ac1494135993400dd6ceca74427708b28424
Opcode Fuzzy Hash: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction Fuzzy Hash: B74142B4104B829BE311CF24CC8076ABB96FF99381F650C1CE0951B796DBB87549CB92

Function 100037B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 87stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,?), ref: 100037D7

Part of subcall function 10003540: RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
Part of subcall function 10003540: RegQueryValueA.ADVAPI32 ref: 1000357E
Part of subcall function 10003540: lstrcpyA.KERNEL32(?,00000000), ref: 10003591
Part of subcall function 10003540: RegCloseKey.ADVAPI32(?), ref: 1000359C

lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?), ref: 10003816
_mbsstr.MSVCRT ref: 10003842
_mbsstr.MSVCRT ref: 10003857
lstrlenA.KERNEL32(?), ref: 10003867
lstrcatA.KERNEL32(00000000,1000866C), ref: 1000387C
lstrcatA.KERNEL32(00000000,?), ref: 10003887
WinExec.KERNEL32(?,?), ref: 1000388F

Strings

\shell\open\command, xrefs: 10003810
.htm, xrefs: 100037ED
open, xrefs: 100037CE
"%1", xrefs: 1000383C

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$_mbsstr$CloseExecExecuteOpenQueryShellValuelstrcpylstrlen
String ID: "%1"$.htm$\shell\open\command$open
API String ID: 729890978-1533145997
Opcode ID: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction ID: bfa4e36c36e67bfdf65cedbb39ad291800a273508fa034cc737e01779e384aa2
Opcode Fuzzy Hash: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction Fuzzy Hash: 9A21C1325443556BF321EB60CC84FAFB39CFB84291F15891DFB9093144EB25E90987A6

Function 10002440 Relevance: 13.6, APIs: 9, Instructions: 140windowCOMMON

Download Yara Rule

APIs

#2860.MFC42(?,?), ref: 10002453
SendMessageA.USER32(?,00000172,00000000,?), ref: 10002481
GetClientRect.USER32(?,?), ref: 10002499
GetClientRect.USER32(?,?), ref: 100024A4
GetWindowRect.USER32(?,?), ref: 100024AF
SetRect.USER32(00000000,00000000,00000000,00000000,00000000), ref: 100024C2
#6605.MFC42(?,?), ref: 1000252E
OffsetRect.USER32(?,?,?), ref: 10002581
#4299.MFC42(?,?,?,?,00000001), ref: 100025A3

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#2860#4299#6605MessageOffsetSendWindow
String ID:
API String ID: 1591621576-0
Opcode ID: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction ID: cea368ed319ff426ac7cae26e22c5591117dddf13591c75ce779038945222747
Opcode Fuzzy Hash: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction Fuzzy Hash: 71411A713047019FD708CF39CD95A6BB7EAFBC8680F198A2CB585C3259DA70F9058A55

Function 10002FD0 Relevance: 12.1, APIs: 8, Instructions: 60windowtimeCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 10002FD6
ScreenToClient.USER32(?,?), ref: 10002FF6
GetClientRect.USER32(?,?), ref: 10003005
PtInRect.USER32(?,?,?), ref: 1000301A
KillTimer.USER32(?,?), ref: 10003032
SendMessageA.USER32(?,00000030,?,00000001), ref: 10003051
InvalidateRect.USER32(?,?,00000001), ref: 1000306D
#2379.MFC42 ref: 10003075

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$ClientMessage$#2379InvalidateKillScreenSendTimer
String ID:
API String ID: 173336095-0
Opcode ID: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction ID: 76f8f83f127ebf74195a72dad42daeb95907ffedfed5679e39fce6817e511657
Opcode Fuzzy Hash: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction Fuzzy Hash: CB1103B4504711AFE314DF64CC98E6BB7E9FB88B81F04890DF98683254EB75E904CB91

Function 10002150 Relevance: 10.5, APIs: 7, Instructions: 41COMMON

Download Yara Rule

APIs

#795.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000217E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000218E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000219E
#2414.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021B7
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021CA
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021D7
#641.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021E6

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#2414#641#795
String ID:
API String ID: 1303925036-0
Opcode ID: 9c0007cf5b19ab8dec9855f64950081603fe9d25d0220f3b38a78263db54cccf
Instruction ID: f5c4544bc7a3faee989b476a257d09b4c225558fe38a2fb961692ad6650ff4c0
Opcode Fuzzy Hash: 9c0007cf5b19ab8dec9855f64950081603fe9d25d0220f3b38a78263db54cccf
Instruction Fuzzy Hash: 411130B5004B818EE315DF28C84174AFBE4FFA5790F55091DE4A643796CFB8614DCBA2

Function 10002070 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

#324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#324
String ID:
API String ID: 2217935779-0
Opcode ID: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction ID: 0e0f615a265ac9c9a9ef4592cef02d40833f3a3893898f0605a6b53120fdffae
Opcode Fuzzy Hash: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction Fuzzy Hash: 82114CB5104B818BE311CF148C8075AFBE5FB99781F510C1DE19647796DBB8A548CB92

Function 10002A00 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 10002A06
GetClientRect.USER32(?,?), ref: 10002A30
GetWindowRect.USER32(?,?), ref: 10002A42
#4299.MFC42(?,?,?,?,00000001), ref: 10002A85
#4299.MFC42(?,?,?,?,00000001,?,?,?,?,00000001), ref: 10002AB3

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #4299Rect$#2379ClientWindow
String ID:
API String ID: 2463140695-0
Opcode ID: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction ID: 7fd873ad5859924dc3e9645bdb9b098ce72c68c189247eaef3a9cf332acd70ce
Opcode Fuzzy Hash: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction Fuzzy Hash: 9F212F75304705AFD708DE78CD94E6BB7EAFBC8244F058A2DB84583249DA70F909C6A2

Function 100049BA Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 100049E8
_initterm.MSVCRT ref: 10004A13
free.MSVCRT ref: 10004A50

Strings

kGu0EAu, xrefs: 100049D0

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID: kGu0EAu
API String ID: 1678931842-451212217
Opcode ID: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction ID: 6e6ce05fc65f6857befb30b960dddb25c0f056c42b7287eed7d5b62f4f9fe03b
Opcode Fuzzy Hash: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction Fuzzy Hash: 3D113CB27462229FF714DF68DD84B5637E5FB493D1B22402DE801C716CEB719A00CB59

Function 10002B50 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

#567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
#540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
#556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
#2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #2614#540#556#567
String ID:
API String ID: 4066608244-0
Opcode ID: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction ID: 5380fbfe1f13ce258253e983e879f2a7423347c2a2865734c5e17ac8d5c15826
Opcode Fuzzy Hash: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction Fuzzy Hash: 97112BB0500B91CFE320CF1AC844356FBE5FB45754F900E2EE19687B95DBB9A444CB91

Function 100030F0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

#858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
IsWindow.USER32(?), ref: 10003129
#6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
#800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #6358#800#858Window
String ID:
API String ID: 1255164923-0
Opcode ID: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction ID: a14bf695a60021346b265786ca639e55b1935be1e887f5c80a4f76400b1b17f4
Opcode Fuzzy Hash: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction Fuzzy Hash: 0E01A272104A519BD311CF14C841B9B73E8FB49BA0F008A1DF16683584DB74A808CB62

Function 10003540 Relevance: 6.0, APIs: 4, Instructions: 35registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
RegQueryValueA.ADVAPI32 ref: 1000357E
lstrcpyA.KERNEL32(?,00000000), ref: 10003591
RegCloseKey.ADVAPI32(?), ref: 1000359C

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValuelstrcpy
String ID:
API String ID: 534897748-0
Opcode ID: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction ID: 31d2930b61c82b42a2fde46d1cefe9ce52522f5b9b535180cdc1a6a6f7b1b038
Opcode Fuzzy Hash: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction Fuzzy Hash: F3F04F75144312BFE320CB10CC89FABBBA9EBC8790F10C90CF98982254D670D844CBA2

Function 10002F70 Relevance: 6.0, APIs: 4, Instructions: 35windowtimeCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 10002F9C
InvalidateRect.USER32(?,00000000,00000001), ref: 10002FAA
SetTimer.USER32(?,?,00000064,00000000), ref: 10002FBF
#2379.MFC42 ref: 10002FC7

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #2379InvalidateMessageRectSendTimer
String ID:
API String ID: 920896690-0
Opcode ID: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction ID: 2dcf2f78edcbb6a6aeec61f8ec110639963feb333860edce5202acada731f870
Opcode Fuzzy Hash: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction Fuzzy Hash: CBF0E775210711ABE730CB65CC85F56B3E9BB4C790F114A19F686D76C4D6B1F9408B50

Function 1000431C Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

#1567.MFC42 ref: 10004320
#800.MFC42 ref: 10004335
#800.MFC42 ref: 10004341
#800.MFC42 ref: 10004350

Memory Dump Source

Source File: 00000013.00000002.1633152115.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000013.00000002.1633127993.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633192470.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1633214564.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000013.00000002.1635455487.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#1567
String ID:
API String ID: 3194870385-0
Opcode ID: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction ID: e8ea892de69bcb9610e0c8c3a5f6cf03a5fb7e67a11db6fafae1abe6c09cea7f
Opcode Fuzzy Hash: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction Fuzzy Hash: 14F08C79C05288DADB04CF98D1417EDFB70FB61310F1081AEC85123282CB762A0AC761

Analysis Process: rundll32.exePID: 6704, Parent PID: 7120COMMON

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	374
Total number of Limit Nodes:	11

Executed Functions

Function 10001420 Relevance: 89.6, APIs: 47, Strings: 4, Instructions: 301
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#4710.MFC42 ref: 1000143D
#540.MFC42 ref: 10001446

Part of subcall function 10001830: #537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
Part of subcall function 10001830: #860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
Part of subcall function 10001830: #941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
Part of subcall function 10001830: #941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
Part of subcall function 10001830: #941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
Part of subcall function 10001830: #941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
Part of subcall function 10001830: #941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
Part of subcall function 10001830: #941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
Part of subcall function 10001830: #941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
Part of subcall function 10001830: #941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
Part of subcall function 10001830: #2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
Part of subcall function 10001830: #860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
Part of subcall function 10001830: #939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
Part of subcall function 10001830: #941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
Part of subcall function 10001830: #941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
Part of subcall function 10001830: #941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
Part of subcall function 10001830: #941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
Part of subcall function 10001830: #941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
Part of subcall function 10001830: #941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
Part of subcall function 10001830: #941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
Part of subcall function 10001830: #941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
Part of subcall function 10001830: #800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

SendMessageA.USER32(?,00000031,00000000,00000000), ref: 1000146D
#2860.MFC42(00000000), ref: 10001470
GetObjectA.GDI32(?,0000003C,?), ref: 10001480
MulDiv.KERNEL32(?,00000003,00000002), ref: 1000148F
CreateFontIndirectA.GDI32(?), ref: 100014A4
#1641.MFC42(00000000), ref: 100014AD
SendMessageA.USER32(?,00000030,?,00000001), ref: 100014C5
GetWindowRect.USER32(?,?), ref: 100014D6
GetWindowRect.USER32(?,?), ref: 100014E4
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000150B
#2818.MFC42(?,About %s,?,6D34A098,00000000,00000000,?,?,00000006), ref: 10001534
#6199.MFC42(?), ref: 10001543
#2818.MFC42(?,10008058,?,?), ref: 10001567
#2818.MFC42(?,10008058,?,?), ref: 1000158E
#6199.MFC42(?,?), ref: 100015A3
#6199.MFC42(?,?,?), ref: 100015B5
#860.MFC42(10008798,?,?,?), ref: 100015C3
#2818.MFC42(10008798,10008058,?,10008798,?,?,?), ref: 100015E0
#6199.MFC42(?,10008798,?,?,?), ref: 100015F3
#860.MFC42(10008798,?,10008798,?,?,?), ref: 10001601
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,?,?), ref: 1000161E
#941.MFC42( ** BETA ** ,10008798,?,10008798,?,?,?), ref: 10001639
#6199.MFC42(?,10008798,?,10008798,?,?,?), ref: 10001649
SendMessageA.USER32(?,00000170,?,00000000), ref: 1000166A
#860.MFC42(10008798,?,10008798,?,10008798,?,?,?), ref: 10001675
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,?,?), ref: 10001692
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016A5
#860.MFC42(10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016B3
#2818.MFC42(10008798,10008058,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016D0
#6199.MFC42(?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016E3
#860.MFC42(PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016F1
GetModuleHandleA.KERNEL32(?,PSAbout.dll,?,10008798,?,10008798,?,10008798,?,10008798,?,?,?), ref: 100016FB
#2919.MFC42(00000100,00000000), ref: 1000170B
_GetAppVersion@8.PSABOUT(00000000,00000100,00000000), ref: 10001711
#926.MFC42(?,ProSoft About Version : ,?,00000000), ref: 10001729
#858.MFC42 ref: 1000173B
#800.MFC42 ref: 10001749
#6199.MFC42(?), ref: 10001759
#860.MFC42(10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001775
#2818.MFC42(?,10008058,00000000,10008798,6D34A098,00000000,00000000,?,?,00000006), ref: 10001798
#6199.MFC42(?), ref: 100017AD
#2818.MFC42(?,10008058,?,?), ref: 100017C6
#535.MFC42(?,?,?), ref: 100017D9

Part of subcall function 100030F0: #858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
Part of subcall function 100030F0: IsWindow.USER32(?), ref: 10003129
Part of subcall function 100030F0: #6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
Part of subcall function 100030F0: #800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

#800.MFC42(6D34A098,00000000,00000000,?,?,00000006), ref: 1000180E

Strings

About %s, xrefs: 1000152E
** BETA ** , xrefs: 10001630
PSAbout.dll, xrefs: 100016E8
ProSoft About Version : , xrefs: 10001723

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#2818$#6199$#860$#800$MessageSendWindow$#858Rect$#1641#2860#2919#4710#535#537#540#6197#6358#926#939CreateFontHandleIndirectModuleObjectVersion@8
String ID: ** BETA ** $About %s$PSAbout.dll$ProSoft About Version :
API String ID: 3958394562-2501452965
Opcode ID: 93a61c409d91f74adb62bd33cdf8a781a3db4ebdfbefdad8c7220e47ed2a5d1a
Instruction ID: f28686d8da41217129008f13a01225032e64cb8ff28e48d6fc26cba87298445a
Opcode Fuzzy Hash: 93a61c409d91f74adb62bd33cdf8a781a3db4ebdfbefdad8c7220e47ed2a5d1a
Instruction Fuzzy Hash: EFB170B4204B41ABE715CB20CC91FAB73E9FB94684F05891CF5969728ADF31FA08CB55

Function 10001830 Relevance: 66.6, APIs: 22, Strings: 16, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#537.MFC42(2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001853
#860.MFC42( ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000186D
#941.MFC42( 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001879
#941.MFC42( Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001885
#941.MFC42(10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 10001891
#941.MFC42( Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 1000189D
#941.MFC42( Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018A9
#941.MFC42(10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018B5
#941.MFC42( Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF,1000145A), ref: 100018C1
#941.MFC42( e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8,000000FF), ref: 100018CD
#2818.MFC42(?,10008058,?, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 100018F3
#860.MFC42(100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000,10004DA8), ref: 10001908
#939.MFC42(?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009,?,?,?,00000000), ref: 10001914
#941.MFC42( ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001920
#941.MFC42( This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 1000192C
#941.MFC42( copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001938
#941.MFC42( Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.,2004-2009), ref: 10001944
#941.MFC42( of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor, ProSoft Technology, Inc.), ref: 10001950
#941.MFC42( result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA., 5201 Truxtun Avenue, 3rd Floor), ref: 1000195C
#941.MFC42( and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248, Bakersfield, CA 93309 USA.), ref: 10001968
#941.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001974
#800.MFC42( permissible under the law., and will be prosecuted to the maximum extent, result in severe civil and criminal penalties,, of this program, or any portion of it, may, Unauthorized reproduction or distribution, copyright law and international treaties., This computer program is protected by, ProSoft Technology Inc. ,?,100081B0, e-mail: prosoft@prosoft-technology.com , Web: www.prosoft-technology.com ,10008798, Fax: +1 661-716-5101, Phone: +1 661-716-5100,10008248), ref: 10001985

Strings

e-mail: prosoft@prosoft-technology.com , xrefs: 100018C6
5201 Truxtun Avenue, 3rd Floor, xrefs: 10001872
ProSoft Technology Inc. , xrefs: 10001919
of this program, or any portion of it, may, xrefs: 10001949
ProSoft Technology, Inc., xrefs: 1000185E
Unauthorized reproduction or distribution, xrefs: 1000193D
copyright law and international treaties., xrefs: 10001931
and will be prosecuted to the maximum extent, xrefs: 10001961
Phone: +1 661-716-5100, xrefs: 10001896
This computer program is protected by, xrefs: 10001925
result in severe civil and criminal penalties,, xrefs: 10001955
Fax: +1 661-716-5101, xrefs: 100018A2
permissible under the law., xrefs: 1000196D
Bakersfield, CA 93309 USA., xrefs: 1000187E
2004-2009, xrefs: 1000184A
Web: www.prosoft-technology.com , xrefs: 100018BA

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #941$#860$#2818#537#800#939
String ID: This computer program is protected by$ 5201 Truxtun Avenue, 3rd Floor$ Bakersfield, CA 93309 USA.$ Fax: +1 661-716-5101$ Phone: +1 661-716-5100$ ProSoft Technology Inc. $ ProSoft Technology, Inc.$ Unauthorized reproduction or distribution$ Web: www.prosoft-technology.com $ and will be prosecuted to the maximum extent$ copyright law and international treaties.$ e-mail: prosoft@prosoft-technology.com $ of this program, or any portion of it, may$ permissible under the law.$ result in severe civil and criminal penalties,$2004-2009
API String ID: 560914698-2702941522
Opcode ID: 3e8686c33e3dff9c0c9880628ee8c3a3c2ef0ead8f0d71cde7fdfe506ad94cfd
Instruction ID: 91c8ed7013d054164af58b362b1f26a6fbb61d5f425d44fa41214922a166be22
Opcode Fuzzy Hash: 3e8686c33e3dff9c0c9880628ee8c3a3c2ef0ead8f0d71cde7fdfe506ad94cfd
Instruction Fuzzy Hash: 473161B4340D9067F909E7188C26AFD6355EF919D2F43451CB3A16728FCF246B1A838E

Function 10003C10 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#6467.MFC42(00000000), ref: 10003C3D
#268.MFC42(00000000), ref: 10003C4C

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 10003C79
#800.MFC42(00000000,00000000), ref: 10003CAD
#795.MFC42(00000000,00000000), ref: 10003CD7
#795.MFC42(00000000,00000000), ref: 10003CE6
#795.MFC42(00000000,00000000), ref: 10003CF5
#795.MFC42(00000000,00000000), ref: 10003D04
#795.MFC42(00000000,00000000), ref: 10003D13
#795.MFC42(00000000,00000000), ref: 10003D22
#795.MFC42(00000000,00000000), ref: 10003D31
#795.MFC42(00000000,00000000), ref: 10003D40
#795.MFC42(00000000,00000000), ref: 10003D4F
#609.MFC42(00000000,00000000), ref: 10003D5E
#641.MFC42(00000000,00000000), ref: 10003D6C
#1567.MFC42(00000000,00000000), ref: 10003D75
#800.MFC42(00000000,00000000), ref: 10003CB9

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003DAE
#800.MFC42(00000000,00000000), ref: 10003DBA
#795.MFC42(00000000,00000000), ref: 10003DD8
#795.MFC42(00000000,00000000), ref: 10003DE7
#795.MFC42(00000000,00000000), ref: 10003DF6
#795.MFC42(00000000,00000000), ref: 10003E05
#795.MFC42(00000000,00000000), ref: 10003E14
#795.MFC42(00000000,00000000), ref: 10003E23
#795.MFC42(00000000,00000000), ref: 10003E32
#795.MFC42(00000000,00000000), ref: 10003E41
#795.MFC42(00000000,00000000), ref: 10003E50
#609.MFC42(00000000,00000000), ref: 10003E5F
#641.MFC42(00000000,00000000), ref: 10003E6D
#1567.MFC42(00000000,00000000), ref: 10003E76

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

d, xrefs: 10003D8F
, xrefs: 10003D9E

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: 864dba5f2589cee9f34ace38c7c25b972837081295b7a0c565ecea36310cfde6
Instruction ID: ce90d30b60a23b1df5e22dc6523357bb231baf84ee5b8182cc3d66bcb1d629aa
Opcode Fuzzy Hash: 864dba5f2589cee9f34ace38c7c25b972837081295b7a0c565ecea36310cfde6
Instruction Fuzzy Hash: C771477880628CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA32

Function 10002D40 Relevance: 31.6, APIs: 21, Instructions: 126
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#3797.MFC42 ref: 10002D5E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 10002D75
#3874.MFC42(?), ref: 10002D8B
#540.MFC42(?), ref: 10002D94
#3874.MFC42(?), ref: 10002DA8
#6199.MFC42(?,?), ref: 10002DBD
SendMessageA.USER32(?,00000031,00000000,00000000), ref: 10002DCC
#2860.MFC42(00000000), ref: 10002DD3
GetStockObject.GDI32(00000011), ref: 10002DE6
GetStockObject.GDI32(0000000C), ref: 10002DEE
#2860.MFC42(00000000), ref: 10002DF5
GetObjectA.GDI32(?,0000003C,?), ref: 10002E07
CreateFontIndirectA.GDI32(?), ref: 10002E18
#1641.MFC42(00000000), ref: 10002E1E
CreateFontIndirectA.GDI32(?), ref: 10002E2D
#1641.MFC42(00000000), ref: 10002E33
GetClientRect.USER32(?,?), ref: 10002E58
#2122.MFC42(?,00000000), ref: 10002E66
#1088.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E78
#5277.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E7F
#800.MFC42(?,00000000,?,00000001,?,00000000), ref: 10002E90

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: Object$#1641#2860#3874CreateFontIndirectStock$#1088#2122#3797#5277#540#6199#800ClientLongMessageRectSendWindow
String ID:
API String ID: 2029918275-0
Opcode ID: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction ID: c9a03a5f96910dafa03aba3819474b77990a7e9c8b104b6fd7e7a11093b1c142
Opcode Fuzzy Hash: f2f77c2ac01c84055b45cd89cd9d725ac414e13b8c473ee5942127ecbc62a407
Instruction Fuzzy Hash: D141CFB4204B42ABE624DB24CC85F6FB3A9EF88B90F010A0CF142972C9DF64F905C765

Function 100047D9 Relevance: 31.6, APIs: 21, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1116.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F0
#1176.MFC42(?,?,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100047F5
#1575.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004809
#1168.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004812
#1577.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004830
#1182.MFC42(100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?), ref: 10004843
#823.MFC42(00000040,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?), ref: 1000484A
#342.MFC42(100098F8,00000000,100098F8,?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?), ref: 10004859
#1176.MFC42(?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?,?), ref: 10004868
#1243.MFC42(?,?,00000000,10008798,00000000,?,?,?,?,?,?,10004AB5,?,?,?,?), ref: 10004870
#1243.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004887
#1176.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 1000488E
#1168.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 10004896
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048A9
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B0
#1577.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048B5
#1253.MFC42(100098F8,00000001,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048C1
#6467.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048D6
#1197.MFC42(10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048DB
#1570.MFC42(000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048E2
#1255.MFC42(?,000000FF,10008868,?,?,?,?,10004AB5,?,?,?,?,?,?), ref: 100048EA

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #1176$#1168#1197#1243#1570#1577$#1116#1182#1253#1255#1575#342#6467#823
String ID:
API String ID: 2007088025-0
Opcode ID: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction ID: edb89b75dec8b2219673670b66b7d6a2bc8d39bc8546632be8b72beb1c9dc777
Opcode Fuzzy Hash: f6432b86b6d72565bbf1bd5e5c3225fbe8896e023424330d84faee1b921aa69e
Instruction Fuzzy Hash: 4C318FB8600244ABFB10EF61C845F5D77A4EF806E0F13C529F9255B2AADF34E941CB19

Function 10003260 Relevance: 28.7, APIs: 19, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindow.USER32(?), ref: 10003287
GetWindowRect.USER32(?,?), ref: 100032AC
GetClientRect.USER32(?,?), ref: 100032BB
#6605.MFC42(?), ref: 100032C8
GetParent.USER32(?), ref: 100032D1
#2864.MFC42(00000000), ref: 100032D8
#6880.MFC42(?,00000000), ref: 100032EA
#6880.MFC42(?,?,00000000), ref: 100032F6
#540.MFC42(00000000), ref: 100032FF
#3874.MFC42 ref: 10003313
GetDC.USER32(?), ref: 1000331C
#2859.MFC42(00000000), ref: 10003323
GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 1000334B
ReleaseDC.USER32(?,?), ref: 10003371
#3797.MFC42 ref: 100033A9
InflateRect.USER32(?,00000000,?), ref: 100033D8
InflateRect.USER32(?,?,00000000), ref: 1000340D
#6197.MFC42(00000000,?,?,?,?,00000004), ref: 1000344C
#800.MFC42(00000000,?,?,?,?,00000004), ref: 1000345D

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$#6880InflateWindow$#2859#2864#3797#3874#540#6197#6605#800ClientExtentParentPoint32ReleaseText
String ID:
API String ID: 1555407671-0
Opcode ID: d2e59de0ad313e814094079131a3e4435a3ca1c7cc293d6768b7e4fa58d8ab18
Instruction ID: fad4f85ae7451d699b48dc3c23a1c9188842fcfe73b98fa0dc477d473762e04e
Opcode Fuzzy Hash: d2e59de0ad313e814094079131a3e4435a3ca1c7cc293d6768b7e4fa58d8ab18
Instruction Fuzzy Hash: 2A6129B5204341AFD744CF68CD84A6FB7E9FBC8680F454A1CF98593298DB34E9058BA2

Function 100011D0 Relevance: 22.6, APIs: 15, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 1000120F
#2414.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001231
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001247
#800.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001257

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001277
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001287
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001297
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012A7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012B7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012C7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012D7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012E7
#795.MFC42(?,?,?,?,?,?,?,100011B8), ref: 100012F7
#609.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001304
#641.MFC42(?,?,?,?,?,?,?,100011B8), ref: 10001313

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#2414$#800$#609#641#809
String ID:
API String ID: 2601255804-0
Opcode ID: dad1e5acd96207fcb516968db52c721e2fe89a94faa14b1906d0b7f2ef00c40b
Instruction ID: c87b3d48cd3f525f1380d43a1c8d41ca1566e881e5744a2b82a627dc5851ada9
Opcode Fuzzy Hash: dad1e5acd96207fcb516968db52c721e2fe89a94faa14b1906d0b7f2ef00c40b
Instruction Fuzzy Hash: 6C311B78108B818AE315DF64C48579ABFD4AFA5380F550C5DE4E603297CBB8624DCBA3

Function 10003480 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 52
librarywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034A9
#2915.MFC42(00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034C4
GetWindowsDirectoryA.KERNEL32(00000000,00000104,00000104,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034CA
#5572.MFC42(000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034D6
#941.MFC42(\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034E4
LoadLibraryA.KERNELBASE(?,\winhlp32.exe,000000FF,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 100034EE
LoadCursorA.USER32(00000000,0000006A), ref: 100034FD
CopyIcon.USER32(00000000), ref: 10003508
FreeLibrary.KERNELBASE(00000000,?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003512
#800.MFC42(?,75754BC0,?,00000000,10005048,000000FF,10002E46,00000000), ref: 10003524

Strings

\winhlp32.exe, xrefs: 100034DB

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad$#2915#540#5572#800#941CopyCursorDirectoryFreeIconWindows
String ID: \winhlp32.exe
API String ID: 1176994157-695620452
Opcode ID: 9bc18a9dcaf9d496de05e81099aa452c11a15a7f8f37902f5a36aa6263560667
Instruction ID: e496be142816392f4a802cf4bfc056d9d89f17a7e690c9ce2094f43ff9286023
Opcode Fuzzy Hash: 9bc18a9dcaf9d496de05e81099aa452c11a15a7f8f37902f5a36aa6263560667
Instruction Fuzzy Hash: 8011A0B5104A12ABE305DF24CC45B9BB7E8FF457A1F108A1CF562932E4DF349648CA56

Function 10001330 Relevance: 16.6, APIs: 11, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2302.MFC42(?,00000001,?), ref: 1000133F
#2302.MFC42(?,00000C81,?,?,00000001,?), ref: 10001351
#2302.MFC42(?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001363
#2302.MFC42(?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001375
#2302.MFC42(?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?,00000001,?), ref: 10001387
#2302.MFC42(?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?,00000C81,?,?), ref: 10001399
#2302.MFC42(?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?,00000BBC,?,?), ref: 100013AB
#2302.MFC42(?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?,00000BBD,?,?), ref: 100013BD
#2302.MFC42(?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?,00000BBF,?,?), ref: 100013CF
#2302.MFC42(?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?,00000BBB,?,?), ref: 100013E1
#2302.MFC42(?,00000BC0,?,?,00000BB8,?,?,00000BBE,?,?,00000BB9,?,?,00000BBA,?,?), ref: 100013F3

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #2302
String ID:
API String ID: 735948377-0
Opcode ID: 7164a37812371677f22d9e14ba1a6941cd8c28cbc93c80df03fbb858e5833c04
Instruction ID: a7bc58141b3d57b7a2f9e387017e1c6d9f08b27cbc72826201795aafa6989a29
Opcode Fuzzy Hash: 7164a37812371677f22d9e14ba1a6941cd8c28cbc93c80df03fbb858e5833c04
Instruction Fuzzy Hash: 521170B6140B407BF611DE20DC82FFBB36CEB85B8AF45441CBA8515086DFD47E059625

Function 10002C30 Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2414.MFC42 ref: 10002C64
#809.MFC42 ref: 10002C71
#2414.MFC42 ref: 10002C8A
#2414.MFC42 ref: 10002CA8
#800.MFC42 ref: 10002CBB
#795.MFC42 ref: 10002CCA

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #2414$#795#800#809
String ID:
API String ID: 1676757150-0
Opcode ID: cc5e3a9273f2020014c9eae9fbf216b3f049fc57e9afae3d7d4acf3af9f9cb91
Instruction ID: 61f50b5283f78187b9943e8254bafee2355d34d6e190acac775872f165fc4980
Opcode Fuzzy Hash: cc5e3a9273f2020014c9eae9fbf216b3f049fc57e9afae3d7d4acf3af9f9cb91
Instruction Fuzzy Hash: BF115EB51047C28FE700CF19C80070AFBE5EF95791F954A1DE0A153385CBB8A50ACF62

Function 10004900 Relevance: 9.0, APIs: 6, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,00002000), ref: 1000490E
LocalFree.KERNEL32(00000000), ref: 1000491A
#1176.MFC42 ref: 10004920
#1243.MFC42(10008868), ref: 1000492C
#1176.MFC42 ref: 1000493E
#1243.MFC42(?), ref: 10004946

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #1176#1243Local$AllocFree
String ID:
API String ID: 2308495640-0
Opcode ID: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction ID: 5589185b89f99a7ae39e63059246849f8e8e202c6ff74abfd7579a51ee7ecbbf
Opcode Fuzzy Hash: d5d482ad674d6df58614e2d58fea891a61ad99bf8225239012e0e47ce051c14c
Instruction Fuzzy Hash: 86E092B0944311AAF620DB61CC4AF0B7AD9EF407E2F138439F104960A9CF70E440C618

Function 1000478E Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 10004793
#6467.MFC42(10008868), ref: 100047A2
#1578.MFC42(?,?,?,?,10008868), ref: 100047B7

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #1578#6467H_prolog
String ID:
API String ID: 3701988776-0
Opcode ID: 225be51d1682979de9a5a8f11b93485f42be95f4e01545b56e450a7edae2f307
Instruction ID: 8d8a2343cbf58df175da5ae398bcc65f357205776284d92b25b36d497a5dc97f
Opcode Fuzzy Hash: 225be51d1682979de9a5a8f11b93485f42be95f4e01545b56e450a7edae2f307
Instruction Fuzzy Hash: 08E0E5B9900149AFEF06DF80C942BAEBB71FF44345F108418B85526255DB76AA21DB25

Non-executed Functions

Function 100019F0 Relevance: 84.4, APIs: 47, Strings: 1, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#2379.MFC42 ref: 100019F6
GetWindowRect.USER32(?,?), ref: 10001A26
GetWindowRect.USER32(?,?), ref: 10001A34
#6880.MFC42(?), ref: 10001A3D
#6880.MFC42(?,?), ref: 10001A49
GetWindowRect.USER32(?,?), ref: 10001A92
#6880.MFC42(?), ref: 10001A9B
GetWindowRect.USER32(?,?), ref: 10001AB3
#6880.MFC42(?), ref: 10001ABC
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?), ref: 10001AD9
GetWindowRect.USER32(?,?), ref: 10001AF6
#6880.MFC42(?,?,00000000,00000000,00000005,?), ref: 10001AFF
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B1C
GetWindowRect.USER32(?,?), ref: 10001B33
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B3C
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001B5A
GetWindowRect.USER32(?,?), ref: 10001B7D
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001B86
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BA4
GetWindowRect.USER32(?,?), ref: 10001BB5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BBE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001BE3
GetWindowRect.USER32(?,?), ref: 10001BF4
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001BFD
GetWindowRect.USER32(?,?), ref: 10001C20
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C29
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001C47
GetWindowRect.USER32(?,?), ref: 10001C7A
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001C83
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001CA8
GetWindowRect.USER32(?,?), ref: 10001CB9
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CC2
GetWindowRect.USER32(?,?), ref: 10001CE5
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001CEE
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D0C
#6215.MFC42(00000000,6D34A098,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000), ref: 10001D1B
GetWindowRect.USER32(?,?), ref: 10001D3E
#6880.MFC42(?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D47
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005), ref: 10001D75
GetWindowRect.USER32(?,?), ref: 10001D92
#6880.MFC42(?,?,?,?,00000004,?,?,00000000,00000000,00000005,?,?,00000000,00000000,00000005,?), ref: 10001D9B
#6197.MFC42(6D34A098,?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005), ref: 10001DC5
GetWindowRect.USER32(?,?), ref: 10001DE8
#6880.MFC42(?,?,?,?,00000004,?,?,?,?,00000004,?,?,00000000,00000000,00000005,?), ref: 10001DF1
#6197.MFC42(6D34A098,?,?,00000000,00000000,00000005,?,?,?,?,00000004,?,?,?,?,00000004), ref: 10001E17
GetWindowRect.USER32(?,?), ref: 10001E37
#6197.MFC42(6D34A098,00000000,00000000,?,?,00000006,?,00000000,00000000,00000005,?,?,?,?,00000004,?), ref: 10001E5C

Strings

VUUU, xrefs: 10001A58

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: RectWindow$#6880$#6197$#2379#6215
String ID: VUUU
API String ID: 1101919440-2040033107
Opcode ID: 13b8e8da2f769331353385238693a4145235e3055610f624813af9cb8230173c
Instruction ID: 5a31ff0520036d38cb31330b8b9511fc0d41158ddc336ad14b2b1ef2a9cc197e
Opcode Fuzzy Hash: 13b8e8da2f769331353385238693a4145235e3055610f624813af9cb8230173c
Instruction Fuzzy Hash: D9D120B52147019FE314CF24CC95FABB7E9EBD8B84F104A1CB58687296EA30F905CB95

Function 10004090 Relevance: 66.7, APIs: 35, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#540.MFC42 ref: 100040B4
#537.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040C9
#540.MFC42(\StringFileInfo\040904B0\ProductVersion), ref: 100040D5
#6467.MFC42(00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040E7
#860.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 100040F8
#268.MFC42(10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004100
#2915.MFC42(00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004111
GetModuleFileNameA.KERNEL32(?,00000000,00000100,00000100,10008798,00000000,\StringFileInfo\040904B0\ProductVersion), ref: 10004120
#2915.MFC42(00000000), ref: 1000412A
GetFileVersionInfoSizeA.VERSION(00000000,?,00000000), ref: 10004134
#823.MFC42(00000000,00000000,?,00000000), ref: 10004144
#2915.MFC42(00000000), ref: 10004152
GetFileVersionInfoA.VERSION(00000000,?,00000000,00000000,00000000), ref: 1000415E
GetLastError.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 10004169
#2915.MFC42(00000000,00000000,?,00000000,00000000,00000000), ref: 10004180
VerQueryValueA.VERSION(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000418F
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 1000419A
#2818.MFC42(?,10008058,?,00000000,00000000,?,?,00000000,00000000,?,00000000,00000000,00000000), ref: 100041B9
#825.MFC42(00000000,00000000,00000000,00000000), ref: 100041C6
#6877.MFC42(100086C4,100086C8,00000000,?,00000000), ref: 100041E0
#5683.MFC42(0000002E,100086C4,100086C8,00000000,?,00000000), ref: 100041F3
#5710.MFC42(?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004213
#4129.MFC42(?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004226
#924.MFC42(?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004239
#922.MFC42(?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?,00000000), ref: 10004248
#858.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004255
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004261
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 1000426D
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004279
#800.MFC42(00000000,?,00000000,00000000,?,00000000, Build ,?,00000000,?,?,0000002E,100086C4,100086C8,00000000,?), ref: 10004285
#2915.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 1000428F
#1567.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042BB
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042D5
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042E1
#800.MFC42(00000000,100086C4,100086C8,00000000,?,00000000), ref: 100042F0

Strings

\StringFileInfo\040904B0\ProductVersion, xrefs: 100040BB
GetFileVersionInfo Error is %d, xrefs: 10004173, 100041A4
Build , xrefs: 1000422B

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#2915$File$#540ErrorInfoLastVersion$#1567#268#2818#4129#537#5683#5710#6467#6877#823#825#858#860#922#924ModuleNameQuerySizeValue
String ID: Build $GetFileVersionInfo Error is %d$\StringFileInfo\040904B0\ProductVersion
API String ID: 2403904333-2205515449
Opcode ID: 32ee173fd4bfab7e9fd2f4364ef36033f116338a373bc0aea6c9cddcc8ed7950
Instruction ID: fe3a53cdd048ef3aad4013630a4a48c8c662586e619284a4b3165d18e955ce92
Opcode Fuzzy Hash: 32ee173fd4bfab7e9fd2f4364ef36033f116338a373bc0aea6c9cddcc8ed7950
Instruction Fuzzy Hash: AD71A3B5801149AAEB04DBE4CD81EEFBB78EF15280F114158F90673286DF746B09C776

Function 10002620 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 313windowCOMMON

Download Yara Rule

APIs

#470.MFC42 ref: 10002646
#323.MFC42 ref: 10002673
GetClientRect.USER32(?,?), ref: 1000268F
#5788.MFC42(?), ref: 10002699
#5794.MFC42(00000007,?), ref: 100026A6
Rectangle.GDI32(?,?,?,?,?), ref: 100026C9
#5788.MFC42(00000000), ref: 100026D4
#5788.MFC42(00000000,00000000), ref: 100026DE
CreateCompatibleDC.GDI32(?), ref: 100026FD
#1640.MFC42(00000000), ref: 10002708
SendMessageA.USER32(?,00000172,00000000,?), ref: 1000272E
GetClientRect.USER32(?,?), ref: 10002740
#5785.MFC42(?,?), ref: 10002752
MulDiv.KERNEL32(?,?,?), ref: 1000279E
MulDiv.KERNEL32(?,?,?), ref: 100027CB
StretchBlt.GDI32(?,?,00000000,00000000,?,?,100064FC,100064FC,?,?,00CC0020), ref: 10002831
#5785.MFC42(?,?), ref: 10002848
#2405.MFC42(?,?), ref: 10002851
GetClientRect.USER32(?,?), ref: 10002865
GetClientRect.USER32(?,?), ref: 10002870
MulDiv.KERNEL32(?,?,00000064), ref: 1000288C
MulDiv.KERNEL32(?,?,00000064), ref: 100028A6
#6172.MFC42(00FFFFFF), ref: 100028B5
#5875.MFC42(00000001,00FFFFFF), ref: 100028C0
DrawTextA.USER32(?,?,000000FF,?,00000020), ref: 100028DD
DrawTextA.USER32(?,?,000000FF,?,00000420), ref: 100028F4
GetWindowRect.USER32(?,?), ref: 10002902
#6880.MFC42(?), ref: 1000290F
#6172.MFC42(00FFFFFF,?), ref: 1000296D
#5875.MFC42(00000001,00FFFFFF,?), ref: 10002978
DrawTextA.USER32(?,?,000000FF,?,?), ref: 1000299A
#640.MFC42 ref: 100029A8
#2414.MFC42 ref: 100029C1
#755.MFC42 ref: 100029DD

Strings

gfff, xrefs: 1000291E

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#5788DrawText$#5785#5875#6172$#1640#2405#2414#323#470#5794#640#6880#755CompatibleCreateMessageRectangleSendStretchWindow
String ID: gfff
API String ID: 1747922241-1553575800
Opcode ID: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction ID: de8d7cd43940ff7d5f440d9c982899baa02ad0d10f146baf563ef8a33310dbb5
Opcode Fuzzy Hash: 947e77128112745d52ba768b07c82a943325254e23f019a542ee7d3d7ac89f1e
Instruction Fuzzy Hash: ADC125B52087459FE314DF69C884E6BBBE9FBC8740F114A1CF59583299DB70E809CB62

Function 100035B0 Relevance: 61.3, APIs: 20, Strings: 15, Instructions: 99COMMON

Download Yara Rule

APIs

#540.MFC42(?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035CB
#860.MFC42(The operating system is outof memory or resources.,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100035FD
#860.MFC42(The specified path was not found.,The specified file was not found.), ref: 10003610
#860.MFC42(The specified file was not found.), ref: 10003623
#860.MFC42(The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003636
#860.MFC42(The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 10003649
#860.MFC42(The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000365C
#860.MFC42(The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000366F
#860.MFC42(The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000367F
#860.MFC42(The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000368F
#860.MFC42(The specified dynamic-link library was not found.,There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 1000369F
#860.MFC42(There is no application associatedwith the given filename extension.,The DDE transaction could notbe completed because other DDE transactionswere being processed.,The DDE transaction failed.,The DDE transaction could notbe completed because the request timed out.,The filename association isincomplete or invalid.,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036AF
#860.MFC42(There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036BF
#860.MFC42(A sharing violation occurred. ,The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).,There was not enough memory to complete the operation.,The operating system deniedaccess to the specified file.,The specified path was not found.,The specified file was not found.), ref: 100036CF
#2818.MFC42(?,Unknown Error (%d) occurred.,?,?,?,00000000,10005070,000000FF,10002F07,00000000), ref: 100036DF
#926.MFC42(?,Unable to open hyperlink:,?), ref: 100036F6
#858.MFC42(?,?,?,?,?,?,00000005), ref: 10003705
#800.MFC42(?,?,?,?,?,?,00000005), ref: 10003713
#1200.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003721
#800.MFC42(?,00000030,00000000,?,?,?,?,?,?,00000005), ref: 10003732

Strings

There is no application associatedwith the given filename extension., xrefs: 100036A6
The DDE transaction could notbe completed because other DDE transactionswere being processed., xrefs: 10003666
A sharing violation occurred. , xrefs: 100036C6
The specified dynamic-link library was not found., xrefs: 10003696
The DDE transaction failed., xrefs: 10003676
The specified file was not found., xrefs: 1000361A
The specified path was not found., xrefs: 10003607
There was not enough memory to complete the operation., xrefs: 100036B6
Unknown Error (%d) occurred., xrefs: 100036D9
Unable to open hyperlink:, xrefs: 100036F0
The operating system is outof memory or resources., xrefs: 100035F4
The DDE transaction could notbe completed because the request timed out., xrefs: 10003686
The filename association isincomplete or invalid., xrefs: 10003653
The operating system deniedaccess to the specified file., xrefs: 10003640
The .EXE file is invalid(non-Win32 .EXE or error in .EXE image)., xrefs: 1000362D

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #860$#800$#1200#2818#540#858#926
String ID: A sharing violation occurred. $The .EXE file is invalid(non-Win32 .EXE or error in .EXE image).$The DDE transaction could notbe completed because other DDE transactionswere being processed.$The DDE transaction could notbe completed because the request timed out.$The DDE transaction failed.$The filename association isincomplete or invalid.$The operating system deniedaccess to the specified file.$The operating system is outof memory or resources.$The specified dynamic-link library was not found.$The specified file was not found.$The specified path was not found.$There is no application associatedwith the given filename extension.$There was not enough memory to complete the operation.$Unable to open hyperlink:$Unknown Error (%d) occurred.
API String ID: 346542042-3273680174
Opcode ID: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction ID: bf864e296dc8769b1736225a429bb83c06595c96c86935583d96534d00f8651e
Opcode Fuzzy Hash: b868b63d094aa1a1bd7ee5b72095cdc6864c195a3241ebc7087020d02e4faecc
Instruction Fuzzy Hash: F131A2B8018A41BBF215CB14CC62AAF7798FB902C1F01C91CB5D5521AADF33674DC79A

Function 10003970 Relevance: 57.9, APIs: 31, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

#6467.MFC42(00000000), ref: 1000399D
#268.MFC42(00000000), ref: 100039AC

Part of subcall function 10001000: #324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
Part of subcall function 10001000: #567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
Part of subcall function 10001000: #540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
Part of subcall function 10001000: CreateSolidBrush.GDI32(000000FF), ref: 1000117B
Part of subcall function 10001000: #1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

#2514.MFC42(00000000,00000000), ref: 100039D3
#800.MFC42(00000000,00000000), ref: 10003A07
#795.MFC42(00000000,00000000), ref: 10003A31
#795.MFC42(00000000,00000000), ref: 10003A40
#795.MFC42(00000000,00000000), ref: 10003A4F
#795.MFC42(00000000,00000000), ref: 10003A5E
#795.MFC42(00000000,00000000), ref: 10003A6D
#795.MFC42(00000000,00000000), ref: 10003A7C
#795.MFC42(00000000,00000000), ref: 10003A8B
#795.MFC42(00000000,00000000), ref: 10003A9A
#795.MFC42(00000000,00000000), ref: 10003AA9
#609.MFC42(00000000,00000000), ref: 10003AB8
#641.MFC42(00000000,00000000), ref: 10003AC6
#1567.MFC42(00000000,00000000), ref: 10003ACF
#800.MFC42(00000000,00000000), ref: 10003A13

Part of subcall function 10002C30: #2414.MFC42 ref: 10002C64
Part of subcall function 10002C30: #809.MFC42 ref: 10002C71
Part of subcall function 10002C30: #2414.MFC42 ref: 10002C8A
Part of subcall function 10002C30: #2414.MFC42 ref: 10002CA8
Part of subcall function 10002C30: #800.MFC42 ref: 10002CBB
Part of subcall function 10002C30: #795.MFC42 ref: 10002CCA

#800.MFC42(00000000,00000000), ref: 10003B08
#800.MFC42(00000000,00000000), ref: 10003B14
#795.MFC42(00000000,00000000), ref: 10003B32
#795.MFC42(00000000,00000000), ref: 10003B41
#795.MFC42(00000000,00000000), ref: 10003B50
#795.MFC42(00000000,00000000), ref: 10003B5F
#795.MFC42(00000000,00000000), ref: 10003B6E
#795.MFC42(00000000,00000000), ref: 10003B7D
#795.MFC42(00000000,00000000), ref: 10003B8C
#795.MFC42(00000000,00000000), ref: 10003B9B
#795.MFC42(00000000,00000000), ref: 10003BAA
#609.MFC42(00000000,00000000), ref: 10003BB9
#641.MFC42(00000000,00000000), ref: 10003BC7
#1567.MFC42(00000000,00000000), ref: 10003BD0

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

Part of subcall function 10001F50: #2414.MFC42(?,?,00000000,10004DE8,000000FF,10003B01,00000000), ref: 10001F7B

Strings

d, xrefs: 10003AE9
, xrefs: 10003AF8

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #795$#567$#2414#800$#1567#540#609#641$#1641#2514#268#324#6467#809BrushCreateSolid
String ID: $d
API String ID: 520380079-3649417382
Opcode ID: e584cfe3d76a06efcd44d6a9b43c4ccd9e9a91c91e2c9506ed0a414b07c3501e
Instruction ID: ba9fdb3c8c69b1efcd9dc3c0e08e9eba6e85a8a60e063a58fc3de4da0faa40ac
Opcode Fuzzy Hash: e584cfe3d76a06efcd44d6a9b43c4ccd9e9a91c91e2c9506ed0a414b07c3501e
Instruction Fuzzy Hash: 7871377880618CDAEB15DBA4C5557DCFBB0EF25344F1580E9E84523286DF782B0EDA36

Function 10002250 Relevance: 52.6, APIs: 25, Strings: 5, Instructions: 148windowtimeCOMMON

Download Yara Rule

APIs

#4710.MFC42(?,?,?,?,10004ED8,000000FF), ref: 1000226A
#540.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002273
#2860.MFC42(?,?,?,?,?,10004ED8,000000FF), ref: 1000228E
#823.MFC42(00000008,?,?,?,?,10004ED8,000000FF), ref: 1000229D
#1146.MFC42(00000899,00000002,00000899), ref: 100022C3
LoadBitmapA.USER32(00000000,00000899), ref: 100022C9
#1641.MFC42(00000000), ref: 100022D2
#6215.MFC42(00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022ED
#6215.MFC42(00000005,00000005,?,?,?,?,?,?,10004ED8,000000FF), ref: 100022FA
#6215.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002311
#6215.MFC42(00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000231E
#860.MFC42(10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002332
#860.MFC42(10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002341
#2818.MFC42(?,10008058,?,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000235B
#860.MFC42(10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 1000236C
#2818.MFC42(?,Version: %s,?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002386
#939.MFC42(?,10008798,10008798,10008798,00000000,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 10002395
CreateSolidBrush.GDI32(?), ref: 100023A1
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023AB
CreateSolidBrush.GDI32(00000000), ref: 100023B4
#1641.MFC42(00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023BE
#860.MFC42(Error No Data,00000000,?,?,?,?,?,?,10004ED8,000000FF), ref: 100023CA
SetTimer.USER32(?,00000001,00000BB8,00000000), ref: 100023D8
#4224.MFC42(could not Start Splash Timmer,ProSoft,00000000,?,?,?,?,10004ED8,000000FF), ref: 100023F4
#800.MFC42(?,?,?,?,10004ED8,000000FF), ref: 10002416

Strings

could not Start Splash Timmer, xrefs: 100023ED
ProSoft, xrefs: 100023E8
Version: %s, xrefs: 10002380
Error No Data, xrefs: 100023C3
This is a Beta version of this program. Not for production use and without warranty., xrefs: 10002302

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #6215#860$#1641$#2818BrushCreateSolid$#1146#2860#4224#4710#540#800#823#939BitmapLoadTimer
String ID: Error No Data$ProSoft$This is a Beta version of this program. Not for production use and without warranty.$Version: %s$could not Start Splash Timmer
API String ID: 514652099-906665912
Opcode ID: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction ID: 1913312f89696d600550852331e7f23b7439d3c132441fa52a7110e09bfaff39
Opcode Fuzzy Hash: b106e82f75c2b68fad7de78c43cfcce2fb37ad0f8b92b33dbe923d81e59799b0
Instruction Fuzzy Hash: 67519FB5200F00ABF215DB64CC51BAAB7E8FB58681F014918F6969729ADF34FA04CB95

Function 10003EB0 Relevance: 25.6, APIs: 17, Instructions: 104COMMON

Download Yara Rule

APIs

#6467.MFC42(00000000), ref: 10003EDD
#268.MFC42(00000000), ref: 10003EEA

Part of subcall function 10002070: #324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
Part of subcall function 10002070: #540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
Part of subcall function 10002070: #567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

#2514.MFC42(00000000,00000000), ref: 10003F12
#795.MFC42(00000000,00000000), ref: 10003F2D
#609.MFC42(00000000,00000000), ref: 10003F3C
#800.MFC42(00000000,00000000), ref: 10003F73
#800.MFC42(00000000,00000000), ref: 10003F82
#641.MFC42(00000000,00000000), ref: 10003F91
#1567.MFC42(00000000,00000000), ref: 10003F99
#609.MFC42(00000000,00000000), ref: 10003F4B

Part of subcall function 10001EE0: #2414.MFC42(?,?,00000000,10004DC8,000000FF,10003AF5,00000000), ref: 10001F0B

#795.MFC42(00000000,00000000), ref: 10003FC6
#609.MFC42(00000000,00000000), ref: 10003FD5
#609.MFC42(00000000,00000000), ref: 10003FE4
#800.MFC42(00000000,00000000), ref: 1000400C
#800.MFC42(00000000,00000000), ref: 1000401B
#641.MFC42(00000000,00000000), ref: 1000402A
#1567.MFC42(00000000,00000000), ref: 10004032

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#567$#1567#540#641#795$#2414#2514#268#324#6467
String ID:
API String ID: 39110236-0
Opcode ID: 926edbcbb62db7dd29bd71bff26a577ce8fbb8754f73f2f2a57127e8871633d0
Instruction ID: cfaefb5b01c91ea90e470d212f713a34359e3d9334dad7f1e11d803252a963b9
Opcode Fuzzy Hash: 926edbcbb62db7dd29bd71bff26a577ce8fbb8754f73f2f2a57127e8871633d0
Instruction Fuzzy Hash: 904181B8C05299DAEB10DBA4C9417EDFBB0EF15340F1080E9D54923786DF792B48DB66

Function 10001000 Relevance: 22.6, APIs: 15, Instructions: 97COMMON

Download Yara Rule

APIs

#324.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001029
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF,100039C3,00000000,00000000), ref: 10001039
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001051
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001069
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001081
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001099
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010B1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010C9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010E1
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 100010F9
#567.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001111

Part of subcall function 10002B50: #567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
Part of subcall function 10002B50: #540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
Part of subcall function 10002B50: #556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
Part of subcall function 10002B50: #2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001137
#540.MFC42(000007D1,00000000,?,?,00000002,?,00000000,10004C77,000000FF), ref: 10001147
CreateSolidBrush.GDI32(000000FF), ref: 1000117B
#1641.MFC42(00000000,?,?,00000002,?,00000000,10004C77), ref: 10001184

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#1641#2614#324#556BrushCreateSolid
String ID:
API String ID: 862247804-0
Opcode ID: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction ID: ef8ebbcba9a2f6dd6cb2c20b7593ac1494135993400dd6ceca74427708b28424
Opcode Fuzzy Hash: c59788841f233aca7461894643f3ac6d2aacd4091ecb3ef82a872218ae90a87c
Instruction Fuzzy Hash: B74142B4104B829BE311CF24CC8076ABB96FF99381F650C1CE0951B796DBB87549CB92

Function 100037B0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 87stringprocessCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,?), ref: 100037D7

Part of subcall function 10003540: RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
Part of subcall function 10003540: RegQueryValueA.ADVAPI32 ref: 1000357E
Part of subcall function 10003540: lstrcpyA.KERNEL32(?,00000000), ref: 10003591
Part of subcall function 10003540: RegCloseKey.ADVAPI32(?), ref: 1000359C

lstrcatA.KERNEL32(?,\shell\open\command,80000000,.htm,?), ref: 10003816
_mbsstr.MSVCRT ref: 10003842
_mbsstr.MSVCRT ref: 10003857
lstrlenA.KERNEL32(?), ref: 10003867
lstrcatA.KERNEL32(00000000,1000866C), ref: 1000387C
lstrcatA.KERNEL32(00000000,?), ref: 10003887
WinExec.KERNEL32(?,?), ref: 1000388F

Strings

\shell\open\command, xrefs: 10003810
.htm, xrefs: 100037ED
open, xrefs: 100037CE
"%1", xrefs: 1000383C

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$_mbsstr$CloseExecExecuteOpenQueryShellValuelstrcpylstrlen
String ID: "%1"$.htm$\shell\open\command$open
API String ID: 729890978-1533145997
Opcode ID: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction ID: bfa4e36c36e67bfdf65cedbb39ad291800a273508fa034cc737e01779e384aa2
Opcode Fuzzy Hash: d472292a7c3796fc2f38b6b1a38bb90f5857e7a2a47701205bffc1a1387a8422
Instruction Fuzzy Hash: 9A21C1325443556BF321EB60CC84FAFB39CFB84291F15891DFB9093144EB25E90987A6

Function 10002440 Relevance: 13.6, APIs: 9, Instructions: 140windowCOMMON

Download Yara Rule

APIs

#2860.MFC42(?,?), ref: 10002453
SendMessageA.USER32(?,00000172,00000000,?), ref: 10002481
GetClientRect.USER32(?,?), ref: 10002499
GetClientRect.USER32(?,?), ref: 100024A4
GetWindowRect.USER32(?,?), ref: 100024AF
SetRect.USER32(00000000,00000000,00000000,00000000,00000000), ref: 100024C2
#6605.MFC42(?,?), ref: 1000252E
OffsetRect.USER32(?,?,?), ref: 10002581
#4299.MFC42(?,?,?,?,00000001), ref: 100025A3

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$Client$#2860#4299#6605MessageOffsetSendWindow
String ID:
API String ID: 1591621576-0
Opcode ID: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction ID: cea368ed319ff426ac7cae26e22c5591117dddf13591c75ce779038945222747
Opcode Fuzzy Hash: 7a4e30ae434ae4d802ffbe96aee62a3a44f042fa02a81a532f95ec2a69d9fd75
Instruction Fuzzy Hash: 71411A713047019FD708CF39CD95A6BB7EAFBC8680F198A2CB585C3259DA70F9058A55

Function 10002FD0 Relevance: 12.1, APIs: 8, Instructions: 60windowtimeCOMMON

Download Yara Rule

APIs

GetMessagePos.USER32 ref: 10002FD6
ScreenToClient.USER32(?,?), ref: 10002FF6
GetClientRect.USER32(?,?), ref: 10003005
PtInRect.USER32(?,?,?), ref: 1000301A
KillTimer.USER32(?,?), ref: 10003032
SendMessageA.USER32(?,00000030,?,00000001), ref: 10003051
InvalidateRect.USER32(?,?,00000001), ref: 1000306D
#2379.MFC42 ref: 10003075

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: Rect$ClientMessage$#2379InvalidateKillScreenSendTimer
String ID:
API String ID: 173336095-0
Opcode ID: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction ID: 76f8f83f127ebf74195a72dad42daeb95907ffedfed5679e39fce6817e511657
Opcode Fuzzy Hash: f4f3901086f71d843120d0b1d26b7a9e3ea72662b6a4e76e5857c581d4e99dc8
Instruction Fuzzy Hash: CB1103B4504711AFE314DF64CC98E6BB7E9FB88B81F04890DF98683254EB75E904CB91

Function 10002150 Relevance: 10.5, APIs: 7, Instructions: 41COMMON

Download Yara Rule

APIs

#795.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000217E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000218E
#609.MFC42(?,?,?,?,?,?,?,10002138), ref: 1000219E
#2414.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021B7
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021CA
#800.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021D7
#641.MFC42(?,?,?,?,?,?,?,10002138), ref: 100021E6

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #609#800$#2414#641#795
String ID:
API String ID: 1303925036-0
Opcode ID: 9c0007cf5b19ab8dec9855f64950081603fe9d25d0220f3b38a78263db54cccf
Instruction ID: f5c4544bc7a3faee989b476a257d09b4c225558fe38a2fb961692ad6650ff4c0
Opcode Fuzzy Hash: 9c0007cf5b19ab8dec9855f64950081603fe9d25d0220f3b38a78263db54cccf
Instruction Fuzzy Hash: 411130B5004B818EE315DF28C84174AFBE4FFA5790F55091DE4A643796CFB8614DCBA2

Function 10002070 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

#324.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 10002099
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF,10003EFF,00000000,00000000), ref: 100020A7
#540.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020B4
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020D0
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 100020E8
#567.MFC42(00000835,00000000,?,?,00000000,?,00000000,10004E65,000000FF), ref: 10002100

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #567$#540$#324
String ID:
API String ID: 2217935779-0
Opcode ID: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction ID: 0e0f615a265ac9c9a9ef4592cef02d40833f3a3893898f0605a6b53120fdffae
Opcode Fuzzy Hash: 43aa6c68d9906ef81e915a8c7c7bada45a0781a7d6be189ef56f34b673fb01a0
Instruction Fuzzy Hash: 82114CB5104B818BE311CF148C8075AFBE5FB99781F510C1DE19647796DBB8A548CB92

Function 10002A00 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 10002A06
GetClientRect.USER32(?,?), ref: 10002A30
GetWindowRect.USER32(?,?), ref: 10002A42
#4299.MFC42(?,?,?,?,00000001), ref: 10002A85
#4299.MFC42(?,?,?,?,00000001,?,?,?,?,00000001), ref: 10002AB3

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #4299Rect$#2379ClientWindow
String ID:
API String ID: 2463140695-0
Opcode ID: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction ID: 7fd873ad5859924dc3e9645bdb9b098ce72c68c189247eaef3a9cf332acd70ce
Opcode Fuzzy Hash: 82d9410c73ce4cd349a0a38fed258ac145b69033f957ebb036d360ccb05af84a
Instruction Fuzzy Hash: 9F212F75304705AFD708DE78CD94E6BB7EAFBC8244F058A2DB84583249DA70F909C6A2

Function 100049BA Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 100049E8
_initterm.MSVCRT ref: 10004A13
free.MSVCRT ref: 10004A50

Strings

kGu0EAu, xrefs: 100049D0

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID: kGu0EAu
API String ID: 1678931842-451212217
Opcode ID: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction ID: 6e6ce05fc65f6857befb30b960dddb25c0f056c42b7287eed7d5b62f4f9fe03b
Opcode Fuzzy Hash: 78b7094f9f155f5e367261e869c24faaca12b7b05a3d9c7449124659f7b46251
Instruction Fuzzy Hash: 3D113CB27462229FF714DF68DD84B5637E5FB493D1B22402DE801C716CEB719A00CB59

Function 10002B50 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

#567.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B6F
#540.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002B85
#556.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BA3
#2614.MFC42(?,?,00000000,?,00000000,10004F84,000000FF,1000112C,000007D1,00000000,?,?,00000002,?,00000000,10004C77), ref: 10002BE1

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #2614#540#556#567
String ID:
API String ID: 4066608244-0
Opcode ID: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction ID: 5380fbfe1f13ce258253e983e879f2a7423347c2a2865734c5e17ac8d5c15826
Opcode Fuzzy Hash: cd001adb3f906e993f4ee0cb89a3c91f2a238da0620c7a98d2a828515c70140a
Instruction Fuzzy Hash: 97112BB0500B91CFE320CF1AC844356FBE5FB45754F900E2EE19687B95DBB9A444CB91

Function 100030F0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

#858.MFC42(?,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003118
IsWindow.USER32(?), ref: 10003129
#6358.MFC42(?,?,00000001,?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003145
#800.MFC42(?,00000000,10005008,000000FF,100017E5,?,?,?), ref: 10003156

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #6358#800#858Window
String ID:
API String ID: 1255164923-0
Opcode ID: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction ID: a14bf695a60021346b265786ca639e55b1935be1e887f5c80a4f76400b1b17f4
Opcode Fuzzy Hash: 2365626be56d6fa9a48f828a9864e9786a53f225911a590bfa404064d9be6c0e
Instruction Fuzzy Hash: 0E01A272104A519BD311CF14C841B9B73E8FB49BA0F008A1DF16683584DB74A808CB62

Function 10003540 Relevance: 6.0, APIs: 4, Instructions: 35registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 1000355A
RegQueryValueA.ADVAPI32 ref: 1000357E
lstrcpyA.KERNEL32(?,00000000), ref: 10003591
RegCloseKey.ADVAPI32(?), ref: 1000359C

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValuelstrcpy
String ID:
API String ID: 534897748-0
Opcode ID: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction ID: 31d2930b61c82b42a2fde46d1cefe9ce52522f5b9b535180cdc1a6a6f7b1b038
Opcode Fuzzy Hash: e01a9041070a39b80426329a75fd9bf06ca93e39b0b1179dbbe34924b38c743a
Instruction Fuzzy Hash: F3F04F75144312BFE320CB10CC89FABBBA9EBC8790F10C90CF98982254D670D844CBA2

Function 10002F70 Relevance: 6.0, APIs: 4, Instructions: 35windowtimeCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000030,?,00000001), ref: 10002F9C
InvalidateRect.USER32(?,00000000,00000001), ref: 10002FAA
SetTimer.USER32(?,?,00000064,00000000), ref: 10002FBF
#2379.MFC42 ref: 10002FC7

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #2379InvalidateMessageRectSendTimer
String ID:
API String ID: 920896690-0
Opcode ID: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction ID: 2dcf2f78edcbb6a6aeec61f8ec110639963feb333860edce5202acada731f870
Opcode Fuzzy Hash: aefb442e6bfebe49207aa2174bd70283ee740acaf810e8936bb8a75053c6e2ae
Instruction Fuzzy Hash: CBF0E775210711ABE730CB65CC85F56B3E9BB4C790F114A19F686D76C4D6B1F9408B50

Function 1000431C Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

#1567.MFC42 ref: 10004320
#800.MFC42 ref: 10004335
#800.MFC42 ref: 10004341
#800.MFC42 ref: 10004350

Memory Dump Source

Source File: 00000014.00000002.1632562063.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000014.00000002.1632527221.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632592711.0000000010006000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632622272.0000000010008000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000014.00000002.1632649935.000000001000A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_10000000_rundll32.jbxd

Similarity

API ID: #800$#1567
String ID:
API String ID: 3194870385-0
Opcode ID: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction ID: e8ea892de69bcb9610e0c8c3a5f6cf03a5fb7e67a11db6fafae1abe6c09cea7f
Opcode Fuzzy Hash: 7a85c1702c1ed7fe984e6874e3d14e69e68c8d0fd61dee0280d9e0be7ed41863
Instruction Fuzzy Hash: 14F08C79C05288DADB04CF98D1417EDFB70FB61310F1081AEC85123282CB762A0AC761

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PSAbout.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ac7a4fc5b84473d26fc49234f984b16b262e2c8_7522e4b5_3d48e3d7-7135-41ac-a87c-8d7dc7ca6b79\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ac7a4fc5b84473d26fc49234f984b16b262e2c8_7522e4b5_56d3a75f-5829-405b-ad15-41ebb152a4ec\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_ac7a4fc5b84473d26fc49234f984b16b262e2c8_7522e4b5_808f954a-53f1-4397-b5c1-6356f3c5f3fc\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d6e6e8b58b7a0a9a6bb978481c3782f98cadcf_7522e4b5_38ca8843-afa9-4f41-a8ef-8e9775b40cf2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d6e6e8b58b7a0a9a6bb978481c3782f98cadcf_7522e4b5_6122d459-8098-4c10-8204-ad092330c3b0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d6e6e8b58b7a0a9a6bb978481c3782f98cadcf_7522e4b5_79daa82b-bcfe-4dc5-a6f2-0092226be9e7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d6e6e8b58b7a0a9a6bb978481c3782f98cadcf_7522e4b5_dfd94030-e641-470d-9dff-0a9fb81ecb98\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2714.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2733.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER280F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER282F.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER287D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER289D.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F8F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER300D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER303D.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A0F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3A7D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3AAD.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER48F3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4913.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4970.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A6B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A9B.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AAA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AC9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4B18.tmp.xml

Windows Analysis Report
PSAbout.dll