Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_00504E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04774E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree, |
Source: Yara match | File source: 00000000.00000003.874866712.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876330514.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874909818.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874494648.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876188239.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874791903.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874837013.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919920945.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876373518.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874942139.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876356161.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876088782.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874588381.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876229416.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874885116.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.917892757.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876297207.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876268229.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6640, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6604, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874866712.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876330514.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874909818.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874494648.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876188239.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874791903.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874837013.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919920945.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876373518.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874942139.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876356161.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876088782.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874588381.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876229416.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874885116.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.917892757.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876297207.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876268229.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6640, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6604, type: MEMORY |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C502264 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_00506609 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_00507FA8 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C558C07 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C55A588 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C548ED8 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C54C8D4 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C55139D |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04776609 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04777FA8 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C558C07 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C55A588 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C548ED8 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C54C8D4 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C55139D |
Source: unknown | Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\shorefront.dll' |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\shorefront.dll',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\shorefront.dll,Child |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\shorefront.dll',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\shorefront.dll,Forcearea |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\shorefront.dll,Stationmeat |
Source: unknown | Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding |
Source: C:\Program Files\internet explorer\iexplore.exe | Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:816 CREDAT:17410 /prefetch:2 |
Source: C:\Program Files\internet explorer\iexplore.exe | Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:816 CREDAT:17414 /prefetch:2 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\shorefront.dll',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\shorefront.dll,Child |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\shorefront.dll,Forcearea |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\shorefront.dll,Stationmeat |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\shorefront.dll',#1 |
Source: C:\Program Files\internet explorer\iexplore.exe | Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:816 CREDAT:17410 /prefetch:2 |
Source: C:\Program Files\internet explorer\iexplore.exe | Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:816 CREDAT:17414 /prefetch:2 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C502253 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C502200 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_0050B67C push ss; retf |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_00507C20 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_0050B163 push edx; iretd |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_00507F97 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C51242B pushad ; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C510DDC push edi; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C511F8E push esp; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C546847 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6C54B375 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_0477B67C push ss; retf |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04777C20 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_0477B163 push edx; iretd |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04777F97 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C51242B pushad ; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C510DDC push edi; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C511F8E push esp; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C546847 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6C54B375 push ecx; ret |
Source: Yara match | File source: 00000000.00000003.874866712.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876330514.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874909818.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874494648.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876188239.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874791903.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874837013.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919920945.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876373518.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874942139.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876356161.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876088782.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874588381.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876229416.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874885116.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.917892757.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876297207.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876268229.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6640, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6604, type: MEMORY |
Source: C:\Windows\System32\loaddll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\loaddll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_00504E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_04774E9C Wow64EnableWow64FsRedirection,RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree, |
Source: C:\Windows\System32\loaddll32.exe | Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA, |
Source: C:\Windows\System32\loaddll32.exe | Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP, |
Source: C:\Windows\System32\loaddll32.exe | Code function: GetLocaleInfoW,_GetPrimaryLen, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, |
Source: C:\Windows\System32\loaddll32.exe | Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free, |
Source: C:\Windows\System32\loaddll32.exe | Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, |
Source: C:\Windows\System32\loaddll32.exe | Code function: EnumSystemLocalesW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _GetPrimaryLen,EnumSystemLocalesW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: GetLocaleInfoW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: EnumSystemLocalesW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _GetPrimaryLen,EnumSystemLocalesW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: GetLocaleInfoW,_GetPrimaryLen, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: EnumSystemLocalesW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _GetPrimaryLen,EnumSystemLocalesW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: GetLocaleInfoW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: EnumSystemLocalesW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _GetPrimaryLen,EnumSystemLocalesW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage, |
Source: Yara match | File source: 00000000.00000003.874866712.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876330514.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874909818.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874494648.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876188239.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874791903.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874837013.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919920945.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876373518.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874942139.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876356161.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876088782.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874588381.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876229416.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874885116.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.917892757.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876297207.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876268229.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6640, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6604, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874866712.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876330514.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874909818.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874494648.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876188239.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874791903.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874837013.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919920945.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876373518.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874942139.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876356161.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876088782.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874588381.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876229416.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.874885116.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.917892757.0000000002FE8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876297207.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.876268229.00000000050E8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6640, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6604, type: MEMORY |