Source: Yara match | File source: 00000000.00000003.849775483.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848756217.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849876753.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850076693.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848724837.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848569421.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850098978.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848820548.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919640780.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850034271.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848847828.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848790447.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848684716.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849999289.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.918801492.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848623660.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849834165.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849965613.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6988, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6956, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849775483.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848756217.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849876753.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850076693.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848724837.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848569421.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850098978.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848820548.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919640780.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850034271.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848847828.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848790447.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848684716.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849999289.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.918801492.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848623660.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849834165.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849965613.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6988, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6956, type: MEMORY |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3D1996 GetProcAddress,NtCreateSection,memset, |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3D1A44 NtMapViewOfSection, |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3D23A5 NtQueryVirtualMemory, |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_01175A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_0117B1A5 NtQueryVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008A5A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008AB1A5 NtQueryVirtualMemory, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_04C25A27 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_04C2B1A5 NtQueryVirtualMemory, |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3D2184 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_0117AF80 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_0117888E |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_01173EE1 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3F17B0 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D4005E5 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D400DB8 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D40BE61 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D404E00 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D4109C8 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D4088B7 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008A888E |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008A3EE1 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008AAF80 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D3F17B0 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D4005E5 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D400DB8 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D40BE61 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D404E00 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D4109C8 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D4088B7 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_04C23EE1 |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_04C2888E |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_04C2AF80 |
Source: unknown | Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\1c8.dll' |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1c8.dll',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1c8.dll,Clockcondition |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1c8.dll',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1c8.dll,Dogwhen |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1c8.dll,Sing |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1c8.dll,Wholegray |
Source: unknown | Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding |
Source: C:\Program Files\internet explorer\iexplore.exe | Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5828 CREDAT:17410 /prefetch:2 |
Source: C:\Program Files\internet explorer\iexplore.exe | Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5828 CREDAT:17414 /prefetch:2 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\1c8.dll',#1 |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1c8.dll,Clockcondition |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1c8.dll,Dogwhen |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1c8.dll,Sing |
Source: C:\Windows\System32\loaddll32.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\1c8.dll,Wholegray |
Source: C:\Windows\SysWOW64\cmd.exe | Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\1c8.dll',#1 |
Source: C:\Program Files\internet explorer\iexplore.exe | Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5828 CREDAT:17410 /prefetch:2 |
Source: C:\Program Files\internet explorer\iexplore.exe | Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5828 CREDAT:17414 /prefetch:2 |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3D2120 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3D2173 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_0117AF6F push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_0117ABC0 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3FDE07 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3E103D push cs; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D4032D5 push ecx; ret |
Source: C:\Windows\System32\loaddll32.exe | Code function: 0_2_6D3E2AD8 push edx; retf |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008AD23C push eax; retf |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008AD1B0 push eax; retf |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008AABC0 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008AD14D push eax; retf |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_008AAF6F push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D3FDE07 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D3E103D push cs; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 3_2_6D4032D5 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_04C2ABC0 push ecx; ret |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: 6_2_04C2AF6F push ecx; ret |
Source: Yara match | File source: 00000000.00000003.849775483.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848756217.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849876753.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850076693.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848724837.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848569421.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850098978.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848820548.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919640780.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850034271.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848847828.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848790447.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848684716.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849999289.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.918801492.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848623660.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849834165.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849965613.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6988, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6956, type: MEMORY |
Source: C:\Windows\System32\loaddll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\loaddll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\SysWOW64\rundll32.exe | Process information set: NOOPENFILEERRORBOX |
Source: C:\Windows\System32\loaddll32.exe | Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _GetPrimaryLen,EnumSystemLocalesW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _GetPrimaryLen,EnumSystemLocalesW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: EnumSystemLocalesW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, |
Source: C:\Windows\System32\loaddll32.exe | Code function: EnumSystemLocalesW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage, |
Source: C:\Windows\System32\loaddll32.exe | Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, |
Source: C:\Windows\System32\loaddll32.exe | Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free, |
Source: C:\Windows\System32\loaddll32.exe | Code function: GetLocaleInfoW,_GetPrimaryLen, |
Source: C:\Windows\System32\loaddll32.exe | Code function: GetLocaleInfoW, |
Source: C:\Windows\System32\loaddll32.exe | Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _GetPrimaryLen,EnumSystemLocalesW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _GetPrimaryLen,EnumSystemLocalesW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: EnumSystemLocalesW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: EnumSystemLocalesW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_memmove,_memmove,_memmove,_free,_free,_free,_free,_free,_free,_free,_free,_free, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: GetLocaleInfoW,_GetPrimaryLen, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: GetLocaleInfoW, |
Source: C:\Windows\SysWOW64\rundll32.exe | Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP, |
Source: Yara match | File source: 00000000.00000003.849775483.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848756217.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849876753.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850076693.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848724837.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848569421.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850098978.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848820548.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919640780.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850034271.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848847828.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848790447.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848684716.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849999289.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.918801492.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848623660.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849834165.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849965613.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6988, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6956, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849775483.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848756217.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849876753.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850076693.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848724837.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848569421.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850098978.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848820548.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000002.919640780.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.850034271.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848847828.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848790447.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848684716.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849999289.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000002.918801492.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000003.00000003.848623660.0000000004EB8000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849834165.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: 00000000.00000003.849965613.0000000003618000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match | File source: Process Memory Space: rundll32.exe PID: 6988, type: MEMORY |
Source: Yara match | File source: Process Memory Space: loaddll32.exe PID: 6956, type: MEMORY |