Edit tour

Windows Analysis Report
ClickShare-Extension-Pack-01.01.02.0007.msi

Overview

General Information

Sample name:	ClickShare-Extension-Pack-01.01.02.0007.msi
Analysis ID:	1427889
MD5:	56d913ebbe38ab3a7f48abe1a3e9daa6
SHA1:	fb6518265932a3d810183f3a6e6a0fde14a2b66e
SHA256:	26f4dc0f8ccedc064aea7fda31a2a8bec32cf7b646fa044cbfdd352f559764e0
Infos:

Detection

Score:	9
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables debug privileges

Enables driver privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Launches processes in debugging mode, may be used to hinder debugging

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains executable resources (Code or Archives)

Queries device information via Setup API

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Startup Folder File Write

Spawns drivers

Stores files to the Windows start menu directory

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample may be VM or Sandbox-aware, try analysis on a native machine

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample monitors window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Process Tree

System is w10x64

msiexec.exe (PID: 3568 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ClickShare-Extension-Pack-01.01.02.0007.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1632 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1408 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding E6B16BCC263E80D188A4984C7B267598 MD5: 9D09DC1EDA745A5F87553048E57620CF)

taskkill.exe (PID: 4148 cmdline: "C:\Windows\SysWOW64\taskkill.exe" /F /IM clicksharelauncher.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 5740 cmdline: C:\Windows\System32\MsiExec.exe -Embedding F4B6C0AC556B4BDBCA932BA88603FA42 MD5: E5DA170027542E25EDE42FC54C929077)

MirrorOpSetup64.exe (PID: 3356 cmdline: "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe" install MD5: 28B07DC516BFC41A35A93DC1643E143F)

clicksharelauncher.exe (PID: 2072 cmdline: "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe" MD5: 5EB03B6FF6643353FE82B59F8242F1BE)

drvinst.exe (PID: 6616 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\MirrorOpDisplay.inf" "9" "4208fae43" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

drvinst.exe (PID: 4824 cmdline: DrvInst.exe "2" "1" "ROOT\DISPLAY\0000" "C:\Windows\System32\DriverStore\FileRepository\mirroropdisplay.inf_amd64_81a2ef4ec907e6ad\mirroropdisplay.inf" "oem4.inf:*:*:1.1.174.61:Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001," "4208fae43" "0000000000000168" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

WUDFRd.sys (PID: 4 cmdline: MD5: 0B7A5464602DA68DA6BEFC2A1B5BE4C5)

IndirectKmd.sys (PID: 4 cmdline: MD5: 9B943585EF2A4917E1BC2186045E4B64)

WUDFHost.exe (PID: 6768 cmdline: "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-35dc3092-997a-462b-8ee0-c4c46c580d41 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2348cb75-16eb-4e88-aea2-36cde2ec3571 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8f9a7ac6-e24f-4275-b4e5-c5e16ce5d6a7 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-34c938a5-6219-4a04-8fb5-f0a5c593a835 -LifetimeId:f1058ddd-615d-4a9e-a592-7cb571a1dced -DeviceGroupId:v3DDKIndirectGroup -HostArg:0 MD5: 00E2EF3D2C9309CA4135195A049CC79C)

cleanup

Sigma Signatures

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\WUDFRd.sys, NewProcessName: C:\Windows\System32\drivers\WUDFRd.sys, OriginalFileName: C:\Windows\System32\drivers\WUDFRd.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: WUDFRd.sys

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\msiexec.exe, ProcessId: 1632, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Windows\System32\msiexec.exe	Window detected: WixUI_Bmp_DialogI &accept the terms in the License Agreement&Print&Back&InstallCancelBarco ClickShare - End-User License Agreement (EULA / Software License)PLEASE READ THIS DOCUMENT CAREFULLY BEFORE OPENING OR DOWNLOADING AND USING SOFTWARE OR HARDWARE PROVIDED TO YOU BY BARCO AS IT CONTAINS THE TERMS AND CONDITIONS BY WHICH BARCO OFFERS TO LICENSE THE SOFTWARE. BY OPENING THE SOFTWARE PACKAGE OR USING THE HARDWARE IN WHICH THE SOFTWARE IS EMBEDDED YOU AGREE TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT.The Software as supplied by BARCO is licensed not sold to you on a non-exclusive basis for use only under the terms of this license and BARCO reserve all rights not expressly granted to you. You may own the carrier on which the Software is provided but the Software is owned and copyrighted by BARCO or by third party suppliers. Your license confers no title or ownership and is not a sale of any rights in the Software or its documentation.By installing executing and/or using the Software either as initial version or as an upgrade update patch or enhancement of a prior release this Software License shall supersede any terms and conditions previously agreed upon (whether or not in writing) between Barco and you with respect to the subject matter of this Software License and such previous terms shall from the date hereof cease to have any force or effect; provided however that this Software License shall not be construed as a renunciation discharge or waiver of any right or remedy provided in any terms and conditions previously agreed upon with respect to a failure of either party to perform any of its obligations under any terms and conditions previously agreed upon. Software SpecificationsThe Software contains the following software products: ClickShare Software License Terms1 This Software License is between you and BARCO NV a corporation organized and existing under the laws of Belgium registered under number BE 0473.191.041 Commercial Companies' Register of Kortrijk having its registered office President Kennedypark 35 at B-8500 Kortrijk Belgium ("Barco") for the use of the Software.You hereby undertake to inform all users authorized by you to make use of the computing device on which the Software is loaded/installed ("Authorized Users") of the terms of this Software License and to bind all Authorized Users to accept all such terms of this Software License as applies to them.2 Barco grants you a limited non-exclusive non-assignable non-transferable user license (without the right to grant sublicenses). Unless specifically agreed upon otherwise between you and Barco or unless specifically allowed by the Software (or its DRM management) itself i) the license under this Software License applies to one (1) copy of the Software to be used on one single computing device and ii) installation on a computing device that may be concurrently accessed by more than one user shall not constitute a permitted use and a separate license is required for
Source: C:\Windows\System32\msiexec.exe	Window detected: WixUI_Bmp_DialogI &accept the terms in the License Agreement&Print&Back&InstallCancelBarco ClickShare - End-User License Agreement (EULA / Software License)PLEASE READ THIS DOCUMENT CAREFULLY BEFORE OPENING OR DOWNLOADING AND USING SOFTWARE OR HARDWARE PROVIDED TO YOU BY BARCO AS IT CONTAINS THE TERMS AND CONDITIONS BY WHICH BARCO OFFERS TO LICENSE THE SOFTWARE. BY OPENING THE SOFTWARE PACKAGE OR USING THE HARDWARE IN WHICH THE SOFTWARE IS EMBEDDED YOU AGREE TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT.The Software as supplied by BARCO is licensed not sold to you on a non-exclusive basis for use only under the terms of this license and BARCO reserve all rights not expressly granted to you. You may own the carrier on which the Software is provided but the Software is owned and copyrighted by BARCO or by third party suppliers. Your license confers no title or ownership and is not a sale of any rights in the Software or its documentation.By installing executing and/or using the Software either as initial version or as an upgrade update patch or enhancement of a prior release this Software License shall supersede any terms and conditions previously agreed upon (whether or not in writing) between Barco and you with respect to the subject matter of this Software License and such previous terms shall from the date hereof cease to have any force or effect; provided however that this Software License shall not be construed as a renunciation discharge or waiver of any right or remedy provided in any terms and conditions previously agreed upon with respect to a failure of either party to perform any of its obligations under any terms and conditions previously agreed upon. Software SpecificationsThe Software contains the following software products: ClickShare Software License Terms1 This Software License is between you and BARCO NV a corporation organized and existing under the laws of Belgium registered under number BE 0473.191.041 Commercial Companies' Register of Kortrijk having its registered office President Kennedypark 35 at B-8500 Kortrijk Belgium ("Barco") for the use of the Software.You hereby undertake to inform all users authorized by you to make use of the computing device on which the Software is loaded/installed ("Authorized Users") of the terms of this Software License and to bind all Authorized Users to accept all such terms of this Software License as applies to them.2 Barco grants you a limited non-exclusive non-assignable non-transferable user license (without the right to grant sublicenses). Unless specifically agreed upon otherwise between you and Barco or unless specifically allowed by the Software (or its DRM management) itself i) the license under this Software License applies to one (1) copy of the Software to be used on one single computing device and ii) installation on a computing device that may be concurrently accessed by more than one user shall not constitute a permitted use and a separate license is required for

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

File created: C:\Users\Public\MirrorOpDisplaySetup.log

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\eula.txt

Jump to behavior

Source:	Binary string: E:\V3DDK_DIR\v3DDKIndirect\trunk\Release\MirrorOpVirtualDisplay1_0.pdb source: MirrorOpVirtualDisplay1_0.dll0.2.dr
Source:	Binary string: DIFxApp.pdb source: ClickShare-Extension-Pack-01.01.02.0007.msi, MSIB79.tmp.2.dr, MSI3067.tmp.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: DIFxApp.pdb@UVWATAUH source: ClickShare-Extension-Pack-01.01.02.0007.msi, MSIB79.tmp.2.dr, MSI3067.tmp.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: DIFxAppA.pdb source: ClickShare-Extension-Pack-01.01.02.0007.msi, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDKIndirect\trunk\Release\MirrorOpVirtualDisplay1_2.pdb source: MirrorOpVirtualDisplay1_2.dll0.2.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDK_CUSTOMER_SETUP\Release\MirrorOpSetup32.pdb source: MirrorOpSetup32.exe.2.dr
Source:	Binary string: DIFxAppA.pdb@UVWATAUH source: ClickShare-Extension-Pack-01.01.02.0007.msi, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDK_CUSTOMER_SETUP\x64\Release\MirrorOpSetup64.pdb source: MirrorOpSetup64.exe, 00000007.00000000.2075885646.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmp, MirrorOpSetup64.exe, 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmp, MirrorOpSetup64.exe.2.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDKIndirect\trunk\x64\Release\MirrorOpVirtualDisplay1_2.pdb source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, WUDFHost.exe, 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmp, SET15A9.tmp.9.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDKIndirect\trunk\x64\Release\MirrorOpVirtualDisplay1_0.pdb source: MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, SET1589.tmp.9.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_0.dll.2.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\uica.pdb source: ClickShare-Extension-Pack-01.01.02.0007.msi, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\wixca.pdb source: ClickShare-Extension-Pack-01.01.02.0007.msi, 3f0637.msi.2.dr, 3f0639.msi.2.dr, MSI8A8.tmp.2.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E1F6F0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,		7_2_00007FF642E1F6F0
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E11650 GetWindowsDirectoryW,GetLastError,PathAppendW,GetLastError,PathAppendW,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,FindClose,PathStripPathW,SetupUninstallOEMInfW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		7_2_00007FF642E11650

Source: clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp

String found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)

Source: clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://bugreports.qt.io/
Source: clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://bugreports.qt.io/finishedMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogicRocket
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://changelogs.ubuntu.com/changelogs/pool/main/p/pixman/pixman_0.10.0-0ubuntu1/libpixman-1-0.copy
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://creativecommons.org/licenses/by-sa/3.0/
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 3f0639.msi.2.dr	String found in binary or memory: http://dejavu-fonts.org/wiki/License
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://doc.qt.io/qt-5/lgpl.html
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://freetype.sourceforge.net/FTL.TXT
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://ftp.gnu.org/non-gnu/chinese-fonts-truetype/LICENSE
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://github.com/aFarkas/html5shiv/blob/master/MIT%20and%20GPL2%20licenses.md
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://metadata.ftp-master.debian.org/changelogs//main/libs/libsm/libsm_1.2.2-1_copyright
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://metadata.ftp-master.debian.org/changelogs//main/t/ttf-sazanami/ttf-sazanami_20040629-8_copyri
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: 3f0639.msi.2.dr	String found in binary or memory: http://opensource.org/licenses/BSD-3-Clause
Source: 3f0639.msi.2.dr	String found in binary or memory: http://opensource.org/licenses/GPL-2.0
Source: 3f0639.msi.2.dr	String found in binary or memory: http://opensource.org/licenses/ISC
Source: 3f0639.msi.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://opensource.org/licenses/bsd-license.php
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://opensource.org/licenses/mit-license.php
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://perldoc.perl.org/perlartistic.html
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://s.symcd.com06
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://s.symcd.com0_
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://srp.stanford.edu/license.txt
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://sw.symcd.com0
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 3f0639.msi.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://www.cryptopp.com/License.txt
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://www.denx.de/wiki/U-Boot/Licensing
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://www.gnu.org/copyleft/fdl.html
Source: 3f0639.msi.2.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl.html
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl.txt
Source: 3f0639.msi.2.dr	String found in binary or memory: http://www.gnu.org/licenses/lgpl.html
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://www.gnu.org/licenses/old-licenses/gpl-1.0.html
Source: 3f0639.msi.2.dr	String found in binary or memory: http://www.gnu.org/licenses/old-licenses/gpl-2.0.html
Source: 3f0639.msi.2.dr	String found in binary or memory: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://www.libpng.org/pub/png/src/libpng-LICENSE.txt
Source: 3f0639.msi.2.dr	String found in binary or memory: http://www.openssl.org/source/license.html
Source: clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: http://www.php.net/license/3_01.txt
Source: clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.phreedom.org/md5)
Source: clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: SET2037.tmp.10.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: https://d.symcb.com/rpa0)
Source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, MirrorOpSetup64.exe.2.dr, MirrorOpVirtualDisplay1_2.dll0.2.dr, MirrorOpVirtualDisplay1_0.dll0.2.dr, SET15A9.tmp.9.dr, SET1589.tmp.9.dr, MirrorOpSetup32.exe.2.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, MirrorOpVirtualDisplay1_0.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/EvanHahn/HumanizeDuration.js
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/ablanco/jquery.pwstrength.bootstrap/blob/master/GPL-LICENSE.txt
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/ablanco/jquery.pwstrength.bootstrap/commit/19480555e8c7c2f417d78a78dac63056fa221f
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/certnanny/sscep/blob/master/COPYRIGHT
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/hayageek/jquery-upload-file
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/malsup/form#copyright-and-license
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/moment/moment/
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/nnnick/Chart.js/blob/master/LICENSE.md
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://github.com/scottjehl/Respond/blob/master/LICENSE-MIT
Source: 3f0639.msi.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://jquery.org/license/
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://opensource.org/licenses/BSD-3-Clause
Source: 3f0639.msi.2.dr	String found in binary or memory: https://opensource.org/licenses/MIT
Source: 3f0639.msi.2.dr	String found in binary or memory: https://osdn.jp/cvs/view/efont/sazanami/README
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://raw.github.com/joyent/node/v0.10.26/LICENSE
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://wiki.gnome.org/FoundationBoard/Resources/LicensingAgreement
Source: 3f0639.msi.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, clicksharelauncher.exe.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	String found in binary or memory: https://www.gnu.org/licenses/gpl.html

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\SET15C9.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\mirroropdisplay.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	File created: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\mirroropdisplay.cat (copy)	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	File created: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\SET1368.tmp	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe

File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3f0637.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB49.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB79.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}\icon.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3f0639.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3f0639.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3067.tmp	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	File created: C:\Windows\INF\c_display.PNF	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\mirroropdisplay.inf_amd64_81a2ef4ec907e6ad	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\mirroropdisplay.inf_amd64_81a2ef4ec907e6ad\amd64	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\UMDF\SET2037.tmp	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\UMDF\SET2037.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI8A8.tmp

Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E11020	7_2_00007FF642E11020
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E135F0	7_2_00007FF642E135F0
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E197E8	7_2_00007FF642E197E8
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E247F4	7_2_00007FF642E247F4
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E253AC	7_2_00007FF642E253AC
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E1535C	7_2_00007FF642E1535C
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E1B9F8	7_2_00007FF642E1B9F8
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E22DBC	7_2_00007FF642E22DBC
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E22990	7_2_00007FF642E22990
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E28568	7_2_00007FF642E28568
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E1D6EC	7_2_00007FF642E1D6EC
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E1F6F0	7_2_00007FF642E1F6F0
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E19AC8	7_2_00007FF642E19AC8
Source: C:\Windows\System32\WUDFHost.exe	Code function: 13_2_00007FF8B90AC734	13_2_00007FF8B90AC734

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Code function: String function: 00007FF642E129C0 appears 48 times

Source: MSIB79.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: MSIB79.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: MSIB79.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: MSI3067.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: MSI3067.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: MSI3067.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: ClickShare-Extension-Pack-01.01.02.0007.msi	Binary or memory string: OriginalFilenameuica.dll\ vs ClickShare-Extension-Pack-01.01.02.0007.msi
Source: ClickShare-Extension-Pack-01.01.02.0007.msi	Binary or memory string: OriginalFilenameDIFxApp.dll vs ClickShare-Extension-Pack-01.01.02.0007.msi
Source: ClickShare-Extension-Pack-01.01.02.0007.msi	Binary or memory string: OriginalFilenameDIFxAppA.dll vs ClickShare-Extension-Pack-01.01.02.0007.msi
Source: ClickShare-Extension-Pack-01.01.02.0007.msi	Binary or memory string: OriginalFilenamewixca.dll\ vs ClickShare-Extension-Pack-01.01.02.0007.msi

Source: unknown

Driver loaded: C:\Windows\System32\drivers\WUDFRd.sys

Source: classification engine

Classification label: clean9.evad.winMSI@16/61@0/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Barco

Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

File created: C:\Users\Public\MirrorOpDisplaySetup.log

Jump to behavior

Source: C:\Windows\System32\drvinst.exe	Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFA1094AAB77BE8A5A.TMP

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "clicksharelauncher.exe")

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: ClickShare-Extension-Pack-01.01.02.0007.msi

Static file information: TRID: Microsoft Windows Installer (60509/1) 57.88%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ClickShare-Extension-Pack-01.01.02.0007.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E6B16BCC263E80D188A4984C7B267598
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /F /IM clicksharelauncher.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding F4B6C0AC556B4BDBCA932BA88603FA42
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe" install
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\MirrorOpDisplay.inf" "9" "4208fae43" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx"
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "1" "ROOT\DISPLAY\0000" "C:\Windows\System32\DriverStore\FileRepository\mirroropdisplay.inf_amd64_81a2ef4ec907e6ad\mirroropdisplay.inf" "oem4.inf:::1.1.174.61:Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001," "4208fae43" "0000000000000168"
Source: unknown	Process created: C:\Windows\System32\WUDFHost.exe "C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-35dc3092-997a-462b-8ee0-c4c46c580d41 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2348cb75-16eb-4e88-aea2-36cde2ec3571 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8f9a7ac6-e24f-4275-b4e5-c5e16ce5d6a7 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-34c938a5-6219-4a04-8fb5-f0a5c593a835 -LifetimeId:f1058ddd-615d-4a9e-a592-7cb571a1dced -DeviceGroupId:v3DDKIndirectGroup -HostArg:0
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding E6B16BCC263E80D188A4984C7B267598	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding F4B6C0AC556B4BDBCA932BA88603FA42	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe" install	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /F /IM clicksharelauncher.exe	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: drvsetup.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: wudfplatform.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: wpprecorderum.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: wudfx02000.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: wintab32.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Section loaded: msasn1.dll	Jump to behavior

Source: ClickShare Launcher.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe
Source: ClickShare Launcher.lnk0.2.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe

Source: C:\Windows\System32\msiexec.exe	Automated click: I accept the terms in the License Agreement
Source: C:\Windows\System32\msiexec.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\msiexec.exe	Window detected: WixUI_Bmp_DialogI &accept the terms in the License Agreement&Print&Back&InstallCancelBarco ClickShare - End-User License Agreement (EULA / Software License)PLEASE READ THIS DOCUMENT CAREFULLY BEFORE OPENING OR DOWNLOADING AND USING SOFTWARE OR HARDWARE PROVIDED TO YOU BY BARCO AS IT CONTAINS THE TERMS AND CONDITIONS BY WHICH BARCO OFFERS TO LICENSE THE SOFTWARE. BY OPENING THE SOFTWARE PACKAGE OR USING THE HARDWARE IN WHICH THE SOFTWARE IS EMBEDDED YOU AGREE TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT.The Software as supplied by BARCO is licensed not sold to you on a non-exclusive basis for use only under the terms of this license and BARCO reserve all rights not expressly granted to you. You may own the carrier on which the Software is provided but the Software is owned and copyrighted by BARCO or by third party suppliers. Your license confers no title or ownership and is not a sale of any rights in the Software or its documentation.By installing executing and/or using the Software either as initial version or as an upgrade update patch or enhancement of a prior release this Software License shall supersede any terms and conditions previously agreed upon (whether or not in writing) between Barco and you with respect to the subject matter of this Software License and such previous terms shall from the date hereof cease to have any force or effect; provided however that this Software License shall not be construed as a renunciation discharge or waiver of any right or remedy provided in any terms and conditions previously agreed upon with respect to a failure of either party to perform any of its obligations under any terms and conditions previously agreed upon. Software SpecificationsThe Software contains the following software products: ClickShare Software License Terms1 This Software License is between you and BARCO NV a corporation organized and existing under the laws of Belgium registered under number BE 0473.191.041 Commercial Companies' Register of Kortrijk having its registered office President Kennedypark 35 at B-8500 Kortrijk Belgium ("Barco") for the use of the Software.You hereby undertake to inform all users authorized by you to make use of the computing device on which the Software is loaded/installed ("Authorized Users") of the terms of this Software License and to bind all Authorized Users to accept all such terms of this Software License as applies to them.2 Barco grants you a limited non-exclusive non-assignable non-transferable user license (without the right to grant sublicenses). Unless specifically agreed upon otherwise between you and Barco or unless specifically allowed by the Software (or its DRM management) itself i) the license under this Software License applies to one (1) copy of the Software to be used on one single computing device and ii) installation on a computing device that may be concurrently accessed by more than one user shall not constitute a permitted use and a separate license is required for
Source: C:\Windows\System32\msiexec.exe	Window detected: WixUI_Bmp_DialogI &accept the terms in the License Agreement&Print&Back&InstallCancelBarco ClickShare - End-User License Agreement (EULA / Software License)PLEASE READ THIS DOCUMENT CAREFULLY BEFORE OPENING OR DOWNLOADING AND USING SOFTWARE OR HARDWARE PROVIDED TO YOU BY BARCO AS IT CONTAINS THE TERMS AND CONDITIONS BY WHICH BARCO OFFERS TO LICENSE THE SOFTWARE. BY OPENING THE SOFTWARE PACKAGE OR USING THE HARDWARE IN WHICH THE SOFTWARE IS EMBEDDED YOU AGREE TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT.The Software as supplied by BARCO is licensed not sold to you on a non-exclusive basis for use only under the terms of this license and BARCO reserve all rights not expressly granted to you. You may own the carrier on which the Software is provided but the Software is owned and copyrighted by BARCO or by third party suppliers. Your license confers no title or ownership and is not a sale of any rights in the Software or its documentation.By installing executing and/or using the Software either as initial version or as an upgrade update patch or enhancement of a prior release this Software License shall supersede any terms and conditions previously agreed upon (whether or not in writing) between Barco and you with respect to the subject matter of this Software License and such previous terms shall from the date hereof cease to have any force or effect; provided however that this Software License shall not be construed as a renunciation discharge or waiver of any right or remedy provided in any terms and conditions previously agreed upon with respect to a failure of either party to perform any of its obligations under any terms and conditions previously agreed upon. Software SpecificationsThe Software contains the following software products: ClickShare Software License Terms1 This Software License is between you and BARCO NV a corporation organized and existing under the laws of Belgium registered under number BE 0473.191.041 Commercial Companies' Register of Kortrijk having its registered office President Kennedypark 35 at B-8500 Kortrijk Belgium ("Barco") for the use of the Software.You hereby undertake to inform all users authorized by you to make use of the computing device on which the Software is loaded/installed ("Authorized Users") of the terms of this Software License and to bind all Authorized Users to accept all such terms of this Software License as applies to them.2 Barco grants you a limited non-exclusive non-assignable non-transferable user license (without the right to grant sublicenses). Unless specifically agreed upon otherwise between you and Barco or unless specifically allowed by the Software (or its DRM management) itself i) the license under this Software License applies to one (1) copy of the Software to be used on one single computing device and ii) installation on a computing device that may be concurrently accessed by more than one user shall not constitute a permitted use and a separate license is required for

Source: ClickShare-Extension-Pack-01.01.02.0007.msi

Static file information: File size 7888896 > 1048576

Source:	Binary string: E:\V3DDK_DIR\v3DDKIndirect\trunk\Release\MirrorOpVirtualDisplay1_0.pdb source: MirrorOpVirtualDisplay1_0.dll0.2.dr
Source:	Binary string: DIFxApp.pdb source: ClickShare-Extension-Pack-01.01.02.0007.msi, MSIB79.tmp.2.dr, MSI3067.tmp.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: DIFxApp.pdb@UVWATAUH source: ClickShare-Extension-Pack-01.01.02.0007.msi, MSIB79.tmp.2.dr, MSI3067.tmp.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: DIFxAppA.pdb source: ClickShare-Extension-Pack-01.01.02.0007.msi, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDKIndirect\trunk\Release\MirrorOpVirtualDisplay1_2.pdb source: MirrorOpVirtualDisplay1_2.dll0.2.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDK_CUSTOMER_SETUP\Release\MirrorOpSetup32.pdb source: MirrorOpSetup32.exe.2.dr
Source:	Binary string: DIFxAppA.pdb@UVWATAUH source: ClickShare-Extension-Pack-01.01.02.0007.msi, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDK_CUSTOMER_SETUP\x64\Release\MirrorOpSetup64.pdb source: MirrorOpSetup64.exe, 00000007.00000000.2075885646.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmp, MirrorOpSetup64.exe, 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmp, MirrorOpSetup64.exe.2.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDKIndirect\trunk\x64\Release\MirrorOpVirtualDisplay1_2.pdb source: MirrorOpSetup64.exe, 00000007.00000003.2086881460.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2094006943.000002BD8619E000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2098477873.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000A.00000003.2125330206.00000262BEF3B000.00000004.00000020.00020000.00000000.sdmp, WUDFHost.exe, 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmp, SET15A9.tmp.9.dr, MirrorOpVirtualDisplay1_2.dll.2.dr, SET1338.tmp.7.dr, SET2037.tmp.10.dr
Source:	Binary string: E:\V3DDK_DIR\v3DDKIndirect\trunk\x64\Release\MirrorOpVirtualDisplay1_0.pdb source: MirrorOpSetup64.exe, 00000007.00000003.2083285715.00000211E8D8C000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000009.00000003.2097148446.000002BD867D1000.00000004.00000020.00020000.00000000.sdmp, SET1589.tmp.9.dr, SET11D0.tmp.7.dr, MirrorOpVirtualDisplay1_0.dll.2.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\uica.pdb source: ClickShare-Extension-Pack-01.01.02.0007.msi, 3f0637.msi.2.dr, 3f0639.msi.2.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\wixca.pdb source: ClickShare-Extension-Pack-01.01.02.0007.msi, 3f0637.msi.2.dr, 3f0639.msi.2.dr, MSI8A8.tmp.2.dr

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB79.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET1589.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	File created: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET1338.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	File created: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET15A9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	File created: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\UMDF\MirrorOpVirtualDisplay1_2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\UMDF\SET2037.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_0.dll	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	File created: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET11D0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup32.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3067.tmp	Jump to dropped file

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIB79.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET1589.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8A8.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET15A9.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\UMDF\MirrorOpVirtualDisplay1_2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\drivers\UMDF\SET2037.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3067.tmp	Jump to dropped file

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

File created: C:\Users\Public\MirrorOpDisplaySetup.log

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\eula.txt

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ClickShare Launcher.lnk

Jump to behavior

Source: C:\Windows\System32\drivers\WUDFRd.sys

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WUDFRd\Parameters\Wdf

Jump to behavior

Source: C:\Windows\System32\drvinst.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WUDFRd

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Barco	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Barco\ClickShare Launcher	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Barco\ClickShare Launcher\ClickShare Launcher.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ClickShare Launcher.lnk	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WUDFHost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Code function: 7_2_00007FF642E11020 SetupDiCreateDeviceInfoList,GetLastError,SetupDiCreateDeviceInfoW,GetLastError,GetLastError,lstrlenW,SetupDiSetDeviceRegistryPropertyW,GetLastError,SetupDiGetClassDevsW,GetLastError,SetupDiCallClassInstaller,GetLastError,SetupDiEnumDeviceInfo,SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiEnumDeviceInfo,SetupDiDestroyDeviceInfoList,

7_2_00007FF642E11020

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Window / User API: threadDelayed 4906			Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Window / User API: threadDelayed 5093			Jump to behavior

Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIB79.tmp	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET1589.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8A8.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET1338.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET15A9.tmp	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\UMDF\MirrorOpVirtualDisplay1_2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\UMDF\SET2037.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_2.dll	Jump to dropped file
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET11D0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_0.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_0.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup32.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI3067.tmp	Jump to dropped file

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_7-9195

Source: C:\Windows\System32\WUDFHost.exe

API coverage: 8.2 %

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe TID: 3192	Thread sleep count: 4906 > 30	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe TID: 3192	Thread sleep time: -2453000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe TID: 3192	Thread sleep count: 5093 > 30	Jump to behavior
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe TID: 3192	Thread sleep time: -2546500s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E1F6F0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,		7_2_00007FF642E1F6F0
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E11650 GetWindowsDirectoryW,GetLastError,PathAppendW,GetLastError,PathAppendW,GetLastError,FindFirstFileW,GetLastError,FindNextFileW,FindClose,PathStripPathW,SetupUninstallOEMInfW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		7_2_00007FF642E11650

Source: setupapi.dev.log.7.dr	Binary or memory string: set: BIOS Vendor: VMware, Inc.
Source: clicksharelauncher.exe, 0000000E.00000002.4460053394.0000000001345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b!S
Source: setupapi.dev.log.7.dr	Binary or memory string: sig: Key = vmci.inf
Source: clicksharelauncher.exe, 0000000E.00000002.4460053394.0000000001345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}a#P
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&0000000000&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: Service Name = vmci
Source: setupapi.dev.log.7.dr	Binary or memory string: idb: {Publish Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf} 11:48:39.707
Source: setupapi.dev.log.7.dr	Binary or memory string: idb: Indexed 4 device IDs for 'vmci.inf_amd64_68ed49469341f563'.
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001303000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}+
Source: setupapi.dev.log.7.dr	Binary or memory string: set: System Product Name: VMware20,1
Source: setupapi.dev.log.7.dr	Binary or memory string: sto: {Configure Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf}
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: setupapi.dev.log.7.dr	Binary or memory string: sto: {Stage Driver Package: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.634
Source: clicksharelauncher.exe, 0000000E.00000002.4460053394.0000000001345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`=Q
Source: setupapi.dev.log.7.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.inf' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.inf'.
Source: setupapi.dev.log.7.dr	Binary or memory string: cpy: Target Path = C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563
Source: setupapi.dev.log.7.dr	Binary or memory string: idb: Created driver package object 'vmci.inf_amd64_68ed49469341f563' in SYSTEM database node.
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: Image Path = System32\drivers\vmci.sys
Source: setupapi.dev.log.7.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.sys' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.sys'.
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001303000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2024-04-19T07:47:27:389d_vmware_sata_cd00#4&224f42ef&0
Source: clicksharelauncher.exe, 0000000E.00000003.2168643484.0000000001322000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&00000
Source: setupapi.dev.log.7.dr	Binary or memory string: idb: Registered driver package 'vmci.inf_amd64_68ed49469341f563' with 'oem2.inf'.
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: Driver package 'vmci.inf' is configurable.
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: clicksharelauncher.exe, 0000000E.00000002.4460053394.0000000001345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}d5]
Source: clicksharelauncher.exe, 0000000E.00000002.4460053394.0000000001345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}f9_
Source: setupapi.dev.log.7.dr	Binary or memory string: sto: {Core Driver Package Import: vmci.inf_amd64_68ed49469341f563} 11:48:39.704
Source: setupapi.dev.log.7.dr	Binary or memory string: flq: Copying 'C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.sys' to 'C:\Windows\System32\drivers\vmci.sys'.
Source: setupapi.dev.log.7.dr	Binary or memory string: set: System Manufacturer: VMware, Inc.
Source: clicksharelauncher.exe, 0000000E.00000002.4460053394.0000000001345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}g?^
Source: clicksharelauncher.exe, 0000000E.00000002.4460053394.0000000001345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}e;\
Source: setupapi.dev.log.7.dr	Binary or memory string: dvs: {Driver Setup Import Driver Package: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.178
Source: setupapi.dev.log.7.dr	Binary or memory string: idb: Activating driver package 'vmci.inf_amd64_68ed49469341f563'.
Source: setupapi.dev.log.7.dr	Binary or memory string: cpy: Published 'vmci.inf_amd64_68ed49469341f563\vmci.inf' to 'oem2.inf'.
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: {Add Service: vmci}
Source: clicksharelauncher.exe, 0000000E.00000003.2834299246.000000000132C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: Created new service 'vmci'.
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001303000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}O
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: Display Name = VMware VMCI Bus Driver
Source: setupapi.dev.log.7.dr	Binary or memory string: set: PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3F -> Configured [oem2.inf:PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD,vmci.install.x64.NT] and started (ConfigFlags = 0x00000000).
Source: clicksharelauncher.exe, 0000000E.00000003.2162382507.0000000001322000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}/
Source: setupapi.dev.log.7.dr	Binary or memory string: set: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000 -> Configured [disk.inf:GenDisk,disk_install.NT] and started (ConfigFlags = 0x00000000).
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ddtN
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001303000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}j
Source: setupapi.dev.log.7.dr	Binary or memory string: utl: Driver INF - oem2.inf (C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf)
Source: setupapi.dev.log.7.dr	Binary or memory string: set: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000 -> Configured [cdrom.inf:GenCdRom,cdrom_install] and started (ConfigFlags = 0x00000000).
Source: setupapi.dev.log.7.dr	Binary or memory string: sig: Installed catalog 'vmci.cat' as 'oem2.cat'.
Source: setupapi.dev.log.7.dr	Binary or memory string: sig: FilePath = C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.inf
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: {Configure Driver Configuration: vmci.install.x64.NT}
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000000000c5e500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: clicksharelauncher.exe, 0000000E.00000003.2162422103.000000000131A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000c5e500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: setupapi.dev.log.7.dr	Binary or memory string: flq: Copying 'C:\Windows\SoftwareDistribution\Download\Install\vmci.cat' to 'C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.cat'.
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&0000000000
Source: clicksharelauncher.exe, 0000000E.00000002.4460053394.000000000133D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000c5e500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: setupapi.dev.log.7.dr	Binary or memory string: sig: Catalog = C:\Windows\System32\DriverStore\Temp\{5a5b2f36-11ff-5a4a-b3b1-6fc00ed67f26}\vmci.cat
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: Section Name = vmci.install.x64.NT
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: {Configure Driver: VMware VMCI Bus Device}
Source: clicksharelauncher.exe, 0000000E.00000002.4459946442.0000000001321000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&0000000000d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8
Source: setupapi.dev.log.7.dr	Binary or memory string: inf: {Query Configurability: C:\Windows\SoftwareDistribution\Download\Install\vmci.inf} 11:48:39.636
Source: setupapi.dev.log.7.dr	Binary or memory string: idb: {Register Driver Package: C:\Windows\System32\DriverStore\FileRepository\vmci.inf_amd64_68ed49469341f563\vmci.inf} 11:48:39.707
Source: clicksharelauncher.exe, 0000000E.00000002.4458650333.0000000000D1A000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: .?AVQEmulationPaintEngine@@

Source: C:\Windows\System32\drivers\WUDFRd.sys

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Code function: 7_2_00007FF642E183BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00007FF642E183BC

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Code function: 7_2_00007FF642E21CD8 GetProcessHeap,

7_2_00007FF642E21CD8

Source: C:\Windows\SysWOW64\taskkill.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe"

Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E14828 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF642E14828
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E183BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF642E183BC
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E150B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF642E150B8
Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	Code function: 7_2_00007FF642E1529C SetUnhandledExceptionFilter,	7_2_00007FF642E1529C
Source: C:\Windows\System32\WUDFHost.exe	Code function: 13_2_00007FF8B90AC570 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00007FF8B90AC570
Source: C:\Windows\System32\WUDFHost.exe	Code function: 13_2_00007FF8B90ABF64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00007FF8B90ABF64

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe" install			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /F /IM clicksharelauncher.exe			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /F /IM clicksharelauncher.exe

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\drvinst.exe drvinst.exe "4" "0" "c:\users\user\appdata\local\temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\mirroropdisplay.inf" "9" "4208fae43" "0000000000000154" "winsta0\default" "000000000000016c" "208" "c:\program files (x86)\barco\clickshare extension pack\extended desktop driver\iddcx"
Source: unknown	Process created: C:\Windows\System32\WUDFHost.exe "c:\windows\system32\wudfhost.exe" -hostguid:{193a1820-d9ac-4997-8c55-be817523f6aa} -ioeventportname:\umdfcommunicationports\wudf\hostprocess-35dc3092-997a-462b-8ee0-c4c46c580d41 -systemeventportname:\umdfcommunicationports\wudf\hostprocess-2348cb75-16eb-4e88-aea2-36cde2ec3571 -iocanceleventportname:\umdfcommunicationports\wudf\hostprocess-8f9a7ac6-e24f-4275-b4e5-c5e16ce5d6a7 -nonstatechangingeventportname:\umdfcommunicationports\wudf\hostprocess-34c938a5-6219-4a04-8fb5-f0a5c593a835 -lifetimeid:f1058ddd-615d-4a9e-a592-7cb571a1dced -devicegroupid:v3ddkindirectgroup -hostarg:0

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Code function: 7_2_00007FF642E28280 cpuid

7_2_00007FF642E28280

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

7_2_00007FF642E11020

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\mirroropdisplay.cat VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Code function: 7_2_00007FF642E13F70 GetLocalTime,_invalid_parameter_noinfo_noreturn,

7_2_00007FF642E13F70

Source: C:\Windows\System32\drvinst.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	2 LSASS Driver	2 LSASS Driver	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Windows Service	2 Windows Service	11 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	11 Process Injection	1 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	21 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	32 Masquerading	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ClickShare-Extension-Pack-01.01.02.0007.msi	2%	ReversingLabs
ClickShare-Extension-Pack-01.01.02.0007.msi	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup32.exe	0%	ReversingLabs
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup32.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	0%	ReversingLabs
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe	0%	Virustotal	Browse
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_0.dll	0%	ReversingLabs
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_0.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_2.dll	0%	ReversingLabs
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_2.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_0.dll	0%	ReversingLabs
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_0.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_2.dll	0%	ReversingLabs
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_2.dll	0%	Virustotal	Browse
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	0%	ReversingLabs
C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET11D0.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET11D0.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET1338.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET1338.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI3067.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI3067.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSI8A8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8A8.tmp	0%	Virustotal	Browse
C:\Windows\Installer\MSIB79.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIB79.tmp	0%	Virustotal	Browse
C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)	0%	Virustotal	Browse
C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)	0%	Virustotal	Browse
C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET1589.tmp	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET1589.tmp	0%	Virustotal	Browse
C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET15A9.tmp	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET15A9.tmp	0%	Virustotal	Browse

Source	Detection	Scanner	Link
http://dejavu-fonts.org/wiki/License	0%	Virustotal	Browse
http://www.phreedom.org/md5)08:27	1%	Virustotal	Browse
http://www.phreedom.org/md5)	1%	Virustotal	Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://doc.qt.io/qt-5/lgpl.html	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.phreedom.org/md5)08:27	clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	false	1%, Virustotal, Browse	unknown
https://github.com/certnanny/sscep/blob/master/COPYRIGHT	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://perldoc.perl.org/perlartistic.html	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://opensource.org/licenses/MIT	3f0639.msi.2.dr	false		high
http://www.gnu.org/licenses/old-licenses/gpl-1.0.html	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.gnu.org/licenses/old-licenses/gpl-2.0.html	3f0639.msi.2.dr	false		high
https://wiki.gnome.org/FoundationBoard/Resources/LicensingAgreement	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://opensource.org/licenses/BSD-3-Clause	3f0639.msi.2.dr	false		high
https://osdn.jp/cvs/view/efont/sazanami/README	3f0639.msi.2.dr	false		high
http://ftp.gnu.org/non-gnu/chinese-fonts-truetype/LICENSE	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://www.gnu.org/licenses/gpl.html	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://bugreports.qt.io/	clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	false		high
http://www.openssl.org/support/faq.html	clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	false		high
http://www.openssl.org/source/license.html	3f0639.msi.2.dr	false		high
https://github.com/ablanco/jquery.pwstrength.bootstrap/commit/19480555e8c7c2f417d78a78dac63056fa221f	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://dejavu-fonts.org/wiki/License	3f0639.msi.2.dr	false	0%, Virustotal, Browse	unknown
https://opensource.org/licenses/BSD-3-Clause	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://github.com/nnnick/Chart.js/blob/master/LICENSE.md	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://metadata.ftp-master.debian.org/changelogs//main/t/ttf-sazanami/ttf-sazanami_20040629-8_copyri	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://github.com/EvanHahn/HumanizeDuration.js	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.denx.de/wiki/U-Boot/Licensing	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://github.com/ablanco/jquery.pwstrength.bootstrap/blob/master/GPL-LICENSE.txt	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE	3f0639.msi.2.dr	false		high
http://www.phreedom.org/md5)	clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	false	1%, Virustotal, Browse	unknown
https://github.com/hayageek/jquery-upload-file	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	3f0639.msi.2.dr	false		high
https://raw.github.com/joyent/node/v0.10.26/LICENSE	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://opensource.org/licenses/mit-license.php	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://github.com/scottjehl/Respond/blob/master/LICENSE-MIT	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html	3f0639.msi.2.dr	false		high
http://bugreports.qt.io/finishedMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogicRocket	clicksharelauncher.exe, 0000000E.00000002.4458650333.00000000002B1000.00000040.00000001.01000000.00000006.sdmp	false		high
https://jquery.org/license/	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://freetype.sourceforge.net/FTL.TXT	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.gnu.org/copyleft/fdl.html	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://opensource.org/licenses/MIT	3f0639.msi.2.dr	false		high
http://www.cryptopp.com/License.txt	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://creativecommons.org/licenses/by-sa/3.0/	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://opensource.org/licenses/GPL-2.0	3f0639.msi.2.dr	false		high
http://www.libpng.org/pub/png/src/libpng-LICENSE.txt	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.gnu.org/licenses/lgpl.html	3f0639.msi.2.dr	false		high
http://www.php.net/license/3_01.txt	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://metadata.ftp-master.debian.org/changelogs//main/libs/libsm/libsm_1.2.2-1_copyright	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://changelogs.ubuntu.com/changelogs/pool/main/p/pixman/pixman_0.10.0-0ubuntu1/libpixman-1-0.copy	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.gnu.org/licenses/gpl.txt	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://opensource.org/licenses/bsd-license.php	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://github.com/moment/moment/	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
https://github.com/malsup/form#copyright-and-license	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://www.gnu.org/licenses/gpl.html	3f0639.msi.2.dr	false		high
http://opensource.org/licenses/ISC	3f0639.msi.2.dr	false		high
http://srp.stanford.edu/license.txt	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high
http://github.com/aFarkas/html5shiv/blob/master/MIT%20and%20GPL2%20licenses.md	ClickShare-Extension-Pack-01.01.02.0007.msi, eula.txt.2.dr, 3f0637.msi.2.dr, 3f0639.msi.2.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427889
Start date and time:	2024-04-18 10:07:32 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ClickShare-Extension-Pack-01.01.02.0007.msi
Detection:	CLEAN
Classification:	clean9.evad.winMSI@16/61@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 38 Number of non-executed functions: 48
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:09:08	API Interceptor	249701x Sleep call for process: clicksharelauncher.exe modified

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11326
Entropy (8bit):	5.630180597742484
Encrypted:	false
SSDEEP:	192:+FxFO1kzjlO3egiLUnEDcHEZclEruHV8NekiUMIAUM8dWlLqql3kQpneG:+RHgyQUYUTODJ
MD5:	C24FBFCD6D6026360E6D1453A9BFE577
SHA1:	E697846689D052AB626DD7952C98FC251B7F01FF
SHA-256:	6EA00D482233E6C6EB8DD938041FD389AF6F4C85EE62E1D874E4441A9FA33DFA
SHA-512:	675726CF7D49F5CD328DCD460AD6962C5F9EFF1EC3431EFFAD83B1A1A096271A287411DDA89424D36563EF0BE1674A2FBFB2FBA35AB5DC8622E2A4ACEBB99FE7
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.Q.X.@.....@.....@.....@.....@.....@......&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}..ClickShare Extension Pack+.ClickShare-Extension-Pack-01.01.02.0007.msi.@.....@.....@.....@......icon.ico..&.{A1C10D50-773A-4B79-B97F-11DA2C6B622E}.....@.....@.....@.....@.......@.....@.....@.......@......ClickShare Extension Pack......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{0526A4B8-F391-44DD-88EB-2E6D9F56FDA3}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}.@......&.{80306A65-7D78-4563-8398-CB028C046D04}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}.@......&.{5A65DD96-ED70-4796-BF98-BA86A99928F2}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}.@......&.{D866D5B6-6849-4282-BED2-0CCB2415A363}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}.@......&.{D4556B3B-F988-44E0-8A19-94FA2B77E26B}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}.@......&.{8BD51D2F-A1AD-4517-BF8F-C979B41B943B}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}.@.

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpDisplay.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup32.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	153480
Entropy (8bit):	6.518659412329164
Encrypted:	false
SSDEEP:	3072:wJWNGx3yjQrSJWZv7KePPhUebjfl+Utin46QIx88DTAAhdvH/+CIt:v2CjGS8vGexDbDtF6QIbAuHWCIt
MD5:	B952D622BD6FA6B455307D676707DF81
SHA1:	5827D7D5ABCDE9D8846CCF596B0C208CBF28CF8B
SHA-256:	BF7337E8ADF47FEDE690C5D202B07EE9C35BF3A94FB0F1AE3F6D9510187371A4
SHA-512:	DD8793AFC0D5CF423F4FA2DD17775BC8411E2795CFA001186B520E3F2629DE314E7D3EA3A6641039B42CF439284DA912339F3E22F957C5B51E93B1106F0704CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o~X..-X..-X..-=..,R..-=..,..-...,I..-...,I..-...,...-=..,K..-=..,U..-X..-$..-...,^..-...-Y..-...,Y..-RichX..-........PE..L...X;,].................v...........H............@.......................................@.....................................x....P..x............6...!...`......@...p...............................@............................................text....t.......v.................. ..`.rdata..............z..............@..@.data........0......................@....rsrc...x....P......................@..@.reloc.......`......."..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177544
Entropy (8bit):	6.232862089682279
Encrypted:	false
SSDEEP:	3072:LSfvwBxaIj5xMwcN0Ea9rRuaymHvQT4GqIxd+8A:mfvwHrfMP2EcrMdq8A
MD5:	28B07DC516BFC41A35A93DC1643E143F
SHA1:	E5BA40E5D75A9712CAC3D2B46D68B3596D91D69B
SHA-256:	096868681DBF7F7D9EF025C7B6802773AC336A843E0FD36EB17B00957936F1E1
SHA-512:	7F1B3A7D4EB238D206BB588E50173088220D621122F0A26FA499783F4C622EC9C05DAC629B6DB9A9476C30B2E350CB903F7C1E42C42813BEE0C3DCB0745D7843
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......MmQ\..?...?...?.lj<...?.lj:...?.[d;...?.[d<...?.[d:. .?.lj;...?.lj>...?...>...?..e6...?..e....?..e=...?.Rich..?.........PE..d...`;,]..........".......... .......K.........@.....................................X....`.................................................dm..x.......x.......\........!......P....K..p............................L..................X............................text............................... ..`.rdata..J...........................@..@.data...h............b..............@....pdata..\............n..............@..@.rsrc...x...........................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.4451848631475315
Encrypted:	false
SSDEEP:	1536:qzJh4x1rUUSYbNgtob1zb0sYQBsoLGJ9HfXZeAW1CGGX63hrIZJC:q9h4x1YUJxnb1zb0sM9/XZnW1CRXGj
MD5:	63E01C3D6A55C079EB96A21E89486624
SHA1:	97D348E45C8AE32613970571006217CF1303FB93
SHA-256:	3F761DE45AEF3B9A002B5C66E3AB91BD09D1CD61AD8264A99873AD67A3BF96CA
SHA-512:	AB2C2B7A8DCBFB71F48BACB27AC04C41DFD9EB5EB9BCF452FCABB81364768D9BEF571C304AEB9D1369797BD333E953E6556FF3AB67FCAB44EE35C2BE207BFEDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P...............................................i.....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.446052780127672
Encrypted:	false
SSDEEP:	1536:q/KS4Jr/6/YTYwpNgtwagzSbKYQBNoLGt9HrYZeAW1ENGXlE3hHdZe:qiS4JrIYTfzPagzSbKL9LYZnW1EEX+C
MD5:	5AD7175FC00F8E1FB330795916061AD4
SHA1:	78531503D1EF24A71D8CF7D4C0B435F2EB2E138F
SHA-256:	48EC375A3C6B5EBC7129CFA7CF1DD624A041BA82DA033AB7CCAAFF5E6C7E622D
SHA-512:	8C6B4B7AE0204ACB926CEE629E9727FA7A22745D0BC6BCC99DEDBF0121729EE158703196DB5D56CE955CD2C7EF9FD0317E733DCCB564130856335D76DE25B131
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P................................................w....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\mirroropdisplay.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	12442
Entropy (8bit):	7.07480875540708
Encrypted:	false
SSDEEP:	192:HT3xKnyJ31fmm++JCR9E7EwWZhYCWK7p1/Z09qnajlVE:z19a9Zh3/p1x09l/E
MD5:	22A18953B86C03F4D625E15350501D15
SHA1:	C0E0C223F79AA9C37C2A77EF1901331E409489FB
SHA-256:	A4808FE0F025BB6DFEA752CF6A28C0D7356909F316C9D44A05B5E47C96354294
SHA-512:	D4E89B87233DABF1F19AE8587A09E367CCCEB88EEB2E8BA78778195D10A1D6EB2A0C989B334338487863F9B8EBF2B62E531D6D1EB4BB5D70CE6124F296003DF4
Malicious:	false
Preview:	0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7.....i.3A..7E."..J....190614082119Z0...+.....7.....0...0.... Y..6....Q..>...../V.....a.@. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0J..+.....7...1<0:...F.i.l.e.......(m.i.r.r.o.r.o.p.d.i.s.p.l.a.y...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y..6....Q..>...../V.....a.@. 0....g..m.........Z..Q.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0..-. w..ci.rlF...m.........1.>.l.&V.1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... w..ci.rlF...m.........1.>.l.&V.0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0....}J./.n.&.ms.x..ZC.L1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_0.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81824
Entropy (8bit):	6.804416120850024
Encrypted:	false
SSDEEP:	1536:yK5OMXREoQfdUFaG/FMTQwJtR5QVJlj3hs1ZNG:5QModjG/FMTQwJ1QVaRG
MD5:	102A690E42B89AEC429C04B20C1A47D7
SHA1:	55C95BCC2B152440973A672558F473CA4E65820B
SHA-256:	04E4F9B8B8ADEA673887696F74E8965BDEC1FB3D24F2525F8F0D9DCE8EA26714
SHA-512:	24B056A9D8DB0AF66385DB63EB5D64FDED80DDFBA13693BA1BF67D7227C00F147AC0B7AEAA05747D64452399AEBC1461F274483DE4526135D41C090156C4A492
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;`.U3.U3.U3..Q2.U3..V2.U3..P2.U3..R2.U3...3..U3..Q2.U3..R2.U3..T2.U3.T3..U3z.P2..U3z.U2.U3z..3.U3z.W2.U3Rich.U3........................PE..L....T.]...........!.........H......@........................................0....../.....@A............................d................................E... ......@...8...........................x...................\|............................text............................... ..`.rdata...,..........................@..@.data...L...........................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_2.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	81824
Entropy (8bit):	6.804651881704946
Encrypted:	false
SSDEEP:	1536:nK5OMXREoQfdUFavAF5Tmw+tR5QVJlqG3hxnLZF:KQModjvAF5Tmw+1QV2onr
MD5:	E6E306E178E2CEC426AA2282D3CECF26
SHA1:	A4264C01DAF22149DD53206F4EB64F83B582D6E6
SHA-256:	2EFF860B3599974FC546DACF4DEB4E33F18480E40219B19FAA65715D6EA52688
SHA-512:	C0307A537E739E2E50D7004AA2C8C06D9ED155740922C824A90BEE4FA63DA979C56AF6D12C145AC0F17AAA6C3D3C8117BA6A03FA4146162C06756158C711E071
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;`.U3.U3.U3..Q2.U3..V2.U3..P2.U3..R2.U3...3..U3..Q2.U3..R2.U3..T2.U3.T3..U3z.P2..U3z.U2.U3z..3.U3z.W2.U3Rich.U3........................PE..L....T.]...........!.........H......@........................................0......M.....@A............................d................................E... ......@...8...........................x...................\|............................text............................... ..`.rdata...,..........................@..@.data...d...........................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	4887168
Entropy (8bit):	7.929521013654076
Encrypted:	false
SSDEEP:	98304:QiZVZtpwcIUykw0B0dGiQiKW3bxx32PWSWuH9dZIMlZGF:lZVPWb0B0dGTiKGyxPIMl0F
MD5:	5EB03B6FF6643353FE82B59F8242F1BE
SHA1:	5C7FA78DF7942206C0A3220F6526C6173BEB04FF
SHA-256:	C3C30FB973C24E9697AA0CBAC056A34667576E118A6C2AAC20864E9AB86C8965
SHA-512:	907961E213C3046E840271C5C98607CE7F704BC36F3F67727736A78C5227F59FA8444427C662276FE3B7DB34C02F09D314B605E970D65701FB1B451F554C9752
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........2un.\&n.\&n.\&...&C.\&...&.\&...&K.\&.;.&o.\&U._'q.\&U.Y'.\&U.X'H.\&.d.&f.\&.d.&o.\&..X'i.\&..U'z.\&.d.&I.\&n.]&F.\&..Y'..\&..X'$.\&..Y'^.\&..&o.\&..^'o.\&Richn.\&........PE..L....\|.\..................H.......i..n....i.......@..........................P........J...@..................................J..X....................vJ.....LO.. ............................p.......p..\...........................................UPX0......i.............................UPX1......H...i...H.................@....rsrc.................H.............@..............................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\eula.txt

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (2531), with CRLF line terminators
Category:	dropped
Size (bytes):	37081
Entropy (8bit):	4.545056211936547
Encrypted:	false
SSDEEP:	384:00FZ14C6yjymNieGprocI8Nbhjf7S1bZJXYsbx+eUuQbN24HSYC:V/1hyGiXWcT7S1bHXYsbx+aQYj
MD5:	8DE264A33E259D341E7788D18B17BFD1
SHA1:	FCEEB916C2AD4F3D452B18E2F447ACEFEB7729A2
SHA-256:	D2498A7E74A677F1D490571DD916EF8C68906C1B30DADDA2C1A8EBDBC13C1A07
SHA-512:	7B37A4F6EE857F061C445EC507D0B3AC8CB3FE5A6D07C29AC8E1BDCD2C8FAE4E872EB6F3FA33F73D3E76CBFD25705A9FFCB2253A93412D2FF8088CC1329C73C4
Malicious:	false
Preview:	.Barco . ClickShare - End-User License Agreement (EULA / Software License)....PLEASE READ THIS DOCUMENT CAREFULLY BEFORE OPENING OR DOWNLOADING AND USING SOFTWARE OR HARDWARE PROVIDED TO YOU BY BARCO AS IT CONTAINS THE TERMS AND CONDITIONS BY WHICH BARCO OFFERS TO LICENSE THE SOFTWARE. BY OPENING THE SOFTWARE PACKAGE, OR USING THE HARDWARE IN WHICH THE SOFTWARE IS EMBEDDED, YOU AGREE TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT...The Software as supplied by BARCO is licensed, not sold to you, on a non-exclusive basis for use only under the terms of this license, and BARCO reserve all rights not expressly granted to you. You may own the carrier on which the Software is provided, but the Software is owned and copyrighted by BARCO or by third party suppliers. Your license confers no title or ownership and is not a sale of any rights in the Software or its documentation...By installing, executing and/or using the Software, either as initial version or as an upgrade, update, patch or

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Barco\ClickShare Launcher\ClickShare Launcher.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Dec 10 13:48:28 2018, mtime=Thu Apr 18 07:08:25 2024, atime=Mon Dec 10 13:48:28 2018, length=4887168, window=hide
Category:	dropped
Size (bytes):	2410
Entropy (8bit):	3.7483846535883076
Encrypted:	false
SSDEEP:	48:88FSdOHclEUgLLqWq9km2xA8esVskKdsLqWjgdsLqWo5GXkeS6WGXxKlUq:8B2UA+kmyeQTj7o5iW6K
MD5:	BCB67DB8742EC2D1585546D2C6583A48
SHA1:	8C8DB84F819B64D004A4BFDFD2BC1757B47DC371
SHA-256:	A1095BAC0324F61EADB0BC40C76363490C56AED9AE8A93BC1BC8339755865BB5
SHA-512:	0602A69E18B948E2CA85F158EF8B6DC3AC130B2BEC1FC33BD32DA8C31151F4B06DAF0F9DE7C9AEA6223E9EB47F4506433711374901A3A9DA8611492A45FF74FC
Malicious:	false
Preview:	L..................F.@.. .....3i.....2.g.....3i......J.....................g....P.O. .:i.....+00.../C:\.....................1......X.A..PROGRA~2.........O.I.X.A....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1......X.A..Barco.<......X.A.X.A..............................B.a.r.c.o.....\|.1......X.A..CLICKS~1..d......X.A.X.A...........................C..C.l.i.c.k.S.h.a.r.e. .E.x.t.e.n.s.i.o.n. .P.a.c.k.....Z.1......X.A..Launcher..B......X.A.X.A..............................L.a.u.n.c.h.e.r.....z.2...J..M.v .CLICKS~1.EXE..^......M.v.X.A....W.........................c.l.i.c.k.s.h.a.r.e.l.a.u.n.c.h.e.r...e.x.e.......................-...................;':......C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe....C.l.i.c.k.S.h.a.r.e. .L.a.u.n.c.h.e.r.h.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.B.a.r.c.o.\.C.l.i.c.k.S.h.a.r.e. .E.x.t.e.n.s.i.o.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ClickShare Launcher.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Dec 10 13:48:28 2018, mtime=Thu Apr 18 07:08:32 2024, atime=Mon Dec 10 13:48:28 2018, length=4887168, window=hide
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	3.7502966302618503
Encrypted:	false
SSDEEP:	48:8zZFSdOHclEUgLLqWqJm2xA8esVskDdsLqWjgdsLqWo5GXkeS6WGXxKlUq:8k2UAMmyeQgj7o5iW6K
MD5:	07E08FB0C3A8547FBF570F37F2263C30
SHA1:	86E3C65307D553622EAB9A388FEE286B35D38821
SHA-256:	BBDF7A02DDAD45DED7A0071D550DE5719E69B8A5418DA429B62CAF383E1932B7
SHA-512:	6236B00D0548A50C748FD89ACEB41EB80182F5A42737D64BC37CB6E3474A8B443F134B871D9E622E5ABF60EFDAAAF0569FD9B89C9EAD1402D8A7F51334FFB0F7
Malicious:	false
Preview:	L..................F.@.. .....3i.......g.....3i......J.....................g....P.O. .:i.....+00.../C:\.....................1......X.A..PROGRA~2.........O.I.X.A....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1......X.A..Barco.<......X.A.X.A..............................B.a.r.c.o.....\|.1......X.A..CLICKS~1..d......X.A.X.A...........................C..C.l.i.c.k.S.h.a.r.e. .E.x.t.e.n.s.i.o.n. .P.a.c.k.....Z.1......X.A..Launcher..B......X.A.X.A..............................L.a.u.n.c.h.e.r.....z.2...J..M.v .CLICKS~1.EXE..^......M.v.X.A....W.........................c.l.i.c.k.s.h.a.r.e.l.a.u.n.c.h.e.r...e.x.e.......................-...................;':......C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe....C.l.i.c.k.S.h.a.r.e. .L.a.u.n.c.h.e.r.e.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.B.a.r.c.o.\.C.l.i.c.k.S.h.a.r.e. .E.x.t.e.n.s.i.o.n. .P.

C:\Users\Public\MirrorOpDisplaySetup.log

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.16834558827164
Encrypted:	false
SSDEEP:	24:Db4LfI0Zq2jxLpeD+hjpPTzLqTzDqK4skrxRqAfFqarTFqUjFqxYuGa:Da542lpeD8jp7gospAfMaHMIMxj
MD5:	5305A6C146D0856EF1082A954FA170F5
SHA1:	CC72107EA11D7E2AF2BCE5C1667000AB9F983151
SHA-256:	F43735F430D6372A1BB4587660DB24D43736DFE77F3A68AFA13DAD97D89CF188
SHA-512:	74E25EC96029F171511C0F4B4195FF4E6748D8A8E17A50EE08DBAFA42E0DF4FAA56101D8D4756317526E4B622C79E7F8360FFC3DBC86052BC8A0BBDFB88AE58A
Malicious:	false
Preview:	..====================================================..Call: 4/18/2024 10:8:26 Build: Jul 15 2019 16:37:52..DriverSetup _tmain: Installing device and driver.....DriverSetup _tmain: Uninstall previous device and driver first.....IDDSetupActions::Install Begin Install Process.....IDDSetupActions::PrivateInitializeGlobals: .. --MirrorOpDisplay.inf.. --Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001.. --{4D36E968-E325-11CE-BFC1-08002BE10318}.. --Display.. --C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpDisplay.inf..IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfoList success..IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfo success..IDDDeviceInfoSet::CreateDeviceNode SetupDiSetDeviceRegistryProperty success..IDDDeviceInfoSet::PrivateDetectDeviceNode SetupDiGetDeviceRegistryProperty failed -536870389..IDDDeviceInfoSet::CreateDeviceNode SetupDiCallClassInstaller success..IDDSetupActions::Install DeviceInfoSet.CreateDeviceN

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\MirrorOpDisplay.inf (copy)

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\SET1368.tmp

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	data
Category:	dropped
Size (bytes):	12442
Entropy (8bit):	7.07480875540708
Encrypted:	false
SSDEEP:	192:HT3xKnyJ31fmm++JCR9E7EwWZhYCWK7p1/Z09qnajlVE:z19a9Zh3/p1x09l/E
MD5:	22A18953B86C03F4D625E15350501D15
SHA1:	C0E0C223F79AA9C37C2A77EF1901331E409489FB
SHA-256:	A4808FE0F025BB6DFEA752CF6A28C0D7356909F316C9D44A05B5E47C96354294
SHA-512:	D4E89B87233DABF1F19AE8587A09E367CCCEB88EEB2E8BA78778195D10A1D6EB2A0C989B334338487863F9B8EBF2B62E531D6D1EB4BB5D70CE6124F296003DF4
Malicious:	false
Preview:	0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7.....i.3A..7E."..J....190614082119Z0...+.....7.....0...0.... Y..6....Q..>...../V.....a.@. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0J..+.....7...1<0:...F.i.l.e.......(m.i.r.r.o.r.o.p.d.i.s.p.l.a.y...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y..6....Q..>...../V.....a.@. 0....g..m.........Z..Q.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0..-. w..ci.rlF...m.........1.>.l.&V.1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... w..ci.rlF...m.........1.>.l.&V.0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0....}J./.n.&.ms.x..ZC.L1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\SET1379.tmp

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\SET1389.tmp

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.4451848631475315
Encrypted:	false
SSDEEP:	1536:qzJh4x1rUUSYbNgtob1zb0sYQBsoLGJ9HfXZeAW1CGGX63hrIZJC:q9h4x1YUJxnb1zb0sM9/XZnW1CRXGj
MD5:	63E01C3D6A55C079EB96A21E89486624
SHA1:	97D348E45C8AE32613970571006217CF1303FB93
SHA-256:	3F761DE45AEF3B9A002B5C66E3AB91BD09D1CD61AD8264A99873AD67A3BF96CA
SHA-512:	AB2C2B7A8DCBFB71F48BACB27AC04C41DFD9EB5EB9BCF452FCABB81364768D9BEF571C304AEB9D1369797BD333E953E6556FF3AB67FCAB44EE35C2BE207BFEDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P...............................................i.....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.446052780127672
Encrypted:	false
SSDEEP:	1536:q/KS4Jr/6/YTYwpNgtwagzSbKYQBNoLGt9HrYZeAW1ENGXlE3hHdZe:qiS4JrIYTfzPagzSbKL9LYZnW1EEX+C
MD5:	5AD7175FC00F8E1FB330795916061AD4
SHA1:	78531503D1EF24A71D8CF7D4C0B435F2EB2E138F
SHA-256:	48EC375A3C6B5EBC7129CFA7CF1DD624A041BA82DA033AB7CCAAFF5E6C7E622D
SHA-512:	8C6B4B7AE0204ACB926CEE629E9727FA7A22745D0BC6BCC99DEDBF0121729EE158703196DB5D56CE955CD2C7EF9FD0317E733DCCB564130856335D76DE25B131
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P................................................w....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET11D0.tmp

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.4451848631475315
Encrypted:	false
SSDEEP:	1536:qzJh4x1rUUSYbNgtob1zb0sYQBsoLGJ9HfXZeAW1CGGX63hrIZJC:q9h4x1YUJxnb1zb0sM9/XZnW1CRXGj
MD5:	63E01C3D6A55C079EB96A21E89486624
SHA1:	97D348E45C8AE32613970571006217CF1303FB93
SHA-256:	3F761DE45AEF3B9A002B5C66E3AB91BD09D1CD61AD8264A99873AD67A3BF96CA
SHA-512:	AB2C2B7A8DCBFB71F48BACB27AC04C41DFD9EB5EB9BCF452FCABB81364768D9BEF571C304AEB9D1369797BD333E953E6556FF3AB67FCAB44EE35C2BE207BFEDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P...............................................i.....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET1338.tmp

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.446052780127672
Encrypted:	false
SSDEEP:	1536:q/KS4Jr/6/YTYwpNgtwagzSbKYQBNoLGt9HrYZeAW1ENGXlE3hHdZe:qiS4JrIYTfzPagzSbKL9LYZnW1EEX+C
MD5:	5AD7175FC00F8E1FB330795916061AD4
SHA1:	78531503D1EF24A71D8CF7D4C0B435F2EB2E138F
SHA-256:	48EC375A3C6B5EBC7129CFA7CF1DD624A041BA82DA033AB7CCAAFF5E6C7E622D
SHA-512:	8C6B4B7AE0204ACB926CEE629E9727FA7A22745D0BC6BCC99DEDBF0121729EE158703196DB5D56CE955CD2C7EF9FD0317E733DCCB564130856335D76DE25B131
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P................................................w....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\mirroropdisplay.cat (copy)

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	data
Category:	dropped
Size (bytes):	12442
Entropy (8bit):	7.07480875540708
Encrypted:	false
SSDEEP:	192:HT3xKnyJ31fmm++JCR9E7EwWZhYCWK7p1/Z09qnajlVE:z19a9Zh3/p1x09l/E
MD5:	22A18953B86C03F4D625E15350501D15
SHA1:	C0E0C223F79AA9C37C2A77EF1901331E409489FB
SHA-256:	A4808FE0F025BB6DFEA752CF6A28C0D7356909F316C9D44A05B5E47C96354294
SHA-512:	D4E89B87233DABF1F19AE8587A09E367CCCEB88EEB2E8BA78778195D10A1D6EB2A0C989B334338487863F9B8EBF2B62E531D6D1EB4BB5D70CE6124F296003DF4
Malicious:	false
Preview:	0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7.....i.3A..7E."..J....190614082119Z0...+.....7.....0...0.... Y..6....Q..>...../V.....a.@. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0J..+.....7...1<0:...F.i.l.e.......(m.i.r.r.o.r.o.p.d.i.s.p.l.a.y...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y..6....Q..>...../V.....a.@. 0....g..m.........Z..Q.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0..-. w..ci.rlF...m.........1.>.l.&V.1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... w..ci.rlF...m.........1.>.l.&V.0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0....}J./.n.&.ms.x..ZC.L1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\mirroropdisplay.inf (copy)

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Windows\INF\c_display.PNF

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15b8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	8660
Entropy (8bit):	3.3733007089209863
Encrypted:	false
SSDEEP:	96:66BcwTdCMNyLNfWdlapY4VfOrtlBARv7Li+XT7+uZt/Y0BnuOTITdE7VGpR2bQjN:67wQMYBfeaOBA9LjXvZ1NnuT6u
MD5:	A35E461187397BC21D7B1FFBC425EB69
SHA1:	1F8AF576F211C42C237324A7C04D5BE9DA89C39C
SHA-256:	0474A97D51D62B4FE7BCBAEFBDE58C25590C088CC25C93735126F98039C2C0D5
SHA-512:	1F37125FBBDB18D5088409AA083840C9EEFF4B9318466E7B6B2F54245FBB6FB24497E31369A7A112BD0B7FF8592E4B0551CF3F30EA7D99F969B2CB135BF13CD4
Malicious:	false
Preview:	..........................x................$...............H...................h................!......C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B...........................................................D...................................................................................................h...........................0...........\|...........<...........t.......(.......................$...................................................................................................................................................................p...........P............................... .......................................\|...\|...........................................................\|...........,...............................................................................................................................................$...................p...................@...................................................................................................

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	60966
Entropy (8bit):	5.229905748890013
Encrypted:	false
SSDEEP:	768:Own95cdyYloiwTyz25ZSGjaFLq+ueIXAVJ:O+5cdyeoiwGeZSGjaFLq+ueIXAVJ
MD5:	ADA2C2FCB9A93F63E633A095F3222436
SHA1:	7E365A71AA093CAA5C7153D34B8DBD0F6EEDABAB
SHA-256:	9784B4A538A20306DF9A7FDDAA0C242F5DC63EA19BBDE060AB94B3F8E0E747F1
SHA-512:	86127661EDF817B749F004EC96342AB2485D5E0B429826D8C40558F2601711BB2DC8D919525881DEF1DD3940274836AA6F61CE13B4261C3628773CC8D1BF29F1
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\Installer\3f0637.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: ClickShare Extension Pack, Author: Barco N.V., Keywords: Installer, Comments: Windows Installer Package, Template: Intel;1033, Revision Number: {A1C10D50-773A-4B79-B97F-11DA2C6B622E}, Create Time/Date: Mon Jul 15 15:43:38 2019, Last Saved Time/Date: Mon Jul 15 15:43:38 2019, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
Category:	dropped
Size (bytes):	7888896
Entropy (8bit):	7.624749083431013
Encrypted:	false
SSDEEP:	196608:OTjSFFYWNrtEPCSnsP9WYhaVVbm2zGRS3i8ODftvhN0:hFYWYB6vhMhmo3i8e1vhm
MD5:	56D913EBBE38AB3A7F48ABE1A3E9DAA6
SHA1:	FB6518265932A3D810183F3A6E6A0FDE14A2B66E
SHA-256:	26F4DC0F8CCEDC064AEA7FDA31A2A8BEC32CF7B646FA044CBFDD352F559764E0
SHA-512:	BFA5D4AE17E9B68D479F8B026A64AC20AD1BCF876ED6D8EDE1EBD846F6A3552A6753C85E6C5BED80374A4254B2D57E84148224E7B55352CC3E0223B57AE3030E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\3f0639.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: ClickShare Extension Pack, Author: Barco N.V., Keywords: Installer, Comments: Windows Installer Package, Template: Intel;1033, Revision Number: {A1C10D50-773A-4B79-B97F-11DA2C6B622E}, Create Time/Date: Mon Jul 15 15:43:38 2019, Last Saved Time/Date: Mon Jul 15 15:43:38 2019, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
Category:	dropped
Size (bytes):	7888896
Entropy (8bit):	7.624749083431013
Encrypted:	false
SSDEEP:	196608:OTjSFFYWNrtEPCSnsP9WYhaVVbm2zGRS3i8ODftvhN0:hFYWYB6vhMhmo3i8e1vhm
MD5:	56D913EBBE38AB3A7F48ABE1A3E9DAA6
SHA1:	FB6518265932A3D810183F3A6E6A0FDE14A2B66E
SHA-256:	26F4DC0F8CCEDC064AEA7FDA31A2A8BEC32CF7B646FA044CBFDD352F559764E0
SHA-512:	BFA5D4AE17E9B68D479F8B026A64AC20AD1BCF876ED6D8EDE1EBD846F6A3552A6753C85E6C5BED80374A4254B2D57E84148224E7B55352CC3E0223B57AE3030E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI3067.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	153080
Entropy (8bit):	5.668024240883533
Encrypted:	false
SSDEEP:	3072:rfmUZkq40ok1KA+2LSQa/967K4AcIaWHTnYzMgYesp0Ccaw:rfmekqAA+2RTCcZ
MD5:	418322F7BE2B68E88A93A048AC75A757
SHA1:	09739792FF1C30F73DACAFBE503630615922B561
SHA-256:	EA5D4B4C7E7BE1CE24A614AE1E31A58BCAE6F1694DD8BFB735CF47D35A08D59B
SHA-512:	253F62F5CE75DF3E9AC3C62E2F06F30C7C6DE6280FBFC830CDD15BF29CB8EE9ED878212F6DF5D0AC6A5C9BE0E6259F900ECCEE472A890F15DD3FF1F84958AEEF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|...\|...\|...u.d.~...\|......u.b.k...u.u.o...u.r.G...u.c.}...u.{.m...[...}...u.e.}...u.`.}...Rich\|...........PE..d......J.........." .........,......p........................................p......}.....@.............................................o............@..$.... .......0...%...`..X...p...................................................(............................text...o........................... ..`.data...@...........................@....pdata....... ......................@..@.rsrc.... ...@......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8A8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	207360
Entropy (8bit):	6.574209364487876
Encrypted:	false
SSDEEP:	3072:r65Z1YCHGiZXOVneG/kdvLdzusAatnw1lflQnB+QDO1Q+cxbVeFT:r657r+0G/kvzoaBcHLnN
MD5:	D773D9BD091E712DF7560F576DA53DE8
SHA1:	165CFBDCE1811883360112441F7237B287CF0691
SHA-256:	E0DB1804CF53ED4819ED70CB35C67680CE1A77573EFDED86E6DAC81010CE55E7
SHA-512:	15A956090F8756A6BFDBE191FDA36739B1107EADA62C6CD3058218BEB417BDBD2EA82BE9B055F7F6EB8017394B330DAFF2E9824DBC9C4F137BEAD8E2AC0574CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................!Es....!Eq....!Ep....L......L......L.......................h..1......1......1.}...........1......Rich...........PE..L......Z...........!.........L......?.....................................................@.................................p........P..x....................`..\|...P...T...............................@...............<............................text...K........................... ..`.rdata..J...........................@..@.data...."... ......................@....rsrc...x....P......................@..@.reloc..\|....`......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIB49.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	123362
Entropy (8bit):	7.787330506251851
Encrypted:	false
SSDEEP:	3072:1VwByHA2QuLaXyTK1A8DI6ek5zcXnFj9ejKn3:1Vzg2RLaJ1JIjSUFBeK
MD5:	5B85527C7602342151F6522B2227A518
SHA1:	72B768A2DF553F48F1565C222C3D3233A522E5CE
SHA-256:	5E93BF8682191E8DC561B39AFBD3C2EF841F82A2706A6A72DEAB2772B75E2322
SHA-512:	9527994943D589B8855D81EF68E4A5AD69D47B9FC3FEAF81843CAEE8AAAC2E60188A0CC5105D86AFBDB1E9F20673AEA37B0366531A249665CAF34214251F0DFF
Malicious:	false
Preview:	...@IXOS.@.....@.Q.X.@.....@.....@.....@.....@.....@......&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}..ClickShare Extension Pack+.ClickShare-Extension-Pack-01.01.02.0007.msi.@.....@.....@.....@......icon.ico..&.{A1C10D50-773A-4B79-B97F-11DA2C6B622E}.....@.....@.....@.....@.......@.....@.....@.......@......ClickShare Extension Pack......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{B409F5AC-ACA6-4026-9151-F60B697FEAD4}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}..&.{B409F5AC-ACA6-4026-9151-F60B697FEAD4}...@.....@......&.{0F52C4B8-B1E3-4273-ABC3-0ECE3FF627C8}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}..&.{0F52C4B8-B1E3-4273-ABC3-0ECE3FF627C8}...@.....@......&.{53352481-1087-4393-B099-991BE47AB769}&.{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}..&.{53352481-1087-4393-B099-991BE47AB769}...@.....@......&.{70D78331-94B7-4FCC-960A-993D5BB73A2D}&.{AA1F9CF3-F74D-4EBD-82DA-12D070

C:\Windows\Installer\MSIB79.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	153080
Entropy (8bit):	5.668024240883533
Encrypted:	false
SSDEEP:	3072:rfmUZkq40ok1KA+2LSQa/967K4AcIaWHTnYzMgYesp0Ccaw:rfmekqAA+2RTCcZ
MD5:	418322F7BE2B68E88A93A048AC75A757
SHA1:	09739792FF1C30F73DACAFBE503630615922B561
SHA-256:	EA5D4B4C7E7BE1CE24A614AE1E31A58BCAE6F1694DD8BFB735CF47D35A08D59B
SHA-512:	253F62F5CE75DF3E9AC3C62E2F06F30C7C6DE6280FBFC830CDD15BF29CB8EE9ED878212F6DF5D0AC6A5C9BE0E6259F900ECCEE472A890F15DD3FF1F84958AEEF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8...\|...\|...\|...u.d.~...\|......u.b.k...u.u.o...u.r.G...u.c.}...u.{.m...[...}...u.e.}...u.`.}...Rich\|...........PE..d......J.........." .........,......p........................................p......}.....@.............................................o............@..$.... .......0...%...`..X...p...................................................(............................text...o........................... ..`.data...@...........................@....pdata....... ......................@..@.rsrc.... ...@......................@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1808961097521928
Encrypted:	false
SSDEEP:	12:JSbX72FjQliAGiLIlHVRpGh/7777777777777777777777777vDHFWT7eOhr9l0G:JRQI5+W7eOOF
MD5:	0D404D57418B77997553904D5D3AB137
SHA1:	8129BDAC7D9FAD3D51C53EAB06E50C65329B24BD
SHA-256:	65A497FD6ECAD150E92658498EE79C58ACA400C1D6825AE97F41670544AE5B3A
SHA-512:	73CB96D1BB9259E71218A8BD10420A9DCC7B1DE0477669EB86E96B5AB314B4569A724AE6250C56ECDE993B708FD3B9D9515ADE4C4E0E6DF36A1F2ED8C35433E5
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5282473903519844
Encrypted:	false
SSDEEP:	48:+8Phj7uRc06WX44FT5TSZqNLVP8hgSoedbgrzStedFmOdOD1LqWD:xhj71IFTFSmLVP8hgDno5
MD5:	021E6DE7D4E2EB5E7AEBC02287943338
SHA1:	0276B02030D55F55191FC84CF808A0B3E5FBD682
SHA-256:	FA2CC40E72A072EF2E9CB70041DD875C017064BA15AFFFC549E9B745F1139CD6
SHA-512:	33677395EA93A4DB37DECB11FA09EDCFC63A302AE7F85D9A7B4911F6D6FA589A4C78A61BB985BC641B844C4ECE65CB064FD6DE34C79366334219A5E9A50B8648
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{AA1F9CF3-F74D-4EBD-82DA-12D07064FA5C}\icon.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 12 icons, 32x32, 16 colors, 4 bits/pixel, 24x24, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	115749
Entropy (8bit):	7.799573915161076
Encrypted:	false
SSDEEP:	3072:YwByHA2QuLaXyTK1A8DI6ek5zcXnFj9ejKns:Yzg2RLaJ1JIjSUFBeX
MD5:	D6115A0F637157C4A81A7186E4345A1E
SHA1:	17CEA8436A983AB5704C550E0B04868F117FECD9
SHA-256:	F3BBB3F5FDFF4CA7B273CF42A388DE6C909F233124A146EFC879E7F3C8A08D78
SHA-512:	5C004D188E21E8E854966E112FF2AE7C2776BB65752CF7137827B761FFC93E8298171543A3DB7A551446A3697C71ED9621B1069D3EEDAD09FAF0A295575B40A3
Malicious:	false
Preview:	...... ......................................(.......00.............. ..........f...........................h....$........ ..U..>*..00.... ..%...... .... ............... .....5......... .h.......(... ...@.................................................................................................... A..0.. ....... ...%..@PR.p.!..@....%...P..........pP.@P.RG..!@.........@.0.`...y...9..P.B@...`...sw1.....0..`...xx..s...R@.....s.x...S...p.@..'w........`..$..w.wx......pp...rwwx.....q. ..B....wxx...v..0...gwwxw......`.0..w..xw..x.w......wxwx8xxxww......8xxw.ww..wy...!.xxx8w..www.........xw.w.xsY ..C.h...wwxwwp..@!......xwww.q..........xw.xw.q...A.....wwwwq..p...$..x.xw.w.......0...wwwwaY......4....w40.......$.Pa...5...!@...`.@05.y.......pq..pA..51C.0.......p0a.......0....`..%$4440C...p...4. ........p.................................................................................................................................(.......0.................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365493797742408
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaue:zTtbmkExhMJCIpEJ
MD5:	D5DFA092FBEFA60E56A68B5DEBABE331
SHA1:	194D5A9D5FDEC47008198EEC9968D90E2E8ACFAC
SHA-256:	E0E1EAA06ADA454CAC8508A7775159107650D910036345159278E9D2BA4F7209
SHA-512:	510B21054497665FDB8F85348377D6E10672B6F17ACA48097FB12CF0C30320D2DCAB6008A79D7E8222F0425F1DB178C8EDB35CAC1AB3677BA5F31850D11174D5
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\MirrorOpDisplay.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\SET15C9.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	12442
Entropy (8bit):	7.07480875540708
Encrypted:	false
SSDEEP:	192:HT3xKnyJ31fmm++JCR9E7EwWZhYCWK7p1/Z09qnajlVE:z19a9Zh3/p1x09l/E
MD5:	22A18953B86C03F4D625E15350501D15
SHA1:	C0E0C223F79AA9C37C2A77EF1901331E409489FB
SHA-256:	A4808FE0F025BB6DFEA752CF6A28C0D7356909F316C9D44A05B5E47C96354294
SHA-512:	D4E89B87233DABF1F19AE8587A09E367CCCEB88EEB2E8BA78778195D10A1D6EB2A0C989B334338487863F9B8EBF2B62E531D6D1EB4BB5D70CE6124F296003DF4
Malicious:	false
Preview:	0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7.....i.3A..7E."..J....190614082119Z0...+.....7.....0...0.... Y..6....Q..>...../V.....a.@. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0J..+.....7...1<0:...F.i.l.e.......(m.i.r.r.o.r.o.p.d.i.s.p.l.a.y...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y..6....Q..>...../V.....a.@. 0....g..m.........Z..Q.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0..-. w..ci.rlF...m.........1.>.l.&V.1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... w..ci.rlF...m.........1.>.l.&V.0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0....}J./.n.&.ms.x..ZC.L1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.

C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\SET15DA.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.4451848631475315
Encrypted:	false
SSDEEP:	1536:qzJh4x1rUUSYbNgtob1zb0sYQBsoLGJ9HfXZeAW1CGGX63hrIZJC:q9h4x1YUJxnb1zb0sM9/XZnW1CRXGj
MD5:	63E01C3D6A55C079EB96A21E89486624
SHA1:	97D348E45C8AE32613970571006217CF1303FB93
SHA-256:	3F761DE45AEF3B9A002B5C66E3AB91BD09D1CD61AD8264A99873AD67A3BF96CA
SHA-512:	AB2C2B7A8DCBFB71F48BACB27AC04C41DFD9EB5EB9BCF452FCABB81364768D9BEF571C304AEB9D1369797BD333E953E6556FF3AB67FCAB44EE35C2BE207BFEDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P...............................................i.....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.446052780127672
Encrypted:	false
SSDEEP:	1536:q/KS4Jr/6/YTYwpNgtwagzSbKYQBNoLGt9HrYZeAW1ENGXlE3hHdZe:qiS4JrIYTfzPagzSbKL9LYZnW1EEX+C
MD5:	5AD7175FC00F8E1FB330795916061AD4
SHA1:	78531503D1EF24A71D8CF7D4C0B435F2EB2E138F
SHA-256:	48EC375A3C6B5EBC7129CFA7CF1DD624A041BA82DA033AB7CCAAFF5E6C7E622D
SHA-512:	8C6B4B7AE0204ACB926CEE629E9727FA7A22745D0BC6BCC99DEDBF0121729EE158703196DB5D56CE955CD2C7EF9FD0317E733DCCB564130856335D76DE25B131
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P................................................w....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET1589.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.4451848631475315
Encrypted:	false
SSDEEP:	1536:qzJh4x1rUUSYbNgtob1zb0sYQBsoLGJ9HfXZeAW1CGGX63hrIZJC:q9h4x1YUJxnb1zb0sM9/XZnW1CRXGj
MD5:	63E01C3D6A55C079EB96A21E89486624
SHA1:	97D348E45C8AE32613970571006217CF1303FB93
SHA-256:	3F761DE45AEF3B9A002B5C66E3AB91BD09D1CD61AD8264A99873AD67A3BF96CA
SHA-512:	AB2C2B7A8DCBFB71F48BACB27AC04C41DFD9EB5EB9BCF452FCABB81364768D9BEF571C304AEB9D1369797BD333E953E6556FF3AB67FCAB44EE35C2BE207BFEDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P...............................................i.....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\amd64\SET15A9.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.446052780127672
Encrypted:	false
SSDEEP:	1536:q/KS4Jr/6/YTYwpNgtwagzSbKYQBNoLGt9HrYZeAW1ENGXlE3hHdZe:qiS4JrIYTfzPagzSbKL9LYZnW1EEX+C
MD5:	5AD7175FC00F8E1FB330795916061AD4
SHA1:	78531503D1EF24A71D8CF7D4C0B435F2EB2E138F
SHA-256:	48EC375A3C6B5EBC7129CFA7CF1DD624A041BA82DA033AB7CCAAFF5E6C7E622D
SHA-512:	8C6B4B7AE0204ACB926CEE629E9727FA7A22745D0BC6BCC99DEDBF0121729EE158703196DB5D56CE955CD2C7EF9FD0317E733DCCB564130856335D76DE25B131
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P................................................w....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{3266e6e3-1dae-6a44-ae19-9eb3e91a1693}\mirroropdisplay.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	12442
Entropy (8bit):	7.07480875540708
Encrypted:	false
SSDEEP:	192:HT3xKnyJ31fmm++JCR9E7EwWZhYCWK7p1/Z09qnajlVE:z19a9Zh3/p1x09l/E
MD5:	22A18953B86C03F4D625E15350501D15
SHA1:	C0E0C223F79AA9C37C2A77EF1901331E409489FB
SHA-256:	A4808FE0F025BB6DFEA752CF6A28C0D7356909F316C9D44A05B5E47C96354294
SHA-512:	D4E89B87233DABF1F19AE8587A09E367CCCEB88EEB2E8BA78778195D10A1D6EB2A0C989B334338487863F9B8EBF2B62E531D6D1EB4BB5D70CE6124F296003DF4
Malicious:	false
Preview:	0.0...*.H........0.0.0....1.0...`.H.e......0.....+.....7......0...0...+.....7.....i.3A..7E."..J....190614082119Z0...+.....7.....0...0.... Y..6....Q..>...../V.....a.@. 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0J..+.....7...1<0:...F.i.l.e.......(m.i.r.r.o.r.o.p.d.i.s.p.l.a.y...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y..6....Q..>...../V.....a.@. 0....g..m.........Z..Q.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0..-. w..ci.rlF...m.........1.>.l.&V.1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... w..ci.rlF...m.........1.>.l.&V.0^..+.....7...1P0N...F.i.l.e.......<m.i.r.r.o.r.o.p.v.i.r.t.u.a.l.d.i.s.p.l.a.y.1._.0...d.l.l...0....}J./.n.&.ms.x..ZC.L1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3475
Entropy (8bit):	5.366043270259199
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3YpgpNM:QO00eO00erMwmkB1kAW
MD5:	B502F057C0DCE81308B11D465B20FB0E
SHA1:	382493BF610585F8B0C88FF5B8D2311BADC63CA8
SHA-256:	71F53FD87B306BA6E618B418F0BC73AE537DFF6154F8D06A50554C02379DD6F8
SHA-512:	66CE513E61897C16F032F6461B999BBEBE0871753C8E7D658F9F0B0256BB644EDCDA48D533995174250A26FBCE2FEBA5C415FA910F1755B4BF13402E200B5A89
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\UMDF\MirrorOpVirtualDisplay1_2.dll (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.446052780127672
Encrypted:	false
SSDEEP:	1536:q/KS4Jr/6/YTYwpNgtwagzSbKYQBNoLGt9HrYZeAW1ENGXlE3hHdZe:qiS4JrIYTfzPagzSbKL9LYZnW1EEX+C
MD5:	5AD7175FC00F8E1FB330795916061AD4
SHA1:	78531503D1EF24A71D8CF7D4C0B435F2EB2E138F
SHA-256:	48EC375A3C6B5EBC7129CFA7CF1DD624A041BA82DA033AB7CCAAFF5E6C7E622D
SHA-512:	8C6B4B7AE0204ACB926CEE629E9727FA7A22745D0BC6BCC99DEDBF0121729EE158703196DB5D56CE955CD2C7EF9FD0317E733DCCB564130856335D76DE25B131
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P................................................w....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\drivers\UMDF\SET2037.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103328
Entropy (8bit):	6.446052780127672
Encrypted:	false
SSDEEP:	1536:q/KS4Jr/6/YTYwpNgtwagzSbKYQBNoLGt9HrYZeAW1ENGXlE3hHdZe:qiS4JrIYTfzPagzSbKL9LYZnW1EEX+C
MD5:	5AD7175FC00F8E1FB330795916061AD4
SHA1:	78531503D1EF24A71D8CF7D4C0B435F2EB2E138F
SHA-256:	48EC375A3C6B5EBC7129CFA7CF1DD624A041BA82DA033AB7CCAAFF5E6C7E622D
SHA-512:	8C6B4B7AE0204ACB926CEE629E9727FA7A22745D0BC6BCC99DEDBF0121729EE158703196DB5D56CE955CD2C7EF9FD0317E733DCCB564130856335D76DE25B131
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v..2..Z2..Z2..Z`..[8..Z`..[7..Z`..[...ZW..[3..Z;._Z$..Zi..[0..ZW..[7..Z2..ZV..Z...["..Z...[3..Z..3Z3..Z...[3..ZRich2..Z........PE..d....T.].........." .........j......P................................................w....`A........................................@;..`....;.......p.......`.......N...E......X.......8............................................... ............................text............................... ..`.rdata..vG.......H..................@..@.data........P.......4..............@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..X............L..............@..B................................................................................................................................................................................................................................................

C:\Windows\Temp\OLD1385.tmp

Download File

Process:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5109
Entropy (8bit):	5.594073955865938
Encrypted:	false
SSDEEP:	96:KpHMiiUG3ZfB8hHKiysf/yeEhTUsysf/y4EhTk4y4f/y8ahTAE4kOa7CaZvg+k24:KGiiUGpfB8hHKmPcBQrE4wpvg6fsp
MD5:	242738D2DF9AAE17C1B6EAB1F53A9478
SHA1:	7D4AB52F126E0426DF6D731A78C6DD5A43EFA24C
SHA-256:	5911D736A39416C251B3E2AB3EABCDDD8BE3D72F56D3BC88EFC2E1618A40E820
SHA-512:	6586F59BDB9B4889DFDED009E89C9A76C03551A7FAD9003F4F6B414FB03A5C4D37132D87FFE24A26FB38895C3AAA8BBA92719C117F7DF5E59C2896BB45D28583
Malicious:	false
Preview:	; MirrorOpDisplay.inf..; Copyright . 2019 MirrorOp;..; All rights reserved....[Version]..Signature="$Windows NT$"..Class=Display..ClassGuid={4d36e968-e325-11ce-bfc1-08002be10318}..ClassVer=2.0..Provider=%ManufacturerName%..CatalogFile=mirroropdisplay.cat..DriverVer = 06/14/2019,1.1.174.61....[ControlFlags]..ExcludeFromSelect =*....[DestinationDirs]..DefaultDestDir = 11..MirrorOp.DisplayUmd = 12,UMDF .; drivers\UMDF..MirrorOp.DisplayUmd.1.2= 12,UMDF .; drivers\UMDF....[Manufacturer]..%ManufacturerName%=Standard,NTx86,ntamd64,NTx86.10.0...16299,ntamd64.10.0...16299,NTx86.10.0...18277,ntamd64.10.0...18277....[Standard.NTx86]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NtAMD64]..%DeviceName%= v3DDKIndirect_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.NTx86.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Install, Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001..[Standard.ntamd64.10.0...16299]..%DeviceName%= v3DDKIndirect_1.2_Insta

C:\Windows\Temp\~DF08AF466AEAFFBC07.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2254104673417807
Encrypted:	false
SSDEEP:	48:tCr7uoO+xFX49T51SZqNLVP8hgSoedbgrzStedFmOdOD1LqWD:kr7ZeTLSmLVP8hgDno5
MD5:	9DB85ED6ABB4DFF4FB5A443A5736167E
SHA1:	2D580DC3BF7E4E97D9AB25DCA7BBD6CACBD0CF1C
SHA-256:	171EEED9E5F13E0515B6C377C84A8DDE675F37FC9BB8F37F9E98ADBE54A36BBA
SHA-512:	CF99EFDF27F8876094CB50D3AABAAE318AB7B14E2F732098AFD89D40B268EDF81F4CD04098AFADC3C3CC62313B5F567E47B432FCFE644F0C42EA93D2524F29F9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF21BE1F1C4D225319.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF26FF837C867FF7CB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36111E347B1C4CFF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2254104673417807
Encrypted:	false
SSDEEP:	48:tCr7uoO+xFX49T51SZqNLVP8hgSoedbgrzStedFmOdOD1LqWD:kr7ZeTLSmLVP8hgDno5
MD5:	9DB85ED6ABB4DFF4FB5A443A5736167E
SHA1:	2D580DC3BF7E4E97D9AB25DCA7BBD6CACBD0CF1C
SHA-256:	171EEED9E5F13E0515B6C377C84A8DDE675F37FC9BB8F37F9E98ADBE54A36BBA
SHA-512:	CF99EFDF27F8876094CB50D3AABAAE318AB7B14E2F732098AFD89D40B268EDF81F4CD04098AFADC3C3CC62313B5F567E47B432FCFE644F0C42EA93D2524F29F9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF47AF7CDC4C892ABB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.08363744089515172
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOWvLhqYeytLVxkkqVky6l9:2F0i8n0itFzDHFWT7eOhr9
MD5:	302ACB54DB64887B98A15B23DF9F0A44
SHA1:	6D61CDE6034AE8685695256EDEDA0E247E6A7EB0
SHA-256:	0EF239B0FE9E188CB66E194F0DEE2B42830C1700C50182354A5E772CDF52779F
SHA-512:	BE0E598DE7B7962020910E97D17BB6997EB323B83E3F810B3C2AE016B4B1E90B0CB5FFFE2C78A23BD3237383096CFAB4E143690AADBC2F4FC7412F542D8A439E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4C187777D30217DE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2254104673417807
Encrypted:	false
SSDEEP:	48:tCr7uoO+xFX49T51SZqNLVP8hgSoedbgrzStedFmOdOD1LqWD:kr7ZeTLSmLVP8hgDno5
MD5:	9DB85ED6ABB4DFF4FB5A443A5736167E
SHA1:	2D580DC3BF7E4E97D9AB25DCA7BBD6CACBD0CF1C
SHA-256:	171EEED9E5F13E0515B6C377C84A8DDE675F37FC9BB8F37F9E98ADBE54A36BBA
SHA-512:	CF99EFDF27F8876094CB50D3AABAAE318AB7B14E2F732098AFD89D40B268EDF81F4CD04098AFADC3C3CC62313B5F567E47B432FCFE644F0C42EA93D2524F29F9
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6A4101373F233987.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA1094AAB77BE8A5A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12880114992744593
Encrypted:	false
SSDEEP:	48:raLqWMmOdODGStedUSoedbgrX7LPMqNLc7:mqoa6n7LP/Lc7
MD5:	F28D4F995976E07C76F70A3DBEB67157
SHA1:	C24594DF92B3FB7025BB51B0B3D56052C5BF16A5
SHA-256:	9F35CF1E712F7873465834698CCE2B5EEFEA16B27100590172829A9BCB44D841
SHA-512:	E6DF2E5BAF830E05C7D43414D17B360A5EA2DB6E6D3DCE0DB6B8CB8DFB90C253E77D051DB47D1F31E78A90C5A017AAD1DD836B37924D1F23C7BFB836ACB0CA3C
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB07B93CBC711E9BF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBCDDB9DEE7E8C601.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD4D8D4C41B47BCFF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5282473903519844
Encrypted:	false
SSDEEP:	48:+8Phj7uRc06WX44FT5TSZqNLVP8hgSoedbgrzStedFmOdOD1LqWD:xhj71IFTFSmLVP8hgDno5
MD5:	021E6DE7D4E2EB5E7AEBC02287943338
SHA1:	0276B02030D55F55191FC84CF808A0B3E5FBD682
SHA-256:	FA2CC40E72A072EF2E9CB70041DD875C017064BA15AFFFC549E9B745F1139CD6
SHA-512:	33677395EA93A4DB37DECB11FA09EDCFC63A302AE7F85D9A7B4911F6D6FA589A4C78A61BB985BC641B844C4ECE65CB064FD6DE34C79366334219A5E9A50B8648
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDF1B04CD2A8092BB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5282473903519844
Encrypted:	false
SSDEEP:	48:+8Phj7uRc06WX44FT5TSZqNLVP8hgSoedbgrzStedFmOdOD1LqWD:xhj71IFTFSmLVP8hgDno5
MD5:	021E6DE7D4E2EB5E7AEBC02287943338
SHA1:	0276B02030D55F55191FC84CF808A0B3E5FBD682
SHA-256:	FA2CC40E72A072EF2E9CB70041DD875C017064BA15AFFFC549E9B745F1139CD6
SHA-512:	33677395EA93A4DB37DECB11FA09EDCFC63A302AE7F85D9A7B4911F6D6FA589A4C78A61BB985BC641B844C4ECE65CB064FD6DE34C79366334219A5E9A50B8648
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: ClickShare Extension Pack, Author: Barco N.V., Keywords: Installer, Comments: Windows Installer Package, Template: Intel;1033, Revision Number: {A1C10D50-773A-4B79-B97F-11DA2C6B622E}, Create Time/Date: Mon Jul 15 15:43:38 2019, Last Saved Time/Date: Mon Jul 15 15:43:38 2019, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.1.2318), Security: 2
Entropy (8bit):	7.624749083431013
TrID:	Microsoft Windows Installer (60509/1) 57.88% ClickyMouse macro set (36024/1) 34.46% Generic OLE2 / Multistream Compound File (8008/1) 7.66%
File name:	ClickShare-Extension-Pack-01.01.02.0007.msi
File size:	7'888'896 bytes
MD5:	56d913ebbe38ab3a7f48abe1a3e9daa6
SHA1:	fb6518265932a3d810183f3a6e6a0fde14a2b66e
SHA256:	26f4dc0f8ccedc064aea7fda31a2a8bec32cf7b646fa044cbfdd352f559764e0
SHA512:	bfa5d4ae17e9b68d479f8b026a64ac20ad1bcf876ed6d8ede1ebd846f6a3552a6753c85e6c5bed80374a4254b2d57e84148224e7b55352cc3e0223b57ae3030e
SSDEEP:	196608:OTjSFFYWNrtEPCSnsP9WYhaVVbm2zGRS3i8ODftvhN0:hFYWYB6vhMhmo3i8e1vhm
TLSH:	AD86F101FAB44125E1A25A7FE9B6EE64D1357C85573085CF2206BA6A3F774D28232F33
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Target ID:	0
Start time:	10:08:17
Start date:	18/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\ClickShare-Extension-Pack-01.01.02.0007.msi"
Imagebase:	0x7ff681910000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:08:17
Start date:	18/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff681910000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:08:24
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding E6B16BCC263E80D188A4984C7B267598
Imagebase:	0xe50000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:08:25
Start date:	18/04/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\taskkill.exe" /F /IM clicksharelauncher.exe
Imagebase:	0x750000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:08:25
Start date:	18/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:08:25
Start date:	18/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\MsiExec.exe -Embedding F4B6C0AC556B4BDBCA932BA88603FA42
Imagebase:	0x7ff681910000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:08:26
Start date:	18/04/2024
Path:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe" install
Imagebase:	0x7ff642e10000
File size:	177'544 bytes
MD5 hash:	28B07DC516BFC41A35A93DC1643E143F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:08:27
Start date:	18/04/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\MirrorOpDisplay.inf" "9" "4208fae43" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx"
Imagebase:	0x7ff704db0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:08:30
Start date:	18/04/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "2" "1" "ROOT\DISPLAY\0000" "C:\Windows\System32\DriverStore\FileRepository\mirroropdisplay.inf_amd64_81a2ef4ec907e6ad\mirroropdisplay.inf" "oem4.inf:::1.1.174.61:Root\VID_MIRROROP_VIRTUAL_DISPLAY_0001," "4208fae43" "0000000000000168"
Imagebase:	0x7ff704db0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:08:31
Start date:	18/04/2024
Path:	C:\Windows\System32\drivers\WUDFRd.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	315'392 bytes
MD5 hash:	0B7A5464602DA68DA6BEFC2A1B5BE4C5
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:08:31
Start date:	18/04/2024
Path:	C:\Windows\System32\drivers\IndirectKmd.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	47'104 bytes
MD5 hash:	9B943585EF2A4917E1BC2186045E4B64
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:08:31
Start date:	18/04/2024
Path:	C:\Windows\System32\WUDFHost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-35dc3092-997a-462b-8ee0-c4c46c580d41 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2348cb75-16eb-4e88-aea2-36cde2ec3571 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8f9a7ac6-e24f-4275-b4e5-c5e16ce5d6a7 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-34c938a5-6219-4a04-8fb5-f0a5c593a835 -LifetimeId:f1058ddd-615d-4a9e-a592-7cb571a1dced -DeviceGroupId:v3DDKIndirectGroup -HostArg:0
Imagebase:	0x7ff75df70000
File size:	271'872 bytes
MD5 hash:	00E2EF3D2C9309CA4135195A049CC79C
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:08:34
Start date:	18/04/2024
Path:	C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe"
Imagebase:	0x2b0000
File size:	4'887'168 bytes
MD5 hash:	5EB03B6FF6643353FE82B59F8242F1BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.3%
Total number of Nodes:	1906
Total number of Limit Nodes:	39

Executed Functions

Function 00007FF642E11020 Relevance: 54.5, APIs: 17, Strings: 14, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiCreateDeviceInfoList.SETUPAPI ref: 00007FF642E11050
GetLastError.KERNEL32 ref: 00007FF642E1105F
SetupDiCreateDeviceInfoW.SETUPAPI ref: 00007FF642E110CF
GetLastError.KERNEL32 ref: 00007FF642E110D9

Strings

IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfoList success, xrefs: 00007FF642E1108A
IDDDeviceInfoSet::PrivateDetectDeviceNode SetupDiGetDeviceRegistryProperty failed %d, xrefs: 00007FF642E112EE
IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfoList failed %d, xrefs: 00007FF642E11065
IDDDeviceInfoSet::CreateDeviceNode StringCchCopy failed %d, xrefs: 00007FF642E1116E
IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfo success, xrefs: 00007FF642E110FC
IDDDeviceInfoSet::CreateDeviceNode SetupDiSetDeviceRegistryProperty success, xrefs: 00007FF642E111DF
IDDDeviceInfoSet::CreateDeviceNode SetupDiCallClassInstaller success, xrefs: 00007FF642E11387
IDDDeviceInfoSet::CreateDeviceNode PrivateDetectDeviceNode device detected, xrefs: 00007FF642E11379
IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfo failed %d, xrefs: 00007FF642E110DF
, xrefs: 00007FF642E1127E
IDDDeviceInfoSet::CreateDeviceNode SetupDiSetDeviceRegistryProperty failed %d, xrefs: 00007FF642E111C2
IDDDeviceInfoSet::PrivateDetectDeviceNode SetupDiGetClassDevs failed %d, xrefs: 00007FF642E11229
IDDDeviceInfoSet::PrivateDetectDeviceNode Current HWID = %s, xrefs: 00007FF642E11311
IDDDeviceInfoSet::CreateDeviceNode SetupDiCallClassInstaller failed %d, xrefs: 00007FF642E1125C

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: CreateDeviceErrorInfoLastSetup$List
String ID: $IDDDeviceInfoSet::CreateDeviceNode PrivateDetectDeviceNode device detected$IDDDeviceInfoSet::CreateDeviceNode SetupDiCallClassInstaller failed %d$IDDDeviceInfoSet::CreateDeviceNode SetupDiCallClassInstaller success$IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfo failed %d$IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfo success$IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfoList failed %d$IDDDeviceInfoSet::CreateDeviceNode SetupDiCreateDeviceInfoList success$IDDDeviceInfoSet::CreateDeviceNode SetupDiSetDeviceRegistryProperty failed %d$IDDDeviceInfoSet::CreateDeviceNode SetupDiSetDeviceRegistryProperty success$IDDDeviceInfoSet::CreateDeviceNode StringCchCopy failed %d$IDDDeviceInfoSet::PrivateDetectDeviceNode Current HWID = %s$IDDDeviceInfoSet::PrivateDetectDeviceNode SetupDiGetClassDevs failed %d$IDDDeviceInfoSet::PrivateDetectDeviceNode SetupDiGetDeviceRegistryProperty failed %d
API String ID: 3956582768-2283095087
Opcode ID: fed52326e30b97d101902100e3bd5036ce6bd3c6a262ac63560ba96fae691d76
Instruction ID: e8d25667b107896b55c2c22086413ead0fa569cdcc3b4b041427c4c207899b9c
Opcode Fuzzy Hash: fed52326e30b97d101902100e3bd5036ce6bd3c6a262ac63560ba96fae691d76
Instruction Fuzzy Hash: FBA1C661B0C68281EB50BB25E8447B96791FF88788F60413DDA4DC7B96EEBFD588C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E135F0 Relevance: 38.7, APIs: 11, Strings: 11, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF642E1367A
VerSetConditionMask.KERNEL32 ref: 00007FF642E13689
VerSetConditionMask.KERNEL32 ref: 00007FF642E13698
VerifyVersionInfoW.KERNEL32 ref: 00007FF642E136B9
VerSetConditionMask.KERNEL32 ref: 00007FF642E136FC
VerifyVersionInfoW.KERNEL32 ref: 00007FF642E1370D
MessageBoxW.USER32 ref: 00007FF642E1373B
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF642E1380F

Strings

IDDSetupActions::Install failed! Windows 10 version not supported, xrefs: 00007FF642E13717
IDDSetupActions::Install DeviceInfoSet.CreateDeviceNode success, xrefs: 00007FF642E137B6
IDDSetupActions::Install Install Process Finished, xrefs: 00007FF642E1382F
IDDSetupActions::Install DeviceInfoSet.CreateDeviceNode failed %d, xrefs: 00007FF642E137AD
98, xrefs: 00007FF642E136E9
Windows 10 version not supported, xrefs: 00007FF642E13732
Install failed!, xrefs: 00007FF642E1372B
IDDSetupActions::Install failed! Windows version not supported., xrefs: 00007FF642E13854
IDDSetupActions::Install Begin Install Process..., xrefs: 00007FF642E13627
IDDSetupActions::Install DiInstallDriver success, xrefs: 00007FF642E13819
IDDSetupActions::Install DiInstallDriver failed %d, xrefs: 00007FF642E137EF

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ConditionMask$Info$VerifyVersion$DestroyDeviceListMessageSetup
String ID: 98$IDDSetupActions::Install Begin Install Process...$IDDSetupActions::Install DeviceInfoSet.CreateDeviceNode failed %d$IDDSetupActions::Install DeviceInfoSet.CreateDeviceNode success$IDDSetupActions::Install DiInstallDriver failed %d$IDDSetupActions::Install DiInstallDriver success$IDDSetupActions::Install Install Process Finished$IDDSetupActions::Install failed! Windows 10 version not supported$IDDSetupActions::Install failed! Windows version not supported.$Install failed!$Windows 10 version not supported
API String ID: 2700560119-2907799221
Opcode ID: 6418241ce41e410b4eaa1010cb9a566d40ee586d4baca8c64cab1df858a32ca7
Instruction ID: 3c499d8c51aca830d7e2c9a5c9bc50faacfe0a9e55aad57ca27b57abfbd11783
Opcode Fuzzy Hash: 6418241ce41e410b4eaa1010cb9a566d40ee586d4baca8c64cab1df858a32ca7
Instruction Fuzzy Hash: 1571BD71A0CA4282E710FF24E8407B967A1FB45758F604239D69DC76E8DFBEE588C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E13F70 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 159
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32 ref: 00007FF642E13F9E

Strings

Call: %d/%d/%d %d:%d:%d Build: %S %S, xrefs: 00007FF642E13FFC
Jul 15 2019, xrefs: 00007FF642E13FE8
DriverSetup _tmain: Wrong action arguments "install" or "remove" , xrefs: 00007FF642E1421F
====================================================, xrefs: 00007FF642E13FA4
remove, xrefs: 00007FF642E14102
16:37:52, xrefs: 00007FF642E13FBA
DriverSetup _tmain: Removing device and driver..., xrefs: 00007FF642E141E5

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: LocalTime
String ID: ====================================================$16:37:52$Call: %d/%d/%d %d:%d:%d Build: %S %S$DriverSetup _tmain: Removing device and driver...$DriverSetup _tmain: Wrong action arguments "install" or "remove" $Jul 15 2019$remove
API String ID: 481472006-1379280510
Opcode ID: 1f1c3b3a2c98da29ed7ade547b96e98a51decfd9d55029b0bbaa74a23730cf53
Instruction ID: 00e3e98328fd3a1a86ecdeff0a056b02717ae2d5d27cab7beba14d6f4c1160fe
Opcode Fuzzy Hash: 1f1c3b3a2c98da29ed7ade547b96e98a51decfd9d55029b0bbaa74a23730cf53
Instruction Fuzzy Hash: CB51C862B1C79181EB10BF64E8002B9A761FB95768F600339EAAD93BD5DFBDD184C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E13B00 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E13C7E

Strings

DriverSetup _tmain: Installing device and driver..., xrefs: 00007FF642E14179
Call: %d/%d/%d %d:%d:%d Build: %S %S, xrefs: 00007FF642E13FFC
Jul 15 2019, xrefs: 00007FF642E13FE8
install, xrefs: 00007FF642E140BD
DriverSetup _tmain: Setup Success!, xrefs: 00007FF642E14201
DriverSetup _tmain:Exit Setup Failed, xrefs: 00007FF642E14213
DriverSetup _tmain: Uninstall previous device and driver first..., xrefs: 00007FF642E14187
DriverSetup _tmain: Wrong action arguments "install" or "remove" , xrefs: 00007FF642E1421F
====================================================, xrefs: 00007FF642E13FA4
remove, xrefs: 00007FF642E14102
16:37:52, xrefs: 00007FF642E13FBA

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ====================================================$16:37:52$Call: %d/%d/%d %d:%d:%d Build: %S %S$DriverSetup _tmain: Installing device and driver...$DriverSetup _tmain: Setup Success!$DriverSetup _tmain: Uninstall previous device and driver first...$DriverSetup _tmain: Wrong action arguments "install" or "remove" $DriverSetup _tmain:Exit Setup Failed$Jul 15 2019$install$remove
API String ID: 3668304517-3626524580
Opcode ID: 20efa88e6ce2be25d30c8158642f15d046da5ff4d7f8f5ef6fbe013f143cf46b
Instruction ID: e1e53072465819b954772ac9dd197f2df5d3b8181910ef342bcdf8713e1e2a4c
Opcode Fuzzy Hash: 20efa88e6ce2be25d30c8158642f15d046da5ff4d7f8f5ef6fbe013f143cf46b
Instruction Fuzzy Hash: DC41D226B0C69191EA04BB16D5042BD6B61FB44BECF244239CE6D47BD0DFBDE4D28340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E24EA4 Relevance: 13.8, APIs: 9, Instructions: 273
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF642E24A88: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E24AC9
Part of subcall function 00007FF642E24A88: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E24B49
Part of subcall function 00007FF642E24A88: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E24B9D
Part of subcall function 00007FF642E24A88: _get_daylight.LIBCMT ref: 00007FF642E24BF5

CreateFileW.KERNELBASE ref: 00007FF642E24FAA
CreateFileW.KERNEL32 ref: 00007FF642E24FFA
GetLastError.KERNEL32 ref: 00007FF642E2502A
GetFileType.KERNELBASE ref: 00007FF642E2503F
GetLastError.KERNEL32 ref: 00007FF642E25049
CloseHandle.KERNEL32 ref: 00007FF642E2507C
CloseHandle.KERNEL32 ref: 00007FF642E251D7
CreateFileW.KERNEL32 ref: 00007FF642E2520C
GetLastError.KERNEL32 ref: 00007FF642E2521B

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: ce18df10edfee4b7cca9ab3f4794dfe56517ee6091c7c382c7b3d2b0b3b863f8
Instruction ID: 004ce611fec5c24b056a21c2f86b8cc13facdf730c7bbe10bc8245577e4c0832
Opcode Fuzzy Hash: ce18df10edfee4b7cca9ab3f4794dfe56517ee6091c7c382c7b3d2b0b3b863f8
Instruction Fuzzy Hash: 98C1BF73B28A4285EB14EF69D4906AC3761FB48BA8B201239DA2E877D4CF7AD051C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E14A88 Relevance: 13.6, APIs: 9, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF642E14A97

Part of subcall function 00007FF642E14D20: __isa_available_init.LIBCMT ref: 00007FF642E14D3D
Part of subcall function 00007FF642E14D20: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF642E14D42

__scrt_release_startup_lock.LIBCMT ref: 00007FF642E14B1A
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF642E14B30
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF642E14B5C
__scrt_get_show_window_mode.LIBCMT ref: 00007FF642E14B6D
__scrt_is_managed_app.LIBCMT ref: 00007FF642E14B90
__scrt_uninitialize_crt.LIBCMT ref: 00007FF642E14BA7
__scrt_fastfail.LIBCMT ref: 00007FF642E14BD9
__scrt_fastfail.LIBCMT ref: 00007FF642E14BE4

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: __scrt_fastfail__scrt_is_nonwritable_in_current_image$__isa_available_init__scrt_get_show_window_mode__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 1587290953-0
Opcode ID: e5c44d8ad92b478862b948c34687c5e22606e722f49d1bf53a1e0d022d216bb8
Instruction ID: 21762c6e08f7cbf392765dc09a9aa20da4a8e9e54421dfa37487a503b5f0609a
Opcode Fuzzy Hash: e5c44d8ad92b478862b948c34687c5e22606e722f49d1bf53a1e0d022d216bb8
Instruction Fuzzy Hash: 89312A65E0C20745FA14BB6195617F91A91BF5178CFA4403CE60ECB7E7DEEEA884C210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E27800 Relevance: 10.8, APIs: 7, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E27C36

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 36cab3562cd4119044195181c9f11b63ba19f5a678f0cfc55da0a4610a529a7a
Instruction ID: 23948702201e3c36c54e0d056bc86573235a7119fbd43f1342a5edb0711d6ee8
Opcode Fuzzy Hash: 36cab3562cd4119044195181c9f11b63ba19f5a678f0cfc55da0a4610a529a7a
Instruction Fuzzy Hash: F7C1F2A2A0C68741EB20BB2594402FD7B91FF81B98F650179DA4F83795DEFEE495C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E25D04 Relevance: 7.7, APIs: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E25D45
GetConsoleMode.KERNEL32 ref: 00007FF642E25E04
GetLastError.KERNEL32 ref: 00007FF642E25E84

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 774a35251612d5c2edf0d44ee06614149a02f96cc033c35a951073a6a5548689
Instruction ID: 9388233ff90d3697f166a6c6e992d9d1e41edc9be80ef96ee420baf92d28c6eb
Opcode Fuzzy Hash: 774a35251612d5c2edf0d44ee06614149a02f96cc033c35a951073a6a5548689
Instruction Fuzzy Hash: F38190B2E1C60389F714BB6585802FD26A0FF4479CF640139DA0FD7A95DFBAA485C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E129C0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF642E1A960: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1A984

OutputDebugStringW.KERNEL32 ref: 00007FF642E12C22

Part of subcall function 00007FF642E1A7A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1A7D9

Part of subcall function 00007FF642E1AA3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1AA5E

Strings

IDDDriverSetup: , xrefs: 00007FF642E12B01, 00007FF642E12B1D
C:\Users\Public\MirrorOpDisplaySetup.log, xrefs: 00007FF642E12A33

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$DebugOutputString
String ID: C:\Users\Public\MirrorOpDisplaySetup.log$IDDDriverSetup:
API String ID: 2581269838-419058318
Opcode ID: 1fdccb3333afe2d85403c7c69e84eb54a89c046a9ce12d80f55bf5ba7a8a31b5
Instruction ID: fee686b85fe384079d07a797d77051813a329687a766a8e86bf40806e4c34d7a
Opcode Fuzzy Hash: 1fdccb3333afe2d85403c7c69e84eb54a89c046a9ce12d80f55bf5ba7a8a31b5
Instruction Fuzzy Hash: 2961827261CB8681EB10FF15E8401BEA761FB84798F604235EA9D83BA9DFBDD585C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E142B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CM_Locate_DevNodeW.SETUPAPI ref: 00007FF642E142CD
CM_Reenumerate_DevNode.SETUPAPI ref: 00007FF642E14305

Strings

IDDUtilities::ScanForHardwareChanges CM_Reenumerate_DevNode failed, xrefs: 00007FF642E1430F
IDDUtilities::ScanForHardwareChanges CM_Locate_DevNode failed, xrefs: 00007FF642E142D7

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: Node$Locate_Reenumerate_
String ID: IDDUtilities::ScanForHardwareChanges CM_Locate_DevNode failed$IDDUtilities::ScanForHardwareChanges CM_Reenumerate_DevNode failed
API String ID: 663006516-2655738101
Opcode ID: de5a6593056758a1d5df4bd3b6a6829154c8c0efcc4f9c667fd4eb99a4ce45f3
Instruction ID: 8d8f1d48942e6f92fbe874405c88a2d43a76511eda2f55dd40a2aaadb132d130
Opcode Fuzzy Hash: de5a6593056758a1d5df4bd3b6a6829154c8c0efcc4f9c667fd4eb99a4ce45f3
Instruction Fuzzy Hash: B601DD66F0C58241FA10FB20F4522B52790FF8A78DFD01139D94D83766CDADD185DA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1B5A4 Relevance: 4.5, APIs: 3, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF642E1B5A3), ref: 00007FF642E1B5CD
TerminateProcess.KERNEL32(?,?,?,00007FF642E1B5A3), ref: 00007FF642E1B5D8
ExitProcess.KERNEL32 ref: 00007FF642E1B5E7

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0c95c501e3aa58c91eb204de892f5bc9b6e096e42d449aa4c61e527aa3f7e4b6
Instruction ID: f8f8e97c24f52b4e4ba8f8acfe9083c3875aba2eaa7f097855a3c95a56900542
Opcode Fuzzy Hash: 0c95c501e3aa58c91eb204de892f5bc9b6e096e42d449aa4c61e527aa3f7e4b6
Instruction Fuzzy Hash: 91E04FA0B1C31683FA147B3198863B92253BF98755F38453CC80F82396CDBFE8889620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E12CA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E12E4F

Strings

IDDSetupActions::PrivateInitializeGlobals: --%s --%s --{%08lX-%04hX-%04hX-%02hhX%02hhX-%02hhX%02hhX%02hhX%02hhX%02h, xrefs: 00007FF642E1308E

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: IDDSetupActions::PrivateInitializeGlobals: --%s --%s --{%08lX-%04hX-%04hX-%02hhX%02hhX-%02hhX%02hhX%02hhX%02hhX%02h
API String ID: 3668304517-916782376
Opcode ID: a894ce2d942afe69fb48e9ad5abdc3fb57e9f5241da4a0890cebf7d63fed4c43
Instruction ID: 20a2198607551ad3f1fe71ff6c8a39813432f1555e0b00b376d4a79d99f627ed
Opcode Fuzzy Hash: a894ce2d942afe69fb48e9ad5abdc3fb57e9f5241da4a0890cebf7d63fed4c43
Instruction Fuzzy Hash: E241FC6271869591EF04AF29D84837C6762FB41FCCF64403ACB4C47A6ADFAAD8C4C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E21880 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF642E218A3

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF642E21889, 00007FF642E2189C

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: try_get_function
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 2742660187-2031265017
Opcode ID: e69678c3cfe61916d7db9ea98564df39a8d9a643ad3256a5b6483599ddd7f16c
Instruction ID: 69728f2e98a40728f41d0cdad9e3aae005f09f0c33c638fa1b4e6dd53e69a1e6
Opcode Fuzzy Hash: e69678c3cfe61916d7db9ea98564df39a8d9a643ad3256a5b6483599ddd7f16c
Instruction Fuzzy Hash: B3E01AD5E0D60791FE18B792A8411E01210BF08778E685339D93E8A3D19EBE99958360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E18FB8 Relevance: 3.2, APIs: 2, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E18FF0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E19226

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 82216182e848de2abea6143fb377a1564691df6ac5a930d42d38bf4f79c2048e
Instruction ID: 32f0f7f244f7c27f972b2c57eed67f421a74e1b45824754f6c7ffea4f7a7df52
Opcode Fuzzy Hash: 82216182e848de2abea6143fb377a1564691df6ac5a930d42d38bf4f79c2048e
Instruction Fuzzy Hash: B471767290C21286E768BF29805417D3EA0FB05B1CF75113DDB4A8229CDFBAE8C1C769

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E25888 Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(00000000,00000000,?,00007FF642E25F11), ref: 00007FF642E2593B
GetLastError.KERNEL32 ref: 00007FF642E25957

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 27d347e4bcd25ef26ffbe790efe73bfa142ff14cf4f6cd0181413b1227ae1f4d
Instruction ID: 6cd1c31d7e3e7767f3f859fa7eb95c89a8d8368886c92a7b94081f0fa7d08620
Opcode Fuzzy Hash: 27d347e4bcd25ef26ffbe790efe73bfa142ff14cf4f6cd0181413b1227ae1f4d
Instruction Fuzzy Hash: 9531E0B2A0CB828ADB10BF14E5402E967A0FB087D8F64403AEB4EC3B14DFB9D555CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1F020 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF642E2511A), ref: 00007FF642E1F086
GetLastError.KERNEL32(?,?,?,00007FF642E2511A), ref: 00007FF642E1F090

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: be9002b8416e5295c7f2982e29ec05d96a0427f6fd9441a002e6fec03e55bcf1
Instruction ID: 37ab179527cd1b64ba819a772351e8da1e4fc5de1a5c2f9b75a80f738828364f
Opcode Fuzzy Hash: be9002b8416e5295c7f2982e29ec05d96a0427f6fd9441a002e6fec03e55bcf1
Instruction Fuzzy Hash: CC11A251F0C78341EE90732090902BC1A81BF657ACF34033DDA2EC62D2CEEFA4C54241

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E26FAC Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00007FF642E24CE0,?,?,?,?,?,?,00000000,?,00000000,00007FF642E24EEB), ref: 00007FF642E26FF0
GetLastError.KERNEL32(?,?,?,00007FF642E24CE0,?,?,?,?,?,?,00000000,?,00000000,00007FF642E24EEB), ref: 00007FF642E26FFA

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: f8b7599dcf22bb89b8b193dfe863a99efbf54b8ba5e020d3d78d394a76263e3e
Instruction ID: c19c898d9b548ee46c0476ac51ada8eccfecd04c5e6a1b51be1eae1a08a67d08
Opcode Fuzzy Hash: f8b7599dcf22bb89b8b193dfe863a99efbf54b8ba5e020d3d78d394a76263e3e
Instruction Fuzzy Hash: FF01E9A1A1C64381EE10BB26A4400B86650BF44BF4F745339E93F877D4DFBDD0958310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E25C18 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7e2edb4a4f1cf0e7c3c5d5c031aecd15cb96ee01b3a1357df52281ece434e74
Instruction ID: 450481875c62f297668633b26391b5aac5c3a8a27e99332c6cb7d355ede65d8f
Opcode Fuzzy Hash: d7e2edb4a4f1cf0e7c3c5d5c031aecd15cb96ee01b3a1357df52281ece434e74
Instruction Fuzzy Hash: BA219C62E1C24246E605BF6699423BD2A50BF407A8F75113CE91ED73D2EFFEE4818721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E26EB1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a336117cc6922ecb649ae1b676eb087051db96fcba9078e30f0755c774c229
Instruction ID: b8bd73f612ee51f0de8b80fd70f16535f5734c4a7625211d147f4c6e42665e90
Opcode Fuzzy Hash: 89a336117cc6922ecb649ae1b676eb087051db96fcba9078e30f0755c774c229
Instruction Fuzzy Hash: 712151A3A1C64685FA41BF6698413BC2A507F407B8F651338D92EC73D2CEFEA4818721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E24730 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E24753

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ed49867dc817cdbed8b5893793f95e782088cc0eca42dc952ae6e14dcc9c0ca3
Instruction ID: 65a45c22041ab21c549ef98d36a338f35fc10f3f980229fbf430eb32ca2f7269
Opcode Fuzzy Hash: ed49867dc817cdbed8b5893793f95e782088cc0eca42dc952ae6e14dcc9c0ca3
Instruction Fuzzy Hash: 7A219572A1CA8686D761BF18D4403B976B0FB85B58F344238EA6EC76D9DF7ED4408B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1B4E8 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF642E1B507

Part of subcall function 00007FF642E1B5F0: GetModuleHandleExW.KERNEL32 ref: 00007FF642E1B60C
Part of subcall function 00007FF642E1B5F0: GetProcAddress.KERNEL32 ref: 00007FF642E1B622
Part of subcall function 00007FF642E1B5F0: FreeLibrary.KERNEL32 ref: 00007FF642E1B63F

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: b50070ca2cf46ee1590de9f4002844b6b8e494ebe11e889baa32c7a63d0038af
Instruction ID: 33fcd0c315b3fed34fdb35a7b1d78a113d4df8f6cbb35f8e19ef1be2e3dbce84
Opcode Fuzzy Hash: b50070ca2cf46ee1590de9f4002844b6b8e494ebe11e889baa32c7a63d0038af
Instruction Fuzzy Hash: 5C214C32A087428AEB11BF68C4443FC3BA2FB4470CF68453ED60D86A85EFB9D585CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1A8A4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1A8CC

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 745ef307ceb8c17d98a6b64c954dd548f1c966b4d8a596774f449028c6480956
Instruction ID: f57832f40f7ac6d66ed7ea3a367e6cdd3eb6fa4149822580d99b7ac8d68e13af
Opcode Fuzzy Hash: 745ef307ceb8c17d98a6b64c954dd548f1c966b4d8a596774f449028c6480956
Instruction Fuzzy Hash: 1F114F22A1C64141FB51BB5194403BDAA90BF95B88FA84139EA4C87786DEBEE8C1D740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E209A4 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E209CF

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2498f85bfee4162a121415b107d629ec5b7f8fca4dabd0d222d8cbc529f7e140
Instruction ID: 5b71214c1ddcc557c9d7f3ba1a0729342e98d8108152c55a2c8b89b8c592f151
Opcode Fuzzy Hash: 2498f85bfee4162a121415b107d629ec5b7f8fca4dabd0d222d8cbc529f7e140
Instruction Fuzzy Hash: 52116DB291C68286F310BB14E4401B967A4FB90748F650039D69ED7AE6DFBEE850C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1EF7C Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f21e3507edb8f12b6ac4b3c8d9479b54e610ff01785e5bc00f72deff8d0fcf
Instruction ID: c298dea0103b4c7e018ae048568371e5dac3c8e0ddf2b416d78eee7025a644e4
Opcode Fuzzy Hash: 39f21e3507edb8f12b6ac4b3c8d9479b54e610ff01785e5bc00f72deff8d0fcf
Instruction Fuzzy Hash: 47119D7391C68281EA04BB55D0402BC7BA1FF84758FA4423AE64D866E5CFFEE080CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1A9B8 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1A9D5

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: db9c21ed129521e5d2efa00b5566bc81da9f3a44f333d9117da0a51689f35792
Instruction ID: ea433647d03c1e8003d388980fe51ee6d1a3eeadd30ab89af8963d1eaa4ab41d
Opcode Fuzzy Hash: db9c21ed129521e5d2efa00b5566bc81da9f3a44f333d9117da0a51689f35792
Instruction Fuzzy Hash: AE017C21E1D20241FE14BB7A95513791951BF847ACF381338E92EC72C2DEAEE4C1D251

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1A7A8 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1A7D9

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0437a05a8b2fcdc18462a1ebf0f628809974bffd1a7324de2242080ef4244cf9
Instruction ID: 729439213ad56b760658b1b5e25bd9bddeec03368d7c6bbce5a267869c3b11cc
Opcode Fuzzy Hash: 0437a05a8b2fcdc18462a1ebf0f628809974bffd1a7324de2242080ef4244cf9
Instruction Fuzzy Hash: DE11B672A14F569CEB10EFA0D8404EC3BB8FB1435CB600639EA5D52B58EF74C1A5C390

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1F4EC Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF642E1CD79,?,?,C:\Users\Public\MirrorOpDisplaySetup.log,00007FF642E1C811,?,?,?,?,00007FF642E1A8C6), ref: 00007FF642E1F541

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2ef55415c9e227d195b9ddc74ff9287e2cd9f98d43b344d340616750f5254069
Instruction ID: 0da552f094c53871882296037796e9765d10c368867ea1e6ccf1f1ffe4a68518
Opcode Fuzzy Hash: 2ef55415c9e227d195b9ddc74ff9287e2cd9f98d43b344d340616750f5254069
Instruction Fuzzy Hash: F2F04951B1D30242FE687B6659502B81A807F48B88F7C003CC90EC67D1EEEEE8C19260

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1AA3C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1AA5E

Part of subcall function 00007FF642E1A9B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1A9D5

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 09df2e4c5f0ffa8ab7ce09f2aa3eb155f60663295c9cd0dc27636491b26e3699
Instruction ID: 4a3675acbad5117533bd2952d3b6dc1bc763c104c36987b1beea905c17ba7278
Opcode Fuzzy Hash: 09df2e4c5f0ffa8ab7ce09f2aa3eb155f60663295c9cd0dc27636491b26e3699
Instruction Fuzzy Hash: F8F0BE21E4C20245FE04BBA8A54117D2A80BF45398FB80238F96EC73C3DEAEE4C2D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1D0E8 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF642E1D126

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 722968801c6b56da2d06f15ee503b3e27699ed8673d5b55e0f3087e4ff32d4cc
Instruction ID: 0dc483acfaec8678c5ae46beef9b6bf2c3f0c9dbbb2bbc610d8ee3c6a7f37e54
Opcode Fuzzy Hash: 722968801c6b56da2d06f15ee503b3e27699ed8673d5b55e0f3087e4ff32d4cc
Instruction Fuzzy Hash: 5BF03411F1C20640FB147B6259412B92A90BF887A8F68023CD92EC53C1DEEEE4C14220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1A960 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1A984

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 63cec559c19ee4260ccbb5719ffa72cfb7ad2930d96ea3a12defc76b9ed1ce50
Instruction ID: 05c47fee9961a65c633bbc91950dac97636ac4826feec00a4404de79f17af537
Opcode Fuzzy Hash: 63cec559c19ee4260ccbb5719ffa72cfb7ad2930d96ea3a12defc76b9ed1ce50
Instruction Fuzzy Hash: 95F0BE22A1D70241EA00BB97A0C01782960BF48788F604138EA0C83346EE7DA4E08701

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF642E11650 Relevance: 61.6, APIs: 19, Strings: 16, Instructions: 394COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF642E116F3
GetLastError.KERNEL32 ref: 00007FF642E116FD
PathAppendW.SHLWAPI ref: 00007FF642E11734
GetLastError.KERNEL32 ref: 00007FF642E1173E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E11CD0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E11CD6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E11CDC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E11CE2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E11CE8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E11CEE

Strings

Version, xrefs: 00007FF642E116A1
MirrorOp, xrefs: 00007FF642E116D9
Provider, xrefs: 00007FF642E116CB
IDDDeviceInfoSet::RemoveDriverOemInf PrivateValidateDriverOemInfFile failed, xrefs: 00007FF642E11CB2
IDDDeviceInfoSet::RemoveDriverOemInf SetupUninstallOEMInf failed %d, xrefs: 00007FF642E11BE5
IDDDeviceInfoSet::RemoveDriverOemInf PathAppendW2 failed %d, xrefs: 00007FF642E117BB
IDDDeviceInfoSet::RemoveDriverOemInf PathAppendW1 failed %d, xrefs: 00007FF642E11749
IDDDeviceInfoSet::RemoveDriverOemInf Removing %s failed, xrefs: 00007FF642E11BFD
INF, xrefs: 00007FF642E11726
IDDDeviceInfoSet::RemoveDriverOemInf PrivateValidateDriverOemInfFile %s "%s" and "%s" matched, xrefs: 00007FF642E11B56
IDDDeviceInfoSet::RemoveDriverOemInf Removing %s, xrefs: 00007FF642E11BB5
IDDDeviceInfoSet::RemoveDriverOemInf FindFirstFileW failed %d, xrefs: 00007FF642E117FE
OEM*.INF, xrefs: 00007FF642E11798
IDDDeviceInfoSet::RemoveDriverOemInf GetWindowsDirectory failed %d, xrefs: 00007FF642E11708
IDDDeviceInfoSet::RemoveDriverOemInf PrivateValidateDriverOemInfFile %s didn't match, xrefs: 00007FF642E11C10
Class, xrefs: 00007FF642E116AF

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLast$AppendDirectoryPathWindows
String ID: Class$IDDDeviceInfoSet::RemoveDriverOemInf FindFirstFileW failed %d$IDDDeviceInfoSet::RemoveDriverOemInf GetWindowsDirectory failed %d$IDDDeviceInfoSet::RemoveDriverOemInf PathAppendW1 failed %d$IDDDeviceInfoSet::RemoveDriverOemInf PathAppendW2 failed %d$IDDDeviceInfoSet::RemoveDriverOemInf PrivateValidateDriverOemInfFile %s "%s" and "%s" matched$IDDDeviceInfoSet::RemoveDriverOemInf PrivateValidateDriverOemInfFile %s didn't match$IDDDeviceInfoSet::RemoveDriverOemInf PrivateValidateDriverOemInfFile failed$IDDDeviceInfoSet::RemoveDriverOemInf Removing %s$IDDDeviceInfoSet::RemoveDriverOemInf Removing %s failed$IDDDeviceInfoSet::RemoveDriverOemInf SetupUninstallOEMInf failed %d$INF$MirrorOp$OEM*.INF$Provider$Version
API String ID: 4142974495-2044558743
Opcode ID: a23dbb0e6d4b7b2b8b5a9e3ff98523dff7d922e63d679815ebf66a74b533c89a
Instruction ID: 1ed719d36de1040de5ffcfe3a7c61e946e66da782728da5d2f6831eeb98f2426
Opcode Fuzzy Hash: a23dbb0e6d4b7b2b8b5a9e3ff98523dff7d922e63d679815ebf66a74b533c89a
Instruction Fuzzy Hash: 2002B562B1CA8285EB10BB64D8843FD2761FB44798F604239DA5D97BDADFBED184C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E22DBC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1207COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF642E22E05
_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E23410
_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E235D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E237DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E23A9E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E23C99
memcpy_s.LIBCPMT ref: 00007FF642E23D87
memcpy_s.LIBCPMT ref: 00007FF642E23E32
memcpy_s.LIBCPMT ref: 00007FF642E23EFB

Strings

1#IND, xrefs: 00007FF642E23FA1
1#QNAN, xrefs: 00007FF642E23FB3
1#INF, xrefs: 00007FF642E23FCF
1#SNAN, xrefs: 00007FF642E23FAA

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: c088b6929c0f9bc34fe6dfb52d229c3f4b83aefbc7bca1ba8693c723832208dc
Instruction ID: 9267dfeee9ff3e3ce06723b19da27fa5c30e4a97e626bf0eeaea09deab57293c
Opcode Fuzzy Hash: c088b6929c0f9bc34fe6dfb52d229c3f4b83aefbc7bca1ba8693c723832208dc
Instruction Fuzzy Hash: 7AB2F7B2A1C2838AE765EE25D4407F977A1FB4478CF601139DA0B97B84DFBAE5408F11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1F6F0 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1F739

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 115ced47fba728b64034feec603b799796ce04428ae76f6d02db1c29cd062fd7
Instruction ID: 2ba0e06ad5711626d7da124f1922928262628d0dbd1833eaa7ea5dac7d4e68a2
Opcode Fuzzy Hash: 115ced47fba728b64034feec603b799796ce04428ae76f6d02db1c29cd062fd7
Instruction Fuzzy Hash: A0A1C662B1CB8241EA20FF6294105BA6BA0FB44BD8F604539DE5E87BD4DFFED4858340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E183BC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF642E18435
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF642E1844D
RtlVirtualUnwind.KERNEL32 ref: 00007FF642E18488
IsDebuggerPresent.KERNEL32 ref: 00007FF642E184C1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF642E184CB
UnhandledExceptionFilter.KERNEL32 ref: 00007FF642E184D6

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: c218e6428fe59945107506239c80b73fb5df4707f7e3fcad3d969d2b93b23afb
Instruction ID: 28c60531996a30caf155b7395d2ff2adef9c37d09d7b95c52638dc8b5616e5d7
Opcode Fuzzy Hash: c218e6428fe59945107506239c80b73fb5df4707f7e3fcad3d969d2b93b23afb
Instruction Fuzzy Hash: 22316176608B8285E760EF25E8406FE77A0FB88758F640139EA9D83B54DF79C585CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E253AC Relevance: 7.8, APIs: 5, Instructions: 325fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 00007FF642E2541B
WriteFile.KERNEL32 ref: 00007FF642E256CA
WriteFile.KERNEL32 ref: 00007FF642E2571C
GetLastError.KERNEL32 ref: 00007FF642E25863
GetLastError.KERNEL32 ref: 00007FF642E25875

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 0a16433618475bb2fbb724adfe60251262132465e8a8c9069d17f2d8e41059e0
Instruction ID: 5881d87ee3c5ce3ea3c7392c3c33a0be73f27b24a2122d4d7b3f3e41e4d6a512
Opcode Fuzzy Hash: 0a16433618475bb2fbb724adfe60251262132465e8a8c9069d17f2d8e41059e0
Instruction Fuzzy Hash: F5E1FFB2B0CA828AE715EB64D5401ED7BB1FB447DCB64013ACE4E87B89DE79D15AC310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1D6EC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1D750

Strings

gfffffff, xrefs: 00007FF642E1D9ED

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: eb9b58d48915d5d3ffdb1694eed1e2520faa93a2238d0f6c1b62b2a1e239f2e1
Instruction ID: 66c246c61ea0493ce619da6a0ecd85491c41a888c200906d992583dd415f5d6d
Opcode Fuzzy Hash: eb9b58d48915d5d3ffdb1694eed1e2520faa93a2238d0f6c1b62b2a1e239f2e1
Instruction Fuzzy Hash: 9C913766B0D78586EF11FB26A0003BD7B94BB55B88F258036CA5DC7395DEBEE542C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E22990 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF642E229F6
memcpy_s.LIBCPMT ref: 00007FF642E22A21

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4ea583caa57715286bcbaff0c0c248d65fdcd68c244adb70adfc071040c02cb8
Instruction ID: ab2d745c5c4d5bb22cd6170048a7024ec0ae5ce5549b161b53de912b1fa0836f
Opcode Fuzzy Hash: 4ea583caa57715286bcbaff0c0c248d65fdcd68c244adb70adfc071040c02cb8
Instruction Fuzzy Hash: 07C1E7B2B1C28787EB24EF19E0446A9B791F794788F548539DB4B83745DE7DE801CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E28568 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF642E287B7
RaiseException.KERNEL32 ref: 00007FF642E287C8

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 95f61eeb739547d073861f78051d6f3c476241b31da44aaeb0ef501daefc93bb
Instruction ID: d03bfb4528f18afa4eaffbbe9518e55e78c1f51f6652cd3da6f53c23a36630eb
Opcode Fuzzy Hash: 95f61eeb739547d073861f78051d6f3c476241b31da44aaeb0ef501daefc93bb
Instruction Fuzzy Hash: 29B15DB7604B458BEB19DF29C8423A837A0F744B4CF258925DA5EC77A4CF7AD412C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E247F4 Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF642E24858

Part of subcall function 00007FF642E1B6C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1B6DC

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 2c0e8cf9ecd32d47927021ebdc77bddd88ff9bcbcbc81d18fe1dfc7b5bc233b3
Instruction ID: cc06bc9142333f32c0c0fb2e64ec5cbb952074bdf2a5b44662c3dfba19d48b94
Opcode Fuzzy Hash: 2c0e8cf9ecd32d47927021ebdc77bddd88ff9bcbcbc81d18fe1dfc7b5bc233b3
Instruction Fuzzy Hash: A471E6A2E1C18345FB68BE6994407B962C1BF40368F34463DD66FD66D5DEBEE8408720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E197E8 Relevance: 1.5, Strings: 1, Instructions: 217COMMON

Download Yara Rule

Strings

IDDDriverSetup: , xrefs: 00007FF642E197F4

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: IDDDriverSetup:
API String ID: 3215553584-3399996212
Opcode ID: eeecbc9370603bd795ef03539da0dfcad55c3f8d195f77c9a7197fff2f096a54
Instruction ID: cd05b06c3591b8e7aeb023942e0fb76a7668ece9f0727e31993ff09a75269fd1
Opcode Fuzzy Hash: eeecbc9370603bd795ef03539da0dfcad55c3f8d195f77c9a7197fff2f096a54
Instruction Fuzzy Hash: 5981A425A1C24346EB68BB1580406B92AA0FB4474CFA4513DDF4ED72DDDEBFE8C6C609

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E19AC8 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF642E19C97

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 649e0a7f1f2a183af6f7ecf5fee3c563b9f904e0040214e62e5041397cd9e972
Instruction ID: e997a9cab9d18a30c8db68cf7f785e80526f863f526a8c63011d3349155f05bf
Opcode Fuzzy Hash: 649e0a7f1f2a183af6f7ecf5fee3c563b9f904e0040214e62e5041397cd9e972
Instruction Fuzzy Hash: C6718825A1C24282EA68BB1980505F92AD1FF4074CFA4513DDF8D9769DCEAFE8C3D60D

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E21CD8 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF642E21CDC

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8cb911616c0c471bd8f1c4d055677fc15ca31b6172e8a1e6e6f084f6f4521530
Instruction ID: 7dd1896884681789066354701945cb61c81914e12105e79637f35ba1e5272f0a
Opcode Fuzzy Hash: 8cb911616c0c471bd8f1c4d055677fc15ca31b6172e8a1e6e6f084f6f4521530
Instruction Fuzzy Hash: 47B09220E0BA02C2EA083B126C8265422E57F48705FA8807CC10D81720DEAE20A55710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1B9F8 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a6b7901535879102e52d180541d17e935bd36162002a264cb2cab31585bdd6f6
Instruction ID: 350f8b351fedf349d8052b9e3920fa0a874eb8c3be6315a5092c3f84fd1baf9e
Opcode Fuzzy Hash: a6b7901535879102e52d180541d17e935bd36162002a264cb2cab31585bdd6f6
Instruction Fuzzy Hash: 28412662718A5482FF04EF2AD9501B97791BB48FD8B18913ADE0DC7B58DF7DC0868300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E28280 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773ce178cf9d8c58a0c86e4b7ff20be9513e03678f5b126c918c20272d577166
Instruction ID: 593cc1ba588e0c4f10a3e87e3683dd2ba250b8b9cd4f4ee91e5250c13a5c2b3c
Opcode Fuzzy Hash: 773ce178cf9d8c58a0c86e4b7ff20be9513e03678f5b126c918c20272d577166
Instruction Fuzzy Hash: A1F044717186658BDBA4AF29A44262977D0F708385F50803DD68DC3E14DB7D94518F08

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1529C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b286ab134bbf7995b5c3fb49a7b69422194a8c5c8628ae7bda57b0ba49535a70
Instruction ID: a25d032b3f7d6da4f50d7305c691c010651a07a390589e91bf82830632f40cf4
Opcode Fuzzy Hash: b286ab134bbf7995b5c3fb49a7b69422194a8c5c8628ae7bda57b0ba49535a70
Instruction Fuzzy Hash: F5A002A290DC13D4E608BB00EC514742734FB50359B64C039D00ED25609FBEE880D360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E130F0 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 287fileCOMMON

Download Yara Rule

APIs

InstallHinfSectionW.SETUPAPI ref: 00007FF642E13166
SHDeleteKeyW.SHLWAPI ref: 00007FF642E131A9
GetSystemDirectoryW.KERNEL32 ref: 00007FF642E131ED
DeleteFileW.KERNEL32 ref: 00007FF642E1336A
DeleteFileW.KERNEL32 ref: 00007FF642E1345B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E135D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E135D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E135DD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E135E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E135E9

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services\MirrorOpVirtualDisplay, xrefs: 00007FF642E13183
\drivers\UMDF\, xrefs: 00007FF642E1324E, 00007FF642E13269
IDDSetupActions::PrivateCleanup SHDeleteKey failed! %d, xrefs: 00007FF642E131B6
MirrorOpVirtualDisplay1_2.dll, xrefs: 00007FF642E13370
IDDSetupActions::PrivateCleanup Removing file and registry entry, xrefs: 00007FF642E1312B
DefaultUninstall 128 , xrefs: 00007FF642E13140
MirrorOpVirtualDisplay1_0.dll, xrefs: 00007FF642E1327F

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Delete$File$DirectoryHinfInstallSectionSystem
String ID: DefaultUninstall 128 $IDDSetupActions::PrivateCleanup Removing file and registry entry$IDDSetupActions::PrivateCleanup SHDeleteKey failed! %d$MirrorOpVirtualDisplay1_0.dll$MirrorOpVirtualDisplay1_2.dll$SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services\MirrorOpVirtualDisplay$\drivers\UMDF\
API String ID: 3428179359-2394112160
Opcode ID: 6449a2557ed0ab4c11eae37c6624858533e72db506172eebe3eadb8f37aa4b5d
Instruction ID: e4d5c8d02cec2379b8c59f1986bfc48806fb27e4d2f779cda55bb774f585e9fe
Opcode Fuzzy Hash: 6449a2557ed0ab4c11eae37c6624858533e72db506172eebe3eadb8f37aa4b5d
Instruction Fuzzy Hash: B4D18462A1C78281FE00BB68D4452BD6721FB857A8F605239DAAD52AE9DFBDD1C4C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E113D0 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 148COMMON

Download Yara Rule

APIs

SetupDiGetClassDevsW.SETUPAPI ref: 00007FF642E11414
GetLastError.KERNEL32 ref: 00007FF642E11423
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF642E11494
GetLastError.KERNEL32 ref: 00007FF642E1149C
SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF642E114EF
GetLastError.KERNEL32 ref: 00007FF642E114F9
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF642E115B0
GetLastError.KERNEL32 ref: 00007FF642E115B8

Strings

IDDDeviceInfoSet::RemoveDeviceNode No Device instance found, xrefs: 00007FF642E115E0
IDDDeviceInfoSet::RemoveDeviceNode SetupDiGetDeviceRegistryProperty (4) failed %d, xrefs: 00007FF642E11576
IDDDeviceInfoSet::RemoveDeviceNode Find device instance/s..., xrefs: 00007FF642E1146F
IDDDeviceInfoSet::RemoveDeviceNode SetupDiGetDeviceRegistryProperty (1) failed %d, xrefs: 00007FF642E114FF
IDDDeviceInfoSet::RemoveDeviceNode SetupDiGetClassDevs failed %d, xrefs: 00007FF642E11429
IDDDeviceInfoSet::RemoveDeviceNode Current HWID = %s, xrefs: 00007FF642E11522
IDDDeviceInfoSet::RemoveDeviceNode No more items, xrefs: 00007FF642E115CB
IDDDeviceInfoSet::RemoveDeviceNode Found an instance = %s %d, xrefs: 00007FF642E11594
IDDDeviceInfoSet::RemoveDeviceNode SetupDiGetClassDevs success, xrefs: 00007FF642E1144E
IDDDeviceInfoSet::RemoveDeviceNode SetupDiEnumDeviceInfo failed %d, xrefs: 00007FF642E1162E

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ErrorLastSetup$Device$EnumInfo$ClassDevsPropertyRegistry
String ID: IDDDeviceInfoSet::RemoveDeviceNode Current HWID = %s$IDDDeviceInfoSet::RemoveDeviceNode Find device instance/s...$IDDDeviceInfoSet::RemoveDeviceNode Found an instance = %s %d$IDDDeviceInfoSet::RemoveDeviceNode No Device instance found$IDDDeviceInfoSet::RemoveDeviceNode No more items$IDDDeviceInfoSet::RemoveDeviceNode SetupDiEnumDeviceInfo failed %d$IDDDeviceInfoSet::RemoveDeviceNode SetupDiGetClassDevs failed %d$IDDDeviceInfoSet::RemoveDeviceNode SetupDiGetClassDevs success$IDDDeviceInfoSet::RemoveDeviceNode SetupDiGetDeviceRegistryProperty (1) failed %d$IDDDeviceInfoSet::RemoveDeviceNode SetupDiGetDeviceRegistryProperty (4) failed %d
API String ID: 2622032799-1916981457
Opcode ID: eca7a7d3da830926f56062e4d1c70cb1dc498bfe433297cd96fdfde324f8f800
Instruction ID: 157ce61836f8913999ea0971d3b2ba4cd072a485b8277f823109dd428f337e29
Opcode Fuzzy Hash: eca7a7d3da830926f56062e4d1c70cb1dc498bfe433297cd96fdfde324f8f800
Instruction Fuzzy Hash: 2C51B761A0C68282F711BB64E8447F92761FF88799F604139DA4E87796DFBED588C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E13890 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 140COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32 ref: 00007FF642E1391A
VerSetConditionMask.KERNEL32 ref: 00007FF642E13929
VerSetConditionMask.KERNEL32 ref: 00007FF642E13938
VerifyVersionInfoW.KERNEL32 ref: 00007FF642E13959
VerSetConditionMask.KERNEL32 ref: 00007FF642E1399C
VerifyVersionInfoW.KERNEL32 ref: 00007FF642E139AD
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF642E13A79

Strings

IDDSetupActions::Uninstall DeviceInfoSet.RemoveDeviceOemInf success, xrefs: 00007FF642E13A83
IDDSetupActions::Uninstall Begin Uninstall Process..., xrefs: 00007FF642E138C7
IDDSetupActions::Uninstall failed! Windows 10 version not supported, xrefs: 00007FF642E139B7
IDDSetupActions::Uninstall DeviceInfoSet.RemoveDeviceNode failed %d, xrefs: 00007FF642E13A26
IDDSetupActions::Uninstall DeviceInfoSet.RemoveDeviceNode success, xrefs: 00007FF642E13A2F
IDDSetupActions::Uninstall Uninstall Process Finished, xrefs: 00007FF642E13AA1
IDDSetupActions::Uninstall failed! Windows version not supported., xrefs: 00007FF642E13AC6
98, xrefs: 00007FF642E13989
IDDSetupActions::Uninstall DeviceInfoSet.RemoveDeviceOemInf failed %d, xrefs: 00007FF642E13A59

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ConditionMask$Info$VerifyVersion$DestroyDeviceListSetup
String ID: 98$IDDSetupActions::Uninstall Begin Uninstall Process...$IDDSetupActions::Uninstall DeviceInfoSet.RemoveDeviceNode failed %d$IDDSetupActions::Uninstall DeviceInfoSet.RemoveDeviceNode success$IDDSetupActions::Uninstall DeviceInfoSet.RemoveDeviceOemInf failed %d$IDDSetupActions::Uninstall DeviceInfoSet.RemoveDeviceOemInf success$IDDSetupActions::Uninstall Uninstall Process Finished$IDDSetupActions::Uninstall failed! Windows 10 version not supported$IDDSetupActions::Uninstall failed! Windows version not supported.
API String ID: 2937069726-1076954044
Opcode ID: 40adedddcf1ee346f5cea53ffa205ac62cdaa207c9ad8ff41f13a03365b9a47a
Instruction ID: c055299bd3beabc5357478b43971592b8c856d71ffd9db6d79d9cc49721a69f1
Opcode Fuzzy Hash: 40adedddcf1ee346f5cea53ffa205ac62cdaa207c9ad8ff41f13a03365b9a47a
Instruction Fuzzy Hash: BB618C3160CA4286E710FF64E8403B967A1FB45798F604239D6ADC76E9DFBEE588C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E11D00 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

SetupOpenInfFileW.SETUPAPI ref: 00007FF642E11D3C
GetLastError.KERNEL32(?,?,?,00000000), ref: 00007FF642E11D4B
SetupFindFirstLineW.SETUPAPI(?,?,?,00000000), ref: 00007FF642E11DA3
SetupGetStringFieldW.SETUPAPI ref: 00007FF642E11DCB
SetupCloseInfFile.SETUPAPI ref: 00007FF642E11E0C

Strings

IDDDeviceInfoSet::SetupFindFirstLine SetupOpenInfFile failed %d, xrefs: 00007FF642E11E3B
IDDDeviceInfoSet::SetupGetStringField SetupOpenInfFile failed %d, xrefs: 00007FF642E11E2C
IDDDeviceInfoSet::PrivateValidateDriverOemInfFile SetupOpenInfFile failed %d, xrefs: 00007FF642E11D51

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: Setup$File$CloseErrorFieldFindFirstLastLineOpenString
String ID: IDDDeviceInfoSet::PrivateValidateDriverOemInfFile SetupOpenInfFile failed %d$IDDDeviceInfoSet::SetupFindFirstLine SetupOpenInfFile failed %d$IDDDeviceInfoSet::SetupGetStringField SetupOpenInfFile failed %d
API String ID: 72482887-258866419
Opcode ID: 6effdb1bf031944deee5388926a05c0b64691f1103955cb96cc82631e727b3e2
Instruction ID: 2dc5fdf88ac01478fe7c5ff39951fa7753ad52a9124bc53738ce2b48b97ff5bd
Opcode Fuzzy Hash: 6effdb1bf031944deee5388926a05c0b64691f1103955cb96cc82631e727b3e2
Instruction Fuzzy Hash: 0041C672B0C64385E720BB61E4047B927A1FB89B99F604539D90EC7796EFBED085C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E14350 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF642E14394
GetLastError.KERNEL32 ref: 00007FF642E143B4
PathRemoveFileSpecW.SHLWAPI ref: 00007FF642E14429
GetLastError.KERNEL32 ref: 00007FF642E14445
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E14597
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E1459D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E145A3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF642E145A9
__std_exception_copy.LIBVCRUNTIME ref: 00007FF642E145D7

Strings

IDDUtilities::GetInfFilePath GetFullPathName failed %d, xrefs: 00007FF642E143BD, 00007FF642E1444E

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorFileLast$ModuleNamePathRemoveSpec__std_exception_copy
String ID: IDDUtilities::GetInfFilePath GetFullPathName failed %d
API String ID: 1997793096-207959331
Opcode ID: 07fa57dc8d8a4c9dd7da9d19e4dfccf55f3e54efb9c370bb08f20c8a6909138d
Instruction ID: c37b3c4f3b4671d49fd9c787236a7bca39fab009a4cf82b32be8fad03e15eafe
Opcode Fuzzy Hash: 07fa57dc8d8a4c9dd7da9d19e4dfccf55f3e54efb9c370bb08f20c8a6909138d
Instruction Fuzzy Hash: 5C6191A2B0C68281EB14BF64E4453BD2762FF45B98FA04139DA5D877D9DFAED584C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1DF84 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1E0F2

Strings

NAN(IND), xrefs: 00007FF642E1E030
NAN, xrefs: 00007FF642E1DFE2
nan(snan), xrefs: 00007FF642E1E025
inf, xrefs: 00007FF642E1E00B
nan(ind), xrefs: 00007FF642E1E04A
INF, xrefs: 00007FF642E1DFF8
NAN(SNAN), xrefs: 00007FF642E1E01A
nan, xrefs: 00007FF642E1DFE9

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 5914814a694583f4a61488e3cdbdbea4ea1b157881318f00679f426ebb2538fd
Instruction ID: ce3472c30740b9064d970807e5c4a0bcc234c9c8460a8f34a643d7a1d559112c
Opcode Fuzzy Hash: 5914814a694583f4a61488e3cdbdbea4ea1b157881318f00679f426ebb2538fd
Instruction Fuzzy Hash: AE41BD72B08B4189E700EF21E8407ED37A9FB18388F644139EA4D87B95EE7ED565C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E28418 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,00000000,00007FF642E27C7E), ref: 00007FF642E28449
GetLastError.KERNEL32(?,00000000,00007FF642E27C7E), ref: 00007FF642E28455
CloseHandle.KERNEL32(?,00000000,00007FF642E27C7E), ref: 00007FF642E2846D
CreateFileW.KERNEL32 ref: 00007FF642E28498
WriteConsoleW.KERNEL32 ref: 00007FF642E284B7

Strings

CONOUT$, xrefs: 00007FF642E28479

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 7c5524c766db8745df0ae9cd6cacbcd340f84a9c76657e64ac13ab8789daa13e
Instruction ID: 1100cb9c5d135987befc0d6bb02c6d1a5f9a6a8f15e53e2a71e7ec3fc7ec602e
Opcode Fuzzy Hash: 7c5524c766db8745df0ae9cd6cacbcd340f84a9c76657e64ac13ab8789daa13e
Instruction Fuzzy Hash: 43118161A1CA4286E750BB12E84476972A0FB8CBE8F244238DA5EC7BA4CFBDD4458754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1B5F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF642E1B60C
GetProcAddress.KERNEL32 ref: 00007FF642E1B622
FreeLibrary.KERNEL32 ref: 00007FF642E1B63F

Strings

CorExitProcess, xrefs: 00007FF642E1B61B
mscoree.dll, xrefs: 00007FF642E1B603

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 47eae215630ea0066a852bd67f66c9f372bbf29a6d7780b217db0c198fc88bcc
Instruction ID: 687b14f59b390fe837ba70dac8395931e6f7df09af25942a2e86bf5d91e85b07
Opcode Fuzzy Hash: 47eae215630ea0066a852bd67f66c9f372bbf29a6d7780b217db0c198fc88bcc
Instruction Fuzzy Hash: 0BF05EA1B1DA4781EB447B50E8803B92760BF54B58F68103DD90FC66B0CEAEE588D720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E28080 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF642E280A8
_set_statfp.LIBCMT ref: 00007FF642E280C3
_set_statfp.LIBCMT ref: 00007FF642E280DF
_set_statfp.LIBCMT ref: 00007FF642E2811B

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: d1d10107198c09c3932fa6673c1dcca8ef673135442fdb47985b5f68ba886dfb
Instruction ID: 1a36a53fbe437f518f778705435850a7cb403f5dd2307e87dc051f1771bf2c78
Opcode Fuzzy Hash: d1d10107198c09c3932fa6673c1dcca8ef673135442fdb47985b5f68ba886dfb
Instruction Fuzzy Hash: 5111A3E2E1CA6301F6A4B124E8563F511407F55378F38473CEA6FD62DA9EDEA8834131

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1EBA8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1EE51

Part of subcall function 00007FF642E24604: _invalid_parameter_noinfo.LIBCMT ref: 00007FF642E24621

Strings

UTF-8, xrefs: 00007FF642E1EDD4
UTF-16LEUNICODE, xrefs: 00007FF642E1EDF5
ccs, xrefs: 00007FF642E1ED9D

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: e0dcfc6a68e5356318c0fcd404b881987b5b91c36ccf0ae3963758e001cf1e56
Instruction ID: 448bc5de0b34a4549e17b6e975140ce89dbfc7b0fb9f23da4305d065a9575bfd
Opcode Fuzzy Hash: e0dcfc6a68e5356318c0fcd404b881987b5b91c36ccf0ae3963758e001cf1e56
Instruction Fuzzy Hash: B3816C72D0C24385F7657B3886542792EA1BF1274CF7D503DEA0EC6695CEAFA881D702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E17396 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF642E16220: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF642E16224

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF642E173BE
RaiseException.KERNEL32 ref: 00007FF642E173E7
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF642E17448

Strings

csm, xrefs: 00007FF642E1741B

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 3ebccaa0a3721d2e0e78a4e67fbc84bec37a22bf9295ac705805b121bfc1fb08
Instruction ID: 9ffe994c05dd84524eff7ff262624dcbed63faab08208a8e8f2f4a881c1d6914
Opcode Fuzzy Hash: 3ebccaa0a3721d2e0e78a4e67fbc84bec37a22bf9295ac705805b121bfc1fb08
Instruction Fuzzy Hash: D9212B76A0864586E630BB11F04067E7B61F784BA8F100239DE9E43795CF7EE8C2CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E219E4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF642E21A0D
TlsSetValue.KERNEL32(?,?,C:\Users\Public\MirrorOpDisplaySetup.log,00007FF642E1CD66,?,?,C:\Users\Public\MirrorOpDisplaySetup.log,00007FF642E1C811,?,?,?,?,00007FF642E1A8C6), ref: 00007FF642E21A24

Strings

C:\Users\Public\MirrorOpDisplaySetup.log, xrefs: 00007FF642E219E9
FlsSetValue, xrefs: 00007FF642E219F1, 00007FF642E219FA

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: Valuetry_get_function
String ID: C:\Users\Public\MirrorOpDisplaySetup.log$FlsSetValue
API String ID: 738293619-4229585492
Opcode ID: 0469a287eda2f5178412d1d50b89cb8822170f4ca3f195091d7258d2e54259c3
Instruction ID: a0da7cb01c8153800b880d0d0b01f8641e9f5eed68c625b2a66faa79e1e58314
Opcode Fuzzy Hash: 0469a287eda2f5178412d1d50b89cb8822170f4ca3f195091d7258d2e54259c3
Instruction Fuzzy Hash: A6E030E5A1C60381EE04BB51E4400F82322BF48B98F785039D51F8B795CEBED694C771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E24A88 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E24AC9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E24B49
_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E24B9D
_get_daylight.LIBCMT ref: 00007FF642E24BF5

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 99e2753389c6de09961ab763d8692691d7301ab5aa3fed7a21eb5d97f3c91e9e
Instruction ID: 8ebc460f52641ad7a6df58ca286bccbd844b0958f8a988725ee1485091767308
Opcode Fuzzy Hash: 99e2753389c6de09961ab763d8692691d7301ab5aa3fed7a21eb5d97f3c91e9e
Instruction Fuzzy Hash: 1A51B1B6E0C60386F7697A28D5653F96A80FB4071CF39413DCA0BC62D5DEEEE8408661

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1DB38 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1DB7B

Strings

e+000, xrefs: 00007FF642E1DC20
gfff, xrefs: 00007FF642E1DC9D

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 74e56a55970d42afd6bce679688fc2a57d31610b12a62597bc6a378fc0ec2037
Instruction ID: f100b6fe8a6ce9d6c411a9df51474be70d20a9d86ac07bfc55ceaffde88b4148
Opcode Fuzzy Hash: 74e56a55970d42afd6bce679688fc2a57d31610b12a62597bc6a378fc0ec2037
Instruction Fuzzy Hash: 94511662B1C6C246E724AF2998403B97F91FB80B94F589239C79CC7BD5CEAED480C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E1AF2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF642E1AF5E

Part of subcall function 00007FF642E1D0A8: HeapFree.KERNEL32(?,?,?,00007FF642E20F84,?,?,?,00007FF642E20FC7,?,?,?,00007FF642E214F0,?,?,?,00007FF642E21423), ref: 00007FF642E1D0BE
Part of subcall function 00007FF642E1D0A8: GetLastError.KERNEL32(?,?,?,00007FF642E20F84,?,?,?,00007FF642E20FC7,?,?,?,00007FF642E214F0,?,?,?,00007FF642E21423), ref: 00007FF642E1D0D0

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF642E149FA), ref: 00007FF642E1AF7C

Strings

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe, xrefs: 00007FF642E1AF6A

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe
API String ID: 3580290477-3583085434
Opcode ID: e237b0c339fbfe9c2aa417fa0f0d7823cdb0a5b28ab6914af6b9d41c11cc57b2
Instruction ID: 820ad926282d4a523502890134b84b61b0a2e1fff3ba777bf1d966e31d48a383
Opcode Fuzzy Hash: e237b0c339fbfe9c2aa417fa0f0d7823cdb0a5b28ab6914af6b9d41c11cc57b2
Instruction Fuzzy Hash: 20413972A0CA1285EB15FF26A4801BD6A95FF44798F64413DEA4EC3B95DFBEE485C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E25AA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,?,00007FF642E25EFD), ref: 00007FF642E25BBF
GetLastError.KERNEL32(00000000,00000000,?,00000000,?,00007FF642E25EFD), ref: 00007FF642E25BE1

Strings

U, xrefs: 00007FF642E25B6B

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0a4a5744d57d7471710afcf482343fbecc98eb0496d10c81e4b9789d81163603
Instruction ID: 1daa08de381c59d030c14cb717d49f8d95ced110f36e7360febe139f8d07fe84
Opcode Fuzzy Hash: 0a4a5744d57d7471710afcf482343fbecc98eb0496d10c81e4b9789d81163603
Instruction Fuzzy Hash: BA41C3A2A1CA8282DB20AF25E4543E967A0FB887D8FA44135EE4EC7798DF7DD441C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E21A9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF642E21AD5
LCMapStringW.KERNEL32 ref: 00007FF642E21B5D

Strings

LCMapStringEx, xrefs: 00007FF642E21AB8, 00007FF642E21AC9

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 7cac5477dbe57fe43c47c71cc1271db3d77883f9a34b8e3e30b53b1ec36ae0a2
Instruction ID: 97cd0427e70872a268909e264cb54935a4b94e8edb5a4af45c634e3e12712239
Opcode Fuzzy Hash: 7cac5477dbe57fe43c47c71cc1271db3d77883f9a34b8e3e30b53b1ec36ae0a2
Instruction Fuzzy Hash: B4115E7660CB8186D760EB46F4402AAB7A4FB89B84F544139EE8E83B19CF3DD1408B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E21A38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF642E21A69
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,-00000018,00007FF642E1EB72,?,?,C:\Users\Public\MirrorOpDisplaySetup.log,00007FF642E1EA6A,?,?,00000080,00007FF642E1A909), ref: 00007FF642E21A83

Strings

InitializeCriticalSectionEx, xrefs: 00007FF642E21A4A, 00007FF642E21A5D

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: ddae6ecf774d961657188d649599536e05ef873d5f8b9a44976e7cd536bdf1e7
Instruction ID: f2d42ee25fb86292c75095745c6e45cafa5e1d149b7833de00e74417ec8526b9
Opcode Fuzzy Hash: ddae6ecf774d961657188d649599536e05ef873d5f8b9a44976e7cd536bdf1e7
Instruction Fuzzy Hash: 77F0BEE5A0C64782EB04BB92E4000E92220BF88B84F695139E92F47B45CEBED54483A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E21B78 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF642E21BA1
__crtDownlevelLocaleNameToLCID.LIBCPMT ref: 00007FF642E21BB8

Strings

LocaleNameToLCID, xrefs: 00007FF642E21B84, 00007FF642E21B8E

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: DownlevelLocaleName__crttry_get_function
String ID: LocaleNameToLCID
API String ID: 404522899-2050040251
Opcode ID: 92a71eb8c403a7bde1df688a4416805be7d7e8ef48885af5f3794540dc293ab6
Instruction ID: 87271e2456b913035ab689971e5f00b6e35fe1df780674638c6a1fa554905c25
Opcode Fuzzy Hash: 92a71eb8c403a7bde1df688a4416805be7d7e8ef48885af5f3794540dc293ab6
Instruction Fuzzy Hash: 33E0E5D5A0C503C1EF04B745E4010F82220BF8474CFB85039D90F8B786CE7EEA408360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF642E17C7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF642E17CA5
TlsSetValue.KERNEL32(?,?,?,00007FF642E16331,?,?,?,?,00007FF642E15FDC,?,?,?,?,00007FF642E14D47), ref: 00007FF642E17CBC

Strings

FlsSetValue, xrefs: 00007FF642E17C89, 00007FF642E17C92

Memory Dump Source

Source File: 00000007.00000002.2132065899.00007FF642E11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF642E10000, based on PE: true

Associated: 00000007.00000002.2132032980.00007FF642E10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132103057.00007FF642E2A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132131149.00007FF642E38000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000007.00000002.2132158381.00007FF642E3A000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff642e10000_MirrorOpSetup64.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: e177c66dba838f717c4c7ad0f142cb926c03ac4292b26ab65b9cb07a26fe3ff6
Instruction ID: cd1b1356101f280718e3b444ed2c5d8b7046de9903002016ca7d17dd5e37048d
Opcode Fuzzy Hash: e177c66dba838f717c4c7ad0f142cb926c03ac4292b26ab65b9cb07a26fe3ff6
Instruction Fuzzy Hash: D0E065A1A0C54381FA047B50E8400F83621BF48B98F78403DD51E86394CFBED4859324

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: WUDFHost.exePID: 6768, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1481
Total number of Limit Nodes:	9

Executed Functions

Function 00007FF8B90AB460 Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DbgPrintEx.NTDLL ref: 00007FF8B90AB4C9
DbgPrintEx.NTDLL ref: 00007FF8B90AB4DF
DbgPrintEx.NTDLL ref: 00007FF8B90AB527
DbgPrintEx.NTDLL ref: 00007FF8B90AB53D
DbgPrintEx.NTDLL ref: 00007FF8B90AB560
DbgPrintEx.NTDLL ref: 00007FF8B90AB576
DbgPrintEx.NTDLL ref: 00007FF8B90AB5AE
DbgPrintEx.NTDLL ref: 00007FF8B90AB5C4
DbgPrintEx.NTDLL ref: 00007FF8B90AB5F1
DbgPrintEx.NTDLL ref: 00007FF8B90AB607
DbgPrintEx.NTDLL ref: 00007FF8B90AB625
DbgPrintEx.NTDLL ref: 00007FF8B90AB63B

Strings

FxDriverEntryUm: PDRIVER_OBJECT_UM 0x%p Successfully returned from driver's DriverEntry, xrefs: 00007FF8B90AB62E
FxDriverEntrydUm Enter PDRIVER_OBJECT_UM 0x%p, xrefs: 00007FF8B90AB4D2
FxDriverEntryUm: VersionBind status %08X, xrefs: 00007FF8B90AB530
Wudfx2000: , xrefs: 00007FF8B90AB4BC, 00007FF8B90AB51A, 00007FF8B90AB553, 00007FF8B90AB5A1, 00007FF8B90AB5E4, 00007FF8B90AB618
FxDriverEntryUm: PDRIVER_OBJECT_UM 0x%p Successfully bound to version library, xrefs: 00007FF8B90AB569
FxDriverEntryUm: DriverEntry status %08X, xrefs: 00007FF8B90AB5FA
FxDriverEntryUm: PDRIVER_OBJECT_UM 0x%p Successfully bound to class library if present, xrefs: 00007FF8B90AB5B7

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Print
String ID: FxDriverEntryUm: DriverEntry status %08X$FxDriverEntryUm: PDRIVER_OBJECT_UM 0x%p Successfully bound to class library if present$FxDriverEntryUm: PDRIVER_OBJECT_UM 0x%p Successfully bound to version library$FxDriverEntryUm: PDRIVER_OBJECT_UM 0x%p Successfully returned from driver's DriverEntry$FxDriverEntryUm: VersionBind status %08X$FxDriverEntrydUm Enter PDRIVER_OBJECT_UM 0x%p$Wudfx2000:
API String ID: 3558298466-1472618948
Opcode ID: bb4ab19fbeff9559545acc8e689e09482ef8633d8afe6dfe3a3301a72c603fc2
Instruction ID: 4ec6a04e786d848aed02365bf88f24f6152f06e0a111a71001282d7d8528995a
Opcode Fuzzy Hash: bb4ab19fbeff9559545acc8e689e09482ef8633d8afe6dfe3a3301a72c603fc2
Instruction Fuzzy Hash: 9D512E24A09FC396EB548F59A8582B96361FF49BE4F504036DB0E573A9DE3CE44BCA40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A83E0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 135
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF8B90A841B
OpenProcess.KERNEL32 ref: 00007FF8B90A842B
GetLastError.KERNEL32 ref: 00007FF8B90A843E

Part of subcall function 00007FF8B90A23F4: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A24B4

K32EnumProcessModules.KERNEL32 ref: 00007FF8B90A84BC
GetCurrentProcess.KERNEL32 ref: 00007FF8B90A851C
VirtualProtect.KERNEL32 ref: 00007FF8B90A8578
VirtualProtect.KERNEL32 ref: 00007FF8B90A8594
FindCloseChangeNotification.KERNELBASE ref: 00007FF8B90A85CC

Strings

iddcx.dll, xrefs: 00007FF8B90A8502

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Process$CurrentProtectVirtual$AutoChangeCloseEnumErrorFindLastModulesNotificationOpenTrace
String ID: iddcx.dll
API String ID: 197447298-4163666229
Opcode ID: d1a90e512ccf06b52219f042a78ee737138c3a24375b34af5ca96d04cfab1a1d
Instruction ID: 99a10a7f3a68e81c91793795b26a066ef53483b4ff9041c37f3785ac6ec2e89c
Opcode Fuzzy Hash: d1a90e512ccf06b52219f042a78ee737138c3a24375b34af5ca96d04cfab1a1d
Instruction Fuzzy Hash: 0E51813261DA8285EE54DF2AA8546AA6370FB89BE4F404131EF5E47794DF3CE847CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A9774 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90A97B2

Part of subcall function 00007FF8B90AB994: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8B90AB9AE

Strings

8, xrefs: 00007FF8B90A985B
(, xrefs: 00007FF8B90A97E7

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: mallocmemset
String ID: ($8
API String ID: 2882185209-284530546
Opcode ID: f93b40dbff8dc9722ff73209c0e77ece645ce7ca20c8cf9f68070899220af56c
Instruction ID: bcff24a79c0058ccbec7b443b346f3ddc360805975fbb84ea634d8dffa78eeab
Opcode Fuzzy Hash: f93b40dbff8dc9722ff73209c0e77ece645ce7ca20c8cf9f68070899220af56c
Instruction Fuzzy Hash: B4614836A09B8285EB508F1AE8802A977B4FB89BE4F504136DF4D53765DF3CE446CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A9390 Relevance: 4.6, APIs: 3, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF8B90A93C2
RegQueryValueExW.ADVAPI32 ref: 00007FF8B90A9428
RegCloseKey.ADVAPI32 ref: 00007FF8B90A949C

Part of subcall function 00007FF8B90A9600: TraceMessage.ADVAPI32 ref: 00007FF8B90A96E8
Part of subcall function 00007FF8B90A9600: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A974E

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$AutoCloseMessageOpenQueryValue
String ID:
API String ID: 157522393-0
Opcode ID: b83dc03b227b42366ff2d5519f44e7d9cf7ad76f3d7e1daed7e8827a0b818578
Instruction ID: ac36bcd3c16b6712644453b39c204f9b86b17b4d28861070eaaab1cffa93a363
Opcode Fuzzy Hash: b83dc03b227b42366ff2d5519f44e7d9cf7ad76f3d7e1daed7e8827a0b818578
Instruction Fuzzy Hash: D5318D32718B8286DB208F15E48096973B8FB89BD8F540136DB9D43B65CF3DE546CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90AA090 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B90A2340: TraceMessage.ADVAPI32 ref: 00007FF8B90A23BC
Part of subcall function 00007FF8B90A2340: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A23DA

Part of subcall function 00007FF8B90A9DE8: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90A9E01

RtlInitUnicodeString.NTDLL ref: 00007FF8B90AA12D

Strings

\DosDevices\Global\v3DDKIndirectCtrlMirrorOp, xrefs: 00007FF8B90AA121

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$AutoInitMessageStringUnicodememset
String ID: \DosDevices\Global\v3DDKIndirectCtrlMirrorOp
API String ID: 3309296490-203415369
Opcode ID: 6237c8417ddc51fb533f343be5af83b2c491143f0f210a4f617f79f007cd6a3c
Instruction ID: add2ba2fbf2340f59b31f966baaca175742168f9ad27fca4c13a5bd2ba5c54d1
Opcode Fuzzy Hash: 6237c8417ddc51fb533f343be5af83b2c491143f0f210a4f617f79f007cd6a3c
Instruction Fuzzy Hash: 1D315A31B08B8281EE208F1AE8906796761FB89FE4F400032DF4D877A5CE6DE547DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A8F44 Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitUnicodeString.NTDLL ref: 00007FF8B90A8FEE

Part of subcall function 00007FF8B90A23F4: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A24B4

RtlInitUnicodeString.NTDLL ref: 00007FF8B90A9087

Part of subcall function 00007FF8B90A9600: TraceMessage.ADVAPI32 ref: 00007FF8B90A96E8
Part of subcall function 00007FF8B90A9600: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A974E

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$AutoInitStringUnicode$Message
String ID:
API String ID: 2970552445-0
Opcode ID: 26d93693c8a34fc82003f05adb3041b0b6f3c0deb2e5d1dad2c642d86f346ab4
Instruction ID: f7de2341916d37ea90358675ab64f7346cdae5c00d71ae7e421140694f6219d5
Opcode Fuzzy Hash: 26d93693c8a34fc82003f05adb3041b0b6f3c0deb2e5d1dad2c642d86f346ab4
Instruction Fuzzy Hash: FD511536B18A9685EB508F19E8847A92374FB89BE8F440136DF4D57768CF39D086CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A9EC8 Relevance: 1.3, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B90A2340: TraceMessage.ADVAPI32 ref: 00007FF8B90A23BC
Part of subcall function 00007FF8B90A2340: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A23DA

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90A9F64

Part of subcall function 00007FF8B90A23F4: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A24B4

Part of subcall function 00007FF8B90AA1CC: UnregisterTraceGuids.ADVAPI32(?,?,?,00007FF8B90AA00A), ref: 00007FF8B90AA1F7
Part of subcall function 00007FF8B90AA1CC: WppAutoLogStop.WPPRECORDERUM(?,?,?,00007FF8B90AA00A), ref: 00007FF8B90AA214

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$Auto$GuidsMessageStopUnregistermemset
String ID:
API String ID: 1399362584-0
Opcode ID: 6ddb2a2449b1b3cc31c96d76f3c801e575412145e0f3f500434ab18c60f2ec76
Instruction ID: 447388e7e9e41aaa3f5f52e608a01ac1adcad0ceb5f5df7cfab5a0375deb9c20
Opcode Fuzzy Hash: 6ddb2a2449b1b3cc31c96d76f3c801e575412145e0f3f500434ab18c60f2ec76
Instruction Fuzzy Hash: 18415B32A09B8299EB11CF19E8506AD33A5FB49798F804235DB4C43764CF3DE55ADB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A9DE8 Relevance: 1.3, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90A9E01

Part of subcall function 00007FF8B90A23F4: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A24B4

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: AutoTracememset
String ID:
API String ID: 689702502-0
Opcode ID: 9490bf59f5409ea6e6973d7511feb8822fd87c3eefbbca1bd2a373c16c37a8f0
Instruction ID: 274ee628bf40856efb7aaf6fa8e6040374cc1a08713b8bda76ea4cd6c7d1b107
Opcode Fuzzy Hash: 9490bf59f5409ea6e6973d7511feb8822fd87c3eefbbca1bd2a373c16c37a8f0
Instruction Fuzzy Hash: 5921B935619F8695EE118F19F4902AA73A4FB85790F500136DB8D43724EF3DE55ACB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF8B90ABB20 Relevance: 19.7, APIs: 13, Instructions: 235COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B90ABB48
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B90ABBAE
_RTC_Initialize.LIBCMT ref: 00007FF8B90ABBDC
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF8B90ABBE6
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B90ABC02
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B90ABC2D
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF8B90ABC4C
__scrt_fastfail.LIBCMT ref: 00007FF8B90ABC82
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B90ABCC4
_RTC_Initialize.LIBCMT ref: 00007FF8B90ABCE3
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B90ABCF6
__scrt_uninitialize_crt.LIBCMT ref: 00007FF8B90ABD00
__scrt_fastfail.LIBCMT ref: 00007FF8B90ABD13

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_default_local_stdio_options__scrt_is_nonwritable_in_current_image__scrt_uninitialize_crt
String ID:
API String ID: 1988982384-0
Opcode ID: 8d8b0e93604f7b03aea2aa78e3838d357983f06e7bcd9ff22b2a10f1b62a33d3
Instruction ID: a1fb7864e4ac59faab524732fad2b086e7745de671b8c3cad5ca27f265f97566
Opcode Fuzzy Hash: 8d8b0e93604f7b03aea2aa78e3838d357983f06e7bcd9ff22b2a10f1b62a33d3
Instruction Fuzzy Hash: 5291A221E1C6D386FE90AF7D94812B966D1AF85BE0F544435DB0D477A6DE3CE8438780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A7E40 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 117threadsynchronizationCOMMON

Download Yara Rule

APIs

AvSetMmThreadCharacteristicsW.AVRT ref: 00007FF8B90A7E66
GetCurrentThread.KERNEL32 ref: 00007FF8B90A7E9C
SetThreadPriority.KERNEL32 ref: 00007FF8B90A7EA8
WaitForSingleObject.KERNEL32 ref: 00007FF8B90A7F0C
ResetEvent.KERNEL32 ref: 00007FF8B90A7F3E
AvRevertMmThreadCharacteristics.AVRT ref: 00007FF8B90A7FF1

Part of subcall function 00007FF8B90A2340: TraceMessage.ADVAPI32 ref: 00007FF8B90A23BC
Part of subcall function 00007FF8B90A2340: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A23DA

WaitForMultipleObjects.KERNEL32 ref: 00007FF8B90A7F74

Strings

Distribution, xrefs: 00007FF8B90A7E5C

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Thread$CharacteristicsTraceWait$AutoCurrentEventMessageMultipleObjectObjectsPriorityResetRevertSingle
String ID: Distribution
API String ID: 3895777651-3162107001
Opcode ID: ba62c29dfb673f1b1e723df5feba3de5e7d2b8e6b0306b30644bfac8037b0bf5
Instruction ID: 87492dd58b92cbe38f1cb70ad0c8a5e0e5ad7426faf9d845038bc7b7706e0e06
Opcode Fuzzy Hash: ba62c29dfb673f1b1e723df5feba3de5e7d2b8e6b0306b30644bfac8037b0bf5
Instruction Fuzzy Hash: D1515D32A18A8682EE20DF1AE4905697760FB85FE8F404135DF4E47BA4DF3DE5479B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A7AA0 Relevance: 10.6, APIs: 7, Instructions: 58threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF8B90A7AD8
GetLastError.KERNEL32 ref: 00007FF8B90A7AE6

Part of subcall function 00007FF8B90A23F4: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A24B4

EnterCriticalSection.KERNEL32 ref: 00007FF8B90A7B1E
LeaveCriticalSection.KERNEL32 ref: 00007FF8B90A7B3D
TerminateThread.KERNEL32 ref: 00007FF8B90A7B4D
CloseHandle.KERNEL32 ref: 00007FF8B90A7B56

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: CriticalSectionThread$AutoCloseCreateEnterErrorHandleLastLeaveTerminateTrace
String ID:
API String ID: 2287874929-0
Opcode ID: cfd441021691846264737c729189ec89ccbfd936bbe59bff10446568655a7716
Instruction ID: 4cb02b1c0bd9c11bd20f3dad939a39e39fa4f9d4d941d648b18ca9d398baa7e0
Opcode Fuzzy Hash: cfd441021691846264737c729189ec89ccbfd936bbe59bff10446568655a7716
Instruction Fuzzy Hash: 60218E32A18A8286EF54CF29E8802A97375FB49BD8F504131DB4D43768DF3CE946CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90AAC80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90A23F4: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A24B4

CreateEventW.KERNEL32 ref: 00007FF8B90AAE30
GetLastError.KERNEL32 ref: 00007FF8B90AAE3E

Part of subcall function 00007FF8B90AB31C: TraceMessage.ADVAPI32 ref: 00007FF8B90AB3DB
Part of subcall function 00007FF8B90AB31C: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90AB433

CloseHandle.KERNEL32 ref: 00007FF8B90AAED2
SetEvent.KERNEL32 ref: 00007FF8B90AAF27

Strings

$, xrefs: 00007FF8B90AACB4

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$AutoEvent$CloseCreateErrorHandleLastMessage
String ID: $
API String ID: 3185613287-3993045852
Opcode ID: 096dfecbe59222bc1f9c0b65a47521039350d6e8050f453a2acb67b19557d57a
Instruction ID: c5d0e3b29b034192ee1e6f8c752c41b0beb0af2eb22831a209020cce452f51e0
Opcode Fuzzy Hash: 096dfecbe59222bc1f9c0b65a47521039350d6e8050f453a2acb67b19557d57a
Instruction Fuzzy Hash: E4914732A18A8286EB24CF1AE4906AD37B5FB49BD8F414032DF4D57B64CF39E546DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A1A4C Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF8B90A1A72
GetLastError.KERNEL32 ref: 00007FF8B90A1A80

Part of subcall function 00007FF8B90A24D0: TraceMessage.ADVAPI32 ref: 00007FF8B90A257D
Part of subcall function 00007FF8B90A24D0: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A25C3

EnterCriticalSection.KERNEL32 ref: 00007FF8B90A1AC1
LeaveCriticalSection.KERNEL32 ref: 00007FF8B90A1B93
CloseHandle.KERNEL32 ref: 00007FF8B90A1BA0

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: CriticalSectionTrace$AutoCloseEnterErrorHandleLastLeaveMessageOpenProcess
String ID:
API String ID: 2031306231-0
Opcode ID: 3e2bb08ac1c2f13e974f2cdaca79f2374d0cb90e86d9eb2d476af5c7a330f06f
Instruction ID: dbe6f9dbfa23307279b4bc0777af963823d9049e27a4398a96fb3340d6a38ae5
Opcode Fuzzy Hash: 3e2bb08ac1c2f13e974f2cdaca79f2374d0cb90e86d9eb2d476af5c7a330f06f
Instruction Fuzzy Hash: 90416D72A18A8686EF608F19E4802797765FB94BE8F104136DB4D47B64DF3CE943C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A9600 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91windowCOMMON

Download Yara Rule

APIs

TraceMessage.ADVAPI32 ref: 00007FF8B90A96E8
WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A974E

Strings

NULL, xrefs: 00007FF8B90A9628
InsiderPreviewPatch01, xrefs: 00007FF8B90A9613

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$AutoMessage
String ID: InsiderPreviewPatch01$NULL
API String ID: 3974790930-884961456
Opcode ID: 2eb4c23508f2ef29a44afe2daf3477ce2fff856d3a3f1fbcbb8be093f61854a0
Instruction ID: b8b5e08c73806085cbd07ac2424c8169abd796c0db0acf0e38d813cb3d0312f2
Opcode Fuzzy Hash: 2eb4c23508f2ef29a44afe2daf3477ce2fff856d3a3f1fbcbb8be093f61854a0
Instruction Fuzzy Hash: F731AB32718B9185EB108F09E80075AB7A9F784BE4F444235EFAD43B94DF39D842C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A94BC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85windowCOMMON

Download Yara Rule

APIs

TraceMessage.ADVAPI32(?,?,?,?,?,?,InsiderPreviewPatch01,00007FF8B90A9464), ref: 00007FF8B90A958E
WppAutoLogTrace.WPPRECORDERUM(?,?,?,?,?,?,InsiderPreviewPatch01,00007FF8B90A9464), ref: 00007FF8B90A95DB

Strings

NULL, xrefs: 00007FF8B90A94E4
InsiderPreviewPatch01, xrefs: 00007FF8B90A94CF

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$AutoMessage
String ID: InsiderPreviewPatch01$NULL
API String ID: 3974790930-884961456
Opcode ID: 42168d8271cd299be1d8d30371282fe681c0d436852659867abbaaebbfde9337
Instruction ID: 9ae6c9d0f107b3205a97bc9f9ba74a17908314603731df016d8e0e07a48e2272
Opcode Fuzzy Hash: 42168d8271cd299be1d8d30371282fe681c0d436852659867abbaaebbfde9337
Instruction Fuzzy Hash: BC31C132718B9181EB148F29A805659B7A9F788BE4F484231EFAD43B95DF3CD853C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90AEA0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90AD890: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF8B90AD894

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF8B90AEA32
RaiseException.KERNEL32 ref: 00007FF8B90AEA5B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF8B90AEABC

Strings

csm, xrefs: 00007FF8B90AEA8F

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: 823ddda207a4dd51195e4671787722eba51f5941b724e0260e40f807ab11711d
Instruction ID: 95e948c7fa26b31753c737b88a498d25d178d4337d79a5ace7d4025643634931
Opcode Fuzzy Hash: 823ddda207a4dd51195e4671787722eba51f5941b724e0260e40f807ab11711d
Instruction Fuzzy Hash: B5211E36608A8186EA30DF59E04066E7B60F7A8BB5F144221DF9E07795CF3CE846CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90AA4C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00000018,00007FF8B90AAF14), ref: 00007FF8B90AA529
DuplicateHandle.KERNEL32 ref: 00007FF8B90AA550
GetLastError.KERNEL32 ref: 00007FF8B90AA55C

Part of subcall function 00007FF8B90A24D0: TraceMessage.ADVAPI32 ref: 00007FF8B90A257D
Part of subcall function 00007FF8B90A24D0: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A25C3

Strings

@, xrefs: 00007FF8B90AA545

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$AutoCurrentDuplicateErrorHandleLastMessageProcess
String ID: @
API String ID: 1247356310-2766056989
Opcode ID: 67e5f5490c3d454e8b1c4a7cc8738c7be903818a90e45f5893b4764a942c097b
Instruction ID: b55b21528bb4628340f796c20a85977065b40d660191274af07e1a0eae71b691
Opcode Fuzzy Hash: 67e5f5490c3d454e8b1c4a7cc8738c7be903818a90e45f5893b4764a942c097b
Instruction Fuzzy Hash: 16215372A08B8286EB60CF19E45026977B0FB89BD8F440134EB4D47B59DF3DE546DB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90AF14C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8B90AF190

Strings

RCC, xrefs: 00007FF8B90AF153
csm, xrefs: 00007FF8B90AF163
MOC, xrefs: 00007FF8B90AF15B

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: terminate
String ID: MOC$RCC$csm
API String ID: 1821763600-2671469338
Opcode ID: ee6917a798ecef4973d7d3b4ec4d4fe72bfcd9ad21f17a0a37251a6e57eff394
Instruction ID: 5ca2f183b0ec7921948066f1b547ad30e517a10ed53362ad51fe6912b214e138
Opcode Fuzzy Hash: ee6917a798ecef4973d7d3b4ec4d4fe72bfcd9ad21f17a0a37251a6e57eff394
Instruction Fuzzy Hash: CBF0303AD18186C6EBA42E9DC14527C3294EF94BF6FA55471C708473828F7CE8428BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A746C Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B90A8328: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90A835E

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8B90A75BE

Part of subcall function 00007FF8B90A2340: TraceMessage.ADVAPI32 ref: 00007FF8B90A23BC
Part of subcall function 00007FF8B90A2340: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A23DA

Strings

Target_, xrefs: 00007FF8B90A74E2
MonitorConnectionInfo, xrefs: 00007FF8B90A755D, 00007FF8B90A75E2
MonitorIndex, xrefs: 00007FF8B90A751C

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Tracememset$AutoMessage
String ID: MonitorConnectionInfo$MonitorIndex$Target_
API String ID: 2212811-1388336407
Opcode ID: 6e94b7cc79ccb3cd0481249f042a7643cee928777ec7d752cca1f47396928f99
Instruction ID: 1be381796bd7da044f7e3a93747a38927610ff94cf46f481a7fdace71949a2ac
Opcode Fuzzy Hash: 6e94b7cc79ccb3cd0481249f042a7643cee928777ec7d752cca1f47396928f99
Instruction Fuzzy Hash: 4D511A32F08A8289EF20CF69E8506AC2760AB597E8F544135DF4D57AA5DF38E547C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A28FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

TraceMessage.ADVAPI32 ref: 00007FF8B90A29FA
WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A2A72

Strings

NULL, xrefs: 00007FF8B90A2924

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: Trace$AutoMessage
String ID: NULL
API String ID: 3974790930-324932091
Opcode ID: 3958be23fc19336d7dd03439b4c9d1e2cab747305af9fd8e5f1ff0d2e02bc9a2
Instruction ID: 8b510492771ea4bea927b3d15fab494881c7bae18dd1976fd72350ef4060bbca
Opcode Fuzzy Hash: 3958be23fc19336d7dd03439b4c9d1e2cab747305af9fd8e5f1ff0d2e02bc9a2
Instruction Fuzzy Hash: 6541BD32618BD182DB208F19E84069AB7B8F784BA0F544235EF9D43B98DF38D952C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8B90A7A18 Relevance: 5.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B90A7A2E
LeaveCriticalSection.KERNEL32 ref: 00007FF8B90A7A41
CloseHandle.KERNEL32 ref: 00007FF8B90A7A4F
GetLastError.KERNEL32 ref: 00007FF8B90A7A59

Part of subcall function 00007FF8B90A23F4: WppAutoLogTrace.WPPRECORDERUM ref: 00007FF8B90A24B4

Memory Dump Source

Source File: 0000000D.00000002.4459129552.00007FF8B90A1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B90A0000, based on PE: true

Associated: 0000000D.00000002.4459113505.00007FF8B90A0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459149218.00007FF8B90B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459165976.00007FF8B90B5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000D.00000002.4459182943.00007FF8B90B6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff8b90a0000_WUDFHost.jbxd

Similarity

API ID: CriticalSection$AutoCloseEnterErrorHandleLastLeaveTrace
String ID:
API String ID: 4100837725-0
Opcode ID: 4b4167614deb192c73a699e9770e0b8d2a4b680929817ad647641f825cbb9811
Instruction ID: de4584044a279b85a10263c2f69bdd09818c095592049e618e7d91eff9080c61
Opcode Fuzzy Hash: 4b4167614deb192c73a699e9770e0b8d2a4b680929817ad647641f825cbb9811
Instruction Fuzzy Hash: 71011A32A08A8292EA548F19E4903296774FB8ABD4F444530DB4D47B68CF2CE567CB44

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ClickShare-Extension-Pack-01.01.02.0007.msi

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3f0638.rbs

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpDisplay.inf

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup32.exe

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\MirrorOpSetup64.exe

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_0.dll

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\amd64\MirrorOpVirtualDisplay1_2.dll

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\mirroropdisplay.cat

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_0.dll

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Extended Desktop Driver\IDDCx\x86\MirrorOpVirtualDisplay1_2.dll

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\clicksharelauncher.exe

C:\Program Files (x86)\Barco\ClickShare Extension Pack\Launcher\eula.txt

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Barco\ClickShare Launcher\ClickShare Launcher.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ClickShare Launcher.lnk

C:\Users\Public\MirrorOpDisplaySetup.log

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\MirrorOpDisplay.inf (copy)

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\SET1368.tmp

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\SET1379.tmp

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\SET1389.tmp

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_0.dll (copy)

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\MirrorOpVirtualDisplay1_2.dll (copy)

C:\Users\user\AppData\Local\Temp\{6d6f95e9-2155-cb49-8d2b-437f70f9d0f7}\amd64\SET11D0.tmp

Windows Analysis Report
ClickShare-Extension-Pack-01.01.02.0007.msi

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre